From 909cdcfdbf15165d9f9937f605796c250f7d21ca Mon Sep 17 00:00:00 2001 From: Michael Keller Date: Sat, 31 Oct 2026 14:42:44 +1300 Subject: [PATCH 1/3] ci: lock GitHub Actions dependencies and verify pull requests Narrow existing action version tags to full releases and record their resolved commits in actions.lock. This makes build and release action updates reviewable without replacing readable uses references with SHAs. Add weekly Dependabot GitHub Actions updates and a contents-read-only pull request job that verifies the lockfile without writing to the checkout. Existing C build targets and release behaviour remain unchanged. Signed-off-by: Michael Keller --- .github/dependabot.yml | 6 +++++ .github/workflows/actions.lock | 35 +++++++++++++++++++++++++++ .github/workflows/build.yml | 24 +++++++++--------- .github/workflows/release.yml | 2 +- .github/workflows/verify-lockfile.yml | 26 ++++++++++++++++++++ 5 files changed, 80 insertions(+), 13 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/verify-lockfile.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..5ace4600 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..a0408cfd --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,35 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/build.yml': + - 'actions/checkout@v6.1.0' + - 'actions/upload-artifact@v7.0.2' + - 'microsoft/setup-msbuild@v3.0.0' + - 'msys2/setup-msys2@v2.33.0' + '.github/workflows/release.yml': + - 'actions/checkout@v6.1.0' + '.github/workflows/verify-lockfile.yml': + - 'actions/checkout@v6.1.0' +dependencies: + 'actions/checkout@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803' + owner_id: 44036562 + repo_id: 197814629 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'microsoft/setup-msbuild@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-30375c66a4eea26614e0d39710365f22f8b0af57' + owner_id: 6154722 + repo_id: 237360465 + 'msys2/setup-msys2@v2.33.0': + ref: 'v2.33.0' + commit: 'sha1-ec48f7c5447b3140e2b088413ae3a55687bccb6e' + owner_id: 6759993 + repo_id: 213203501 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b8b29689..2ccaa8b7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,7 @@ jobs: CC: ${{ matrix.compiler }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - name: Install dependencies run: | sudo apt-get update @@ -32,7 +32,7 @@ jobs: run: | make install DESTDIR=$PWD/artifacts tar -czf ${{ github.job }}-${{ matrix.compiler }}.tar.gz -C artifacts usr/local - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: path: ${{ github.job }}-${{ matrix.compiler }}.tar.gz archive: false @@ -52,7 +52,7 @@ jobs: CC: ${{ matrix.compiler }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - name: Install dependencies run: brew install autoconf automake libtool hidapi libusb - run: autoreconf --install --force @@ -63,7 +63,7 @@ jobs: run: | make install DESTDIR=$PWD/artifacts tar -czf ${{ github.job }}-${{ matrix.compiler }}.tar.gz -C artifacts usr/local - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: path: ${{ github.job }}-${{ matrix.compiler }}.tar.gz archive: false @@ -80,7 +80,7 @@ jobs: arch: [i686, x86_64] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - name: Install dependencies run: | sudo apt-get update @@ -122,7 +122,7 @@ jobs: run: | make install DESTDIR=$PWD/artifacts tar -czf ${{ github.job }}-${{ matrix.arch }}.tar.gz -C artifacts usr/local - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: path: ${{ github.job }}-${{ matrix.arch }}.tar.gz archive: false @@ -142,8 +142,8 @@ jobs: CONFIGURATION: Release steps: - - uses: actions/checkout@v6 - - uses: msys2/setup-msys2@v2 + - uses: actions/checkout@v6.1.0 + - uses: msys2/setup-msys2@v2.33.0 with: install: autoconf automake libtool pkg-config make gcc - run: | @@ -151,9 +151,9 @@ jobs: ./configure make -C src revision.h shell: msys2 {0} - - uses: microsoft/setup-msbuild@v3 + - uses: microsoft/setup-msbuild@v3.0.0 - run: msbuild -m -p:Platform=${{ matrix.platform }} -p:Configuration=${{ env.CONFIGURATION }} contrib/msvc/libdivecomputer.vcxproj - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: name: ${{ github.job }}-${{ matrix.platform }}.zip path: contrib/msvc/${{ matrix.platform }}/${{ env.CONFIGURATION }}/bin @@ -165,13 +165,13 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - run: | autoreconf --install --force ./configure make -C src revision.h - run: $ANDROID_NDK/ndk-build -C contrib/android NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=Android.mk - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: name: ${{ github.job }}.zip path: contrib/android/libs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f9b2d789..8cbc7879 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,7 +9,7 @@ jobs: name: Release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - name: Version number id: version diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml new file mode 100644 index 00000000..06f645c5 --- /dev/null +++ b/.github/workflows/verify-lockfile.yml @@ -0,0 +1,26 @@ +name: Verify workflow lockfile + +on: + pull_request: + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@v6.1.0 + with: + persist-credentials: false + + - name: Install lockfile verifier + run: gh extension install github/gh-actions-lock --pin v0.4.0 + env: + GH_TOKEN: ${{ github.token }} + + - name: Verify lockfile + run: gh actions-lock --verify + env: + GH_TOKEN: ${{ github.token }} From a2025ddb976631d9ace87d1c1c13d3d76e2c82d7 Mon Sep 17 00:00:00 2001 From: Michael Keller Date: Sun, 1 Nov 2026 15:08:46 +1300 Subject: [PATCH 2/3] ci: Restrict build checkout credentials and token permissions Signed-off-by: Michael Keller --- .github/workflows/build.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 029241e9..e5368148 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -2,6 +2,9 @@ name: Build on: [push, pull_request] +permissions: + contents: read + jobs: linux: @@ -20,6 +23,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - name: Install dependencies run: | sudo apt-get update @@ -53,6 +58,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - name: Install dependencies run: brew install autoconf automake libtool hidapi libusb - run: autoreconf --install --force @@ -81,6 +88,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - name: Install dependencies run: | sudo apt-get update @@ -143,6 +152,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - uses: msys2/setup-msys2@v2.33.0 with: install: autoconf automake libtool pkg-config make gcc @@ -166,6 +177,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - run: | autoreconf --install --force ./configure @@ -191,6 +204,8 @@ jobs: steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - name: Install dependencies run: | sudo apt-get update From 97e779cd2c81d535e8002c543513822b8d2785fe Mon Sep 17 00:00:00 2001 From: Michael Keller Date: Sun, 1 Nov 2026 15:08:51 +1300 Subject: [PATCH 3/3] ci: Restrict release checkout credentials and token scopes Signed-off-by: Michael Keller --- .github/workflows/release.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8cbc7879..e62f4f96 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,12 +4,17 @@ on: push: tags: 'v*' +permissions: + contents: write + jobs: release: name: Release runs-on: ubuntu-latest steps: - uses: actions/checkout@v6.1.0 + with: + persist-credentials: false - name: Version number id: version