This is an automated email from the ASF dual-hosted git repository. NiklasMerz pushed a commit to branch ci-harden in repository https://gitbox.apache.org/repos/asf/cordova-ios.git
commit 6523d23f9dd42404c34b1ad803dce96acb180175 Author: Niklas Merz <[email protected]> AuthorDate: Mon May 18 19:20:59 2026 +0200 chore(ci): pin actions and set caching for atr --- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/draft-release.yml | 21 +++++++++++++-------- .github/workflows/release-audit.yml | 9 ++++++--- 3 files changed, 27 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1e049d49..a8e7839e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,10 +45,10 @@ jobs: CDV_IOS_SIM: ${{ matrix.os == 'macos-26' && 'iPhone 17' || 'iPhone 16e' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node-version }} @@ -58,7 +58,7 @@ jobs: npm --version xcodebuild -version - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: languages: javascript queries: security-and-quality @@ -80,7 +80,7 @@ jobs: env: CI: true - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 # v4.6.0 - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 @@ -99,10 +99,10 @@ jobs: os: [ubuntu-latest, windows-latest] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node-version }} @@ -111,7 +111,7 @@ jobs: node --version npm --version - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 with: languages: javascript queries: security-and-quality @@ -130,7 +130,7 @@ jobs: env: CI: true - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 # v4.6.0 - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml index 98ecf5a2..a3304eb4 100644 --- a/.github/workflows/draft-release.yml +++ b/.github/workflows/draft-release.yml @@ -31,10 +31,15 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 1 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 + package-manager-cache: false + cache: '' - name: Setup environment variables run: | @@ -68,14 +73,14 @@ jobs: - name: Verify Target Release Version run: | PACKAGE_VERSION=$(jq -r '.version' package.json) - if [ $PACKAGE_VERSION != "$TARGET_RELEASE_VERSION" ]; then + if [ "$PACKAGE_VERSION" != "$TARGET_RELEASE_VERSION" ]; then echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and package version ($PACKAGE_VERSION)" exit 1 fi if [ -f "plugin.xml" ]; then - PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml) - if [ $PLUGIN_VERSION != "$TARGET_RELEASE_VERSION" ]; then + PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml | jq -r .) + if [ "$PLUGIN_VERSION" != "$TARGET_RELEASE_VERSION" ]; then echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and plugin version ($PLUGIN_VERSION)" exit 1 fi @@ -83,7 +88,7 @@ jobs: - name: Generate "tgz" npm convenience package run: |- - npm install + npm ci NPM_PKG_NAME=$(npm pack --json | jq -r '.[0].filename') mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${NPM_PACKAGE_NAME}.tgz env: @@ -142,8 +147,8 @@ jobs: CORDOVA_GPG_SECRET_KEY: ${{ secrets.CORDOVA_GPG_SECRET_KEY }} - name: Upload to Apache Trusted Release (ATR) - uses: apache/tooling-actions/upload-to-atr@b7e972c11790ee16eca101900af1b3c7fd1b106e + uses: apache/tooling-actions/upload-to-atr@f5f4c0e7ddfbde6b1f8288cef36324c6def68051 with: project: ${{ env.REPO_NAME }} version: ${{ env.TARGET_RELEASE_VERSION }} - src: .asf-release + src: .asf-release \ No newline at end of file diff --git a/.github/workflows/release-audit.yml b/.github/workflows/release-audit.yml index 52798d4a..497bdfa0 100644 --- a/.github/workflows/release-audit.yml +++ b/.github/workflows/release-audit.yml @@ -34,13 +34,16 @@ jobs: runs-on: ubuntu-latest steps: # Checkout project - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 1 # Check license headers (v2.0.0) - uses: erisu/apache-rat-action@46fb01ce7d8f76bdcd7ab10e7af46e1ea95ca01c # Setup environment with node - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 @@ -52,4 +55,4 @@ jobs: - uses: erisu/license-checker-action@99cffa11264fe545fd0baa6c13bca5a00ae608f2 with: license-config: 'licence_checker.yml' - include-asf-category-a: true + include-asf-category-a: true \ No newline at end of file --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
