Skip to content

Use commit sha in GH Actions#1924

Merged
alvneiayu merged 2 commits intomainfrom
pinGHActions
Mar 25, 2026
Merged

Use commit sha in GH Actions#1924
alvneiayu merged 2 commits intomainfrom
pinGHActions

Conversation

@carrodher
Copy link
Copy Markdown
Contributor

@carrodher carrodher commented Mar 25, 2026

Following best practices, we are pinning the commit SHA instead of using a rolling tag for the different GitHub Actions used in this project.

At this moment, the actions used are:

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5.5
uses: carvel-dev/setup-action@a11507416d8fea298e923fe4356f4e4f4097f15b # v1.3.0
uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b # v2.0.0
uses: docker/metadata-action@69f6fc9d46f2f8bf0d5491e4aabe0bb8c6a4678a # v4.0.1
uses: docker/setup-buildx-action@dc7b9719a96d48369863986a06765841d7ea23f6 # v2.0.0
uses: docker/setup-qemu-action@8b122486cedac8393e77aa9734c3528886e4a1a8 # v2.0.0
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
uses: helm/chart-releaser-action@98bccfd32b0f76149d188912ac8e45ddd3f8695f # v1.4.1
uses: medyagh/setup-minikube@e9e035a86bbc3caea26a450bd4dbf9d0c453682e # v0.0.21
uses: sigstore/cosign-installer@0f983226cbf1ee0368469d3e2b33417ceec4c225 # v3.0.2
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4
uses: vmware-labs/vmware-image-builder-action@90ab5b51680627fe01ea9b2d9ba5d7c9db4c56bc # v0.11.0

Signed-off-by: Carlos Rodríguez Hernández <carlos.rodriguez-hernandez@broadcom.com>

ai-assisted=no
Comment thread .github/workflows/helm-vib-lint.yaml Dismissed
alvneiayu
alvneiayu previously approved these changes Mar 25, 2026
@alvneiayu alvneiayu self-requested a review March 25, 2026 11:56
Signed-off-by: Carlos Rodríguez Hernández <carlos.rodriguez-hernandez@broadcom.com>

ai-assisted=no
@alvneiayu alvneiayu merged commit 57530e5 into main Mar 25, 2026
28 of 33 checks passed
@alvneiayu alvneiayu deleted the pinGHActions branch March 25, 2026 12:22
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Apr 10, 2026
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [bitnami-labs/sealed-secrets](https://github.com/bitnami-labs/sealed-secrets) | patch | `v0.36.1` → `v0.36.6` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>bitnami-labs/sealed-secrets (bitnami-labs/sealed-secrets)</summary>

### [`v0.36.6`](https://github.com/bitnami-labs/sealed-secrets/blob/HEAD/RELEASE-NOTES.md#v0366)

[Compare Source](bitnami-labs/sealed-secrets@v0.36.5...v0.36.6)

- Incomplete release for dockerhub credentials problems

### [`v0.36.5`](https://github.com/bitnami-labs/sealed-secrets/blob/HEAD/RELEASE-NOTES.md#v0365)

[Compare Source](bitnami-labs/sealed-secrets@v0.36.4...v0.36.5)

- Incomplete release for dockerhub credentials problems

### [`v0.36.4`](https://github.com/bitnami-labs/sealed-secrets/blob/HEAD/RELEASE-NOTES.md#v0364)

[Compare Source](bitnami-labs/sealed-secrets@v0.36.3...v0.36.4)

- ci: bump K8s integration matrix to latest 1.33/1.34/1.35 patches ([#&#8203;1935](bitnami-labs/sealed-secrets#1935))

### [`v0.36.3`](https://github.com/bitnami-labs/sealed-secrets/blob/HEAD/RELEASE-NOTES.md#v0363)

[Compare Source](bitnami-labs/sealed-secrets@v0.36.2...v0.36.3)

- Incomplete release for dockerhub credentials problems

### [`v0.36.2`](https://github.com/bitnami-labs/sealed-secrets/blob/HEAD/RELEASE-NOTES.md#v0362)

[Compare Source](bitnami-labs/sealed-secrets@v0.36.1...v0.36.2)

- Bump Golang to 1.26.2 ([#&#8203;1931](bitnami-labs/sealed-secrets#1931))
- Remove unneeded internal tests ([#&#8203;1930](bitnami-labs/sealed-secrets#1930))
- fix: send INFO logs to stdout by default ([#&#8203;1925](bitnami-labs/sealed-secrets#1925))
- Use commit sha in GH Actions ([#&#8203;1924](bitnami-labs/sealed-secrets#1924))
- Bump k8s.io/code-generator from 0.35.2 to 0.35.3 ([#&#8203;1922](bitnami-labs/sealed-secrets#1922))
- Bump k8s.io/client-go from 0.35.2 to 0.35.3 ([#&#8203;1920](bitnami-labs/sealed-secrets#1920))
- Bump golang.org/x/crypto from 0.48.0 to 0.49.0 ([#&#8203;1918](bitnami-labs/sealed-secrets#1918))
- Bump distroless/static from `28efbe9` to `47b2d72` in /docker ([#&#8203;1919](bitnami-labs/sealed-secrets#1919))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuOCIsInVwZGF0ZWRJblZlciI6IjQzLjExMC44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiLCJhdXRvbWF0aW9uOmJvdC1hdXRob3JlZCIsImRlcGVuZGVuY3ktdHlwZTo6cGF0Y2giXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants