diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c48305b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/infra-deploy.yml b/.github/workflows/infra-deploy.yml index 08835314..a395dfe5 100644 --- a/.github/workflows/infra-deploy.yml +++ b/.github/workflows/infra-deploy.yml @@ -35,7 +35,7 @@ jobs: if : ${{ github.event.inputs.teardown != 'true' }} name: Lint bicep files steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Perform linting run: az bicep build --f bicep/main.bicep @@ -46,16 +46,16 @@ jobs: name: Create RG and Validate bicep template needs: [ lint ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Azure login - uses: azure/login@v1 + uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Create Resource Group if does not exist - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | if [[ $(az group exists -n ${{ vars.RESOURCE_GROUP }}) == true ]] @@ -66,7 +66,7 @@ jobs: echo "Resource group created" fi - - uses: azure/arm-deploy@v1 + - uses: azure/arm-deploy@65ae74fb7aec7c680c88ef456811f353adae4d06 # v1.0.9 name: Run validation with: deploymentName: ${{ github.run_number }} @@ -83,14 +83,14 @@ jobs: needs: [ validate ] name: Run what-if on the bicep template steps: - - uses: actions/checkout@v4 - - uses: azure/login@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 name: Sign in to Azure with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - uses: azure/arm-deploy@v1 + - uses: azure/arm-deploy@65ae74fb7aec7c680c88ef456811f353adae4d06 # v1.0.9 name: Run what-if with: resourceGroupName: ${{ vars.RESOURCE_GROUP }} @@ -105,15 +105,15 @@ jobs: if : ${{ vars.CONTAINER_REGISTRY_NAME != '' }} needs: [ preview ] steps: - - uses: actions/checkout@v4 - - uses: azure/login@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 name: Sign in to Azure with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Create ACR ${{ vars.CONTAINER_REGISTRY_NAME }} if does not exist - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | if [[ $(az acr check-name -n ${{ vars.CONTAINER_REGISTRY_NAME }} -o tsv --query "nameAvailable") == false ]] @@ -130,7 +130,7 @@ jobs: echo "ACR created" fi - name: Import images from GitHub Container Registry - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | az acr import --name ${{ vars.CONTAINER_REGISTRY_NAME }} --source ${{ env.REGISTRY }}/${{ env.BACKEND_PROCESSOR_IMAGE_NAME }}:latest --image tasksmanager/tasksmanager-backend-processor --force @@ -144,14 +144,14 @@ jobs: needs: [ create-acr] name: Deploy to Azure subscription with ACR steps: - - uses: actions/checkout@v4 - - uses: azure/login@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 name: Sign in to Azure with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - uses: azure/arm-deploy@v1 + - uses: azure/arm-deploy@65ae74fb7aec7c680c88ef456811f353adae4d06 # v1.0.9 id: deployment-with-acr-images name: Deploy to Azure subscription with: @@ -169,14 +169,14 @@ jobs: needs: [ preview ] name: Deploy to Azure subscription with GHCR steps: - - uses: actions/checkout@v4 - - uses: azure/login@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 name: Sign in to Azure with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - - uses: azure/arm-deploy@v1 + - uses: azure/arm-deploy@65ae74fb7aec7c680c88ef456811f353adae4d06 # v1.0.9 id: deployment-with-ghcr-images name: Deploy to Azure subscription with: @@ -192,15 +192,15 @@ jobs: runs-on: ubuntu-latest if : ${{ github.event.inputs.teardown == 'true' }} steps: - - uses: actions/checkout@v4 - - uses: azure/login@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1 name: Sign in to Azure with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Delete Resource Group if exist - uses: azure/CLI@v1 + uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1.0.9 with: inlineScript: | if [[ $(az group exists -n ${{ vars.RESOURCE_GROUP }}) == true ]] diff --git a/.github/workflows/preview-docs.yml b/.github/workflows/preview-docs.yml index 8fc74203..5ea68776 100644 --- a/.github/workflows/preview-docs.yml +++ b/.github/workflows/preview-docs.yml @@ -31,9 +31,9 @@ jobs: runs-on: ubuntu-latest name: Build steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" - name: Capture branch and tag @@ -48,7 +48,7 @@ jobs: make build-docs-website - name: Release preview to branch if: "! github.event.pull_request.head.repo.fork " - uses: rossjrw/pr-preview-action@v1 + uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1.8.1 with: source-dir: ./dist/ preview-branch: gh-pages diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml index f85facdc..77dd7bcc 100644 --- a/.github/workflows/publish-docs.yml +++ b/.github/workflows/publish-docs.yml @@ -19,15 +19,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: gh-pages - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: '.' - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 \ No newline at end of file + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 \ No newline at end of file diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml index 8f698990..4851a5e0 100644 --- a/.github/workflows/publish-images.yml +++ b/.github/workflows/publish-images.yml @@ -28,8 +28,8 @@ jobs: frontend: ${{ steps.filter.outputs.frontend }} processor: ${{ steps.filter.outputs.processor }} steps: - - uses: actions/checkout@v4 - - uses: dorny/paths-filter@v2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: filters: | @@ -51,7 +51,7 @@ jobs: steps: - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # v1.10.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -59,7 +59,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 with: images: ${{ env.REGISTRY }}/${{ env.BACKEND_API_IMAGE_NAME }} tags: | @@ -68,7 +68,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: file: ./TasksTracker.TasksManager.Backend.Api/Dockerfile push: true @@ -86,7 +86,7 @@ jobs: steps: - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # v1.10.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -94,7 +94,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 with: images: ${{ env.REGISTRY }}/${{ env.FRONTEND_APP_IMAGE_NAME }} tags: | @@ -103,7 +103,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: file: ./TasksTracker.WebPortal.Frontend.Ui/Dockerfile push: true @@ -121,7 +121,7 @@ jobs: steps: - name: Log in to the Container registry - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 + uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 # v1.10.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -129,7 +129,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 with: images: ${{ env.REGISTRY }}/${{ env.BACKEND_PROCESSOR_IMAGE_NAME }} tags: | @@ -138,7 +138,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v4 + uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4.2.1 with: file: ./TasksTracker.Processor.Backend.Svc/Dockerfile push: true diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml index 36e40c36..b8e29cf3 100644 --- a/.github/workflows/release-docs.yml +++ b/.github/workflows/release-docs.yml @@ -25,9 +25,9 @@ jobs: runs-on: ubuntu-latest name: Build steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.12" - name: Capture branch and tag @@ -39,7 +39,7 @@ jobs: run: | make build-docs-website - name: Release all docs to branch - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: folder: ./dist branch: gh-pages