From af757db5e80fc745a48ba4b7aef758565123d935 Mon Sep 17 00:00:00 2001 From: Diogo Teles Sant'Anna Date: Wed, 25 Oct 2023 00:32:53 -0300 Subject: [PATCH] GH-36898: [CI] Hashpin Sensitive GitHub Actions (#37676) ### Rationale for this change Explained on issue #36898 ### What changes are included in this PR? For security reasons, it hashpins the calls for github actions that are called with sensitive permission (usually `pull-requests: write`) or with secrets used on the same context. I'm not hashpinning every action call because the tag-pinning flexibility can be useful if used with caution, e.g. in testing environment. ### Are these changes tested? Not tested, but the changes on this PR shouldn't change any comportment of the CI, as we'd still be using the exact same version, but pinned differently. ### Are there any user-facing changes? No * Closes: #36898 Authored-by: Diogo Teles Sant'Anna Signed-off-by: Jacob Wujciak-Jens --- .github/workflows/comment_bot.yml | 20 ++++++++++---------- .github/workflows/cpp.yml | 4 ++-- .github/workflows/dev.yml | 12 ++++++------ .github/workflows/dev_pr.yml | 10 +++++----- .github/workflows/docs.yml | 6 +++--- .github/workflows/docs_light.yml | 6 +++--- .github/workflows/go.yml | 22 +++++++++++----------- .github/workflows/integration.yml | 8 ++++---- .github/workflows/issue_bot.yml | 2 +- .github/workflows/java.yml | 6 +++--- .github/workflows/java_jni.yml | 12 ++++++------ .github/workflows/java_nightly.yml | 6 +++--- .github/workflows/js.yml | 4 ++-- .github/workflows/pr_bot.yml | 6 +++--- .github/workflows/python.yml | 6 +++--- .github/workflows/r.yml | 14 +++++++------- .github/workflows/r_nightly.yml | 8 ++++---- .github/workflows/ruby.yml | 6 +++--- .github/workflows/swift.yml | 2 +- 19 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.github/workflows/comment_bot.yml b/.github/workflows/comment_bot.yml index cc9e02d955afd..f27d95c4e8cd7 100644 --- a/.github/workflows/comment_bot.yml +++ b/.github/workflows/comment_bot.yml @@ -35,13 +35,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: path: arrow # fetch the tags for version number generation fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Install Archery and Crossbow dependencies @@ -60,8 +60,8 @@ jobs: if: startsWith(github.event.comment.body, '@github-actions autotune') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: r-lib/actions/pr-fetch@v2 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + - uses: r-lib/actions/pr-fetch@11a22a908006c25fe054c4ef0ac0436b1de3edbe # v2.6.4 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: See what is different @@ -121,7 +121,7 @@ jobs: --clang_format_binary=clang-format-${CLANG_TOOLS} \ --exclude_glob=cpp/build-support/lint_exclusions.txt \ --source_dir=r/src --quiet --fix - - uses: r-lib/actions/setup-r@v2 + - uses: r-lib/actions/setup-r@11a22a908006c25fe054c4ef0ac0436b1de3edbe # v2.6.4 if: env.R_DOCS == 'true' || env.R_CODE == 'true' || endsWith(github.event.comment.body, 'everything') - name: Update R docs if: env.R_DOCS == 'true' || endsWith(github.event.comment.body, 'everything') @@ -149,7 +149,7 @@ jobs: git config user.name "$(git log -1 --pretty=format:%an)" git config user.email "$(git log -1 --pretty=format:%ae)" git commit -a -m 'Autoformat/render all the things [automated commit]' || echo "No changes to commit" - - uses: r-lib/actions/pr-push@v2 + - uses: r-lib/actions/pr-push@11a22a908006c25fe054c4ef0ac0436b1de3edbe # v2.6.4 with: repo-token: ${{ secrets.GITHUB_TOKEN }} @@ -158,8 +158,8 @@ jobs: if: startsWith(github.event.comment.body, '@github-actions rebase') runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: r-lib/actions/pr-fetch@v2 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + - uses: r-lib/actions/pr-fetch@11a22a908006c25fe054c4ef0ac0436b1de3edbe # v2.6.4 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Rebase on ${{ github.repository }} default branch @@ -170,7 +170,7 @@ jobs: git remote add upstream https://github.com/${{ github.repository }} git fetch --unshallow upstream ${{ github.event.repository.default_branch }} git rebase upstream/${{ github.event.repository.default_branch }} - - uses: r-lib/actions/pr-push@v2 + - uses: r-lib/actions/pr-push@11a22a908006c25fe054c4ef0ac0436b1de3edbe # v2.6.4 with: repo-token: ${{ secrets.GITHUB_TOKEN }} args: "--force" @@ -182,7 +182,7 @@ jobs: if: github.event.comment.body == 'take' runs-on: ubuntu-latest steps: - - uses: actions/github-script@v6 + - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/cpp.yml b/.github/workflows/cpp.yml index a9361f9f51378..e6ae6c60b0f4c 100644 --- a/.github/workflows/cpp.yml +++ b/.github/workflows/cpp.yml @@ -96,12 +96,12 @@ jobs: UBUNTU: ${{ matrix.ubuntu }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: ${{ matrix.image }}-${{ hashFiles('cpp/**') }} diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index cfa9ffb49d7ad..df2b20a9e3c77 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -37,11 +37,11 @@ jobs: if: ${{ !contains(github.event.pull_request.title, 'WIP') }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -84,19 +84,19 @@ jobs: GIT_COMMITTER_EMAIL: "github-actions[bot]@users.noreply.github.com" steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Install Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.8' - name: Install Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939 # v1.152.0 with: ruby-version: '2.7' - name: Install .NET - uses: actions/setup-dotnet@v3 + uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3.2.0 with: dotnet-version: '7.0.x' - name: Install Dependencies diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml index e5d2a77c5a8a2..78b01b561f3cb 100644 --- a/.github/workflows/dev_pr.yml +++ b/.github/workflows/dev_pr.yml @@ -43,7 +43,7 @@ jobs: name: Process runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: repository: apache/arrow ref: main @@ -53,7 +53,7 @@ jobs: if: | (github.event.action == 'opened' || github.event.action == 'edited') - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -64,7 +64,7 @@ jobs: if: | (github.event.action == 'opened' || github.event.action == 'edited') - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -75,7 +75,7 @@ jobs: if: | (github.event.action == 'opened' || github.event.action == 'edited') - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: debug: true github-token: ${{ secrets.GITHUB_TOKEN }} @@ -87,7 +87,7 @@ jobs: if: | (github.event.action == 'opened' || github.event.action == 'synchronize') - uses: actions/labeler@v4 + uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} configuration-path: .github/workflows/dev_pr/labeler.yml diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index a1ac4c3067dae..b30e1eb8809db 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -38,20 +38,20 @@ jobs: UBUNTU: "22.04" steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Free up disk space run: | ci/scripts/util_free_space.sh - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: ubuntu-docs-${{ hashFiles('cpp/**') }} restore-keys: ubuntu-docs- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/docs_light.yml b/.github/workflows/docs_light.yml index 74e6eabe24795..e96ccecdff598 100644 --- a/.github/workflows/docs_light.yml +++ b/.github/workflows/docs_light.yml @@ -47,17 +47,17 @@ jobs: PYTHON: "3.9" steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: conda-docs-${{ hashFiles('cpp/**') }} restore-keys: conda-docs- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index a0dfb9fea1673..11668aaf1b301 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -73,7 +73,7 @@ jobs: GO: ${{ matrix.go }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive @@ -106,7 +106,7 @@ jobs: github.event_name == 'push' && github.repository == 'apache/arrow' && github.ref_name == 'main' - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: ${{ matrix.go }} cache: true @@ -162,12 +162,12 @@ jobs: GO: ${{ matrix.go }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -203,11 +203,11 @@ jobs: GO: ${{ matrix.go }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -240,12 +240,12 @@ jobs: go: [1.19, '1.20'] steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Install go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: ${{ matrix.go }} cache: true @@ -273,12 +273,12 @@ jobs: go: [1.19, '1.20'] steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Install go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: ${{ matrix.go }} cache: true @@ -299,7 +299,7 @@ jobs: github.event_name == 'push' && github.repository == 'apache/arrow' && github.ref_name == 'main' - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: '3.10' - name: Run Benchmarks diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 430b0bb2822e7..bd99b62a2fe02 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -62,12 +62,12 @@ jobs: timeout-minutes: 60 steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Checkout Arrow Rust - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: repository: apache/arrow-rs path: rust @@ -75,13 +75,13 @@ jobs: run: | ci/scripts/util_free_space.sh - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: conda-${{ hashFiles('cpp/**') }} restore-keys: conda- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/issue_bot.yml b/.github/workflows/issue_bot.yml index ae344a4c1eba9..86d1858c8c596 100644 --- a/.github/workflows/issue_bot.yml +++ b/.github/workflows/issue_bot.yml @@ -33,7 +33,7 @@ jobs: if: github.event.issue.pull_request == null runs-on: ubuntu-latest steps: - - uses: actions/github-script@v6 + - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | let split_body = context.payload.issue.body.split('### Component(s)'); diff --git a/.github/workflows/java.yml b/.github/workflows/java.yml index 76bc57a6c712c..444bec2c73b61 100644 --- a/.github/workflows/java.yml +++ b/.github/workflows/java.yml @@ -80,18 +80,18 @@ jobs: MAVEN: ${{ matrix.maven }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: maven-${{ hashFiles('java/**') }} restore-keys: maven- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/java_jni.yml b/.github/workflows/java_jni.yml index 467e8a88af5d3..76b10b828ee49 100644 --- a/.github/workflows/java_jni.yml +++ b/.github/workflows/java_jni.yml @@ -56,7 +56,7 @@ jobs: timeout-minutes: 500 steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive @@ -64,13 +64,13 @@ jobs: run: | ci/scripts/util_free_space.sh - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: java-jni-manylinux-2014-${{ hashFiles('cpp/**', 'java/**') }} restore-keys: java-jni-manylinux-2014- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -99,18 +99,18 @@ jobs: timeout-minutes: 90 steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: maven-${{ hashFiles('java/**') }} restore-keys: maven- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/java_nightly.yml b/.github/workflows/java_nightly.yml index 41843d663051a..11aa4e59beefd 100644 --- a/.github/workflows/java_nightly.yml +++ b/.github/workflows/java_nightly.yml @@ -43,7 +43,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 1 path: arrow @@ -51,14 +51,14 @@ jobs: ref: main submodules: recursive - name: Checkout Crossbow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 path: crossbow repository: ursacomputing/crossbow ref: main - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: cache: 'pip' python-version: 3.8 diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml index 781b2023e2f42..b2040a76dec48 100644 --- a/.github/workflows/js.yml +++ b/.github/workflows/js.yml @@ -47,11 +47,11 @@ jobs: timeout-minutes: 60 steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/pr_bot.yml b/.github/workflows/pr_bot.yml index 617f3f2e017a3..596d3511a543d 100644 --- a/.github/workflows/pr_bot.yml +++ b/.github/workflows/pr_bot.yml @@ -40,7 +40,7 @@ jobs: - name: 'Download PR review payload' id: 'download' if: github.event_name == 'workflow_run' - uses: actions/github-script@v6 + uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1 with: script: | const run_id = "${{ github.event.workflow_run.id }}"; @@ -73,7 +73,7 @@ jobs: curl -sL -o committers.yml $url echo "committers_path=$(pwd)/committers.yml" >> $GITHUB_OUTPUT - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: path: arrow repository: apache/arrow @@ -82,7 +82,7 @@ jobs: # fetch the tags for version number generation fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Install Archery and Crossbow dependencies diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index 7a8fd8d10c235..d201f90101de8 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -89,18 +89,18 @@ jobs: NUMPY: ${{ matrix.numpy || 'latest' }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: ${{ matrix.cache }}-${{ hashFiles('cpp/**') }} restore-keys: ${{ matrix.cache }}- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml index a8680aea56d48..db10e6f28ce1c 100644 --- a/.github/workflows/r.yml +++ b/.github/workflows/r.yml @@ -68,12 +68,12 @@ jobs: UBUNTU: ${{ matrix.ubuntu }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker # As this key is identical on both matrix builds only one will be able to successfully cache, @@ -83,7 +83,7 @@ jobs: ubuntu-${{ matrix.ubuntu }}-r-${{ matrix.r }}-${{ hashFiles('cpp/src/**/*.cc','cpp/src/**/*.h)') }}- ubuntu-${{ matrix.ubuntu }}-r-${{ matrix.r }}- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -106,7 +106,7 @@ jobs: if: always() - name: Save the test output if: always() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: test-output path: r/check/arrow.Rcheck/tests/testthat.Rout* @@ -139,12 +139,12 @@ jobs: DEVTOOLSET_VERSION: ${{ matrix.config.devtoolset }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery @@ -168,7 +168,7 @@ jobs: if: always() - name: Save the test output if: always() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: test-output path: r/check/arrow.Rcheck/tests/testthat.Rout* diff --git a/.github/workflows/r_nightly.yml b/.github/workflows/r_nightly.yml index 7f21d4658e007..5a34239721392 100644 --- a/.github/workflows/r_nightly.yml +++ b/.github/workflows/r_nightly.yml @@ -45,7 +45,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 1 path: arrow @@ -53,14 +53,14 @@ jobs: ref: main submodules: recursive - name: Checkout Crossbow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 path: crossbow repository: ursacomputing/crossbow ref: main - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: cache: 'pip' python-version: 3.8 @@ -86,7 +86,7 @@ jobs: exit 1 fi - name: Cache Repo - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: repo key: r-nightly-${{ github.run_id }} diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index 2e4b98c2428e9..b9a4ac03b6108 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -71,18 +71,18 @@ jobs: UBUNTU: ${{ matrix.ubuntu }} steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive - name: Cache Docker Volumes - uses: actions/cache@v3 + uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1 with: path: .docker key: ubuntu-${{ matrix.ubuntu }}-ruby-${{ hashFiles('cpp/**') }} restore-keys: ubuntu-${{ matrix.ubuntu }}-ruby- - name: Setup Python - uses: actions/setup-python@v4 + uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0 with: python-version: 3.8 - name: Setup Archery diff --git a/.github/workflows/swift.yml b/.github/workflows/swift.yml index 825921ac6fa24..f55e9e77503c0 100644 --- a/.github/workflows/swift.yml +++ b/.github/workflows/swift.yml @@ -51,7 +51,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout Arrow - uses: actions/checkout@v4 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 submodules: recursive