From 3b9f12901eeacbe0a68056d1b245edcca4e3c467 Mon Sep 17 00:00:00 2001 From: xopenwrt Date: Mon, 29 Jun 2026 22:03:40 +0800 Subject: [PATCH] pin workflow actions --- .github/workflows/X-x86_64_X.yml | 20 ++++++++++---------- .github/workflows/X-x86_64_Y.yml | 20 ++++++++++---------- .github/workflows/X-x86_64_Z.yml | 20 ++++++++++---------- AI_CHANGELOG_PINNED_WORKFLOW_ACTIONS.md | 17 +++++++++++++++++ 4 files changed, 47 insertions(+), 30 deletions(-) create mode 100644 AI_CHANGELOG_PINNED_WORKFLOW_ACTIONS.md diff --git a/.github/workflows/X-x86_64_X.yml b/.github/workflows/X-x86_64_X.yml index 356187e..d7880ff 100644 --- a/.github/workflows/X-x86_64_X.yml +++ b/.github/workflows/X-x86_64_X.yml @@ -86,7 +86,7 @@ jobs: fi - name: Maximize Build Space - uses: easimon/maximize-build-space@master + uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794 with: root-reserve-mb: 4096 swap-size-mb: 512 @@ -95,7 +95,7 @@ jobs: remove-android: 'true' - name: Checkout - uses: actions/checkout@main + uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22 with: fetch-depth: 0 @@ -172,7 +172,7 @@ jobs: - name: Accelerate if: env.CACHE_ACCELERATE == 'true' - uses: klever1988/cachewrtbuild@main + uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121 with: ccache: false toolchain: true @@ -283,14 +283,14 @@ jobs: cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r - name: Upload Firmware to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }} path: openwrt/bin/Firmware - name: Upload bin to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }} @@ -334,7 +334,7 @@ jobs: echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV - name: 1 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }} @@ -344,7 +344,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 2 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }} @@ -354,7 +354,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }} @@ -364,7 +364,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 6 Upload SP_LEGACY_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }} @@ -399,7 +399,7 @@ jobs: overwrite: true - name: Delete old Workflow Runs - uses: GitRML/delete-workflow-runs@main + uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled() with: retain_days: 1 diff --git a/.github/workflows/X-x86_64_Y.yml b/.github/workflows/X-x86_64_Y.yml index 1318040..d0fbc2a 100644 --- a/.github/workflows/X-x86_64_Y.yml +++ b/.github/workflows/X-x86_64_Y.yml @@ -71,7 +71,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Maximize Build Space - uses: easimon/maximize-build-space@master + uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794 with: root-reserve-mb: 4096 swap-size-mb: 512 @@ -80,7 +80,7 @@ jobs: remove-android: 'true' - name: Checkout - uses: actions/checkout@main + uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22 with: fetch-depth: 0 @@ -169,7 +169,7 @@ jobs: - name: Accelerate if: env.CACHE_ACCELERATE == 'true' - uses: klever1988/cachewrtbuild@main + uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121 with: ccache: false toolchain: true @@ -278,14 +278,14 @@ jobs: cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r - name: Upload Firmware to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }} path: openwrt/bin/Firmware - name: Upload bin to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }} @@ -329,7 +329,7 @@ jobs: echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV - name: 1 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }} @@ -339,7 +339,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 2 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }} @@ -349,7 +349,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }} @@ -359,7 +359,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 6 Upload SP_LEGACY_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }} @@ -394,7 +394,7 @@ jobs: overwrite: true - name: Delete old Workflow Runs - uses: GitRML/delete-workflow-runs@main + uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled() with: retain_days: 1 diff --git a/.github/workflows/X-x86_64_Z.yml b/.github/workflows/X-x86_64_Z.yml index fc2b10c..b2a3d95 100644 --- a/.github/workflows/X-x86_64_Z.yml +++ b/.github/workflows/X-x86_64_Z.yml @@ -71,7 +71,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Maximize Build Space - uses: easimon/maximize-build-space@master + uses: easimon/maximize-build-space@c28619d8999a147d5e09c1199f84ff6af6ad5794 with: root-reserve-mb: 4096 swap-size-mb: 512 @@ -80,7 +80,7 @@ jobs: remove-android: 'true' - name: Checkout - uses: actions/checkout@main + uses: actions/checkout@b9e0990d219a03df7633c93f6f005a8fecbcab22 with: fetch-depth: 0 @@ -168,7 +168,7 @@ jobs: - name: Accelerate if: env.CACHE_ACCELERATE == 'true' - uses: klever1988/cachewrtbuild@main + uses: klever1988/cachewrtbuild@b729f807837dbc3455d02fd35192660d9b662121 with: ccache: false toolchain: true @@ -277,14 +277,14 @@ jobs: cp openwrt/bin/Firmware/* ./${{ steps.date.outputs.date }} -r - name: Upload Firmware to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_firmware_${{ env.Compile_Date }} path: openwrt/bin/Firmware - name: Upload bin to Artifacts - uses: actions/upload-artifact@main + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a if: env.UPLOAD_BIN_ARTIFACTS == 'true' && env.Result == 'true' && !cancelled() with: name: ${{ env.CONFIG_FILE }}_bin_${{ env.Compile_Date }} @@ -328,7 +328,7 @@ jobs: echo SP_LEGACY_VHDX=$(echo $SP_LEGACY_VHDX) >> $GITHUB_ENV - name: 1 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_IMG_GZ }} @@ -338,7 +338,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 2 Upload SP_UEFI_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_UEFI_VMDK }} @@ -370,7 +370,7 @@ jobs: # file: openwrt/bin/Firmware/${{ env.SP_UEFI_VHDX }} - name: 5 Upload SP_LEGACY_IMG_GZ to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_IMG_GZ }} @@ -380,7 +380,7 @@ jobs: S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }} - name: 6 Upload SP_LEGACY_VMDK to SharePoint - uses: xopenwrt/s3-upload-github-action@master + uses: xopenwrt/s3-upload-github-action@3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e if: env.SharePoint == 'true' && env.Result == 'true' && !cancelled() env: FILE: ./${{ steps.date.outputs.date }}/${{ env.SP_LEGACY_VMDK }} @@ -438,7 +438,7 @@ jobs: overwrite: true - name: Delete old Workflow Runs - uses: GitRML/delete-workflow-runs@main + uses: GitRML/delete-workflow-runs@6c7cf4852e73c46502ee79494d99f5b504cacc6d if: env.DELETE_OLD_WORKFLOW == 'true' && !cancelled() with: retain_days: 1 diff --git a/AI_CHANGELOG_PINNED_WORKFLOW_ACTIONS.md b/AI_CHANGELOG_PINNED_WORKFLOW_ACTIONS.md new file mode 100644 index 0000000..c05aff7 --- /dev/null +++ b/AI_CHANGELOG_PINNED_WORKFLOW_ACTIONS.md @@ -0,0 +1,17 @@ +# AI Modification Log: Pinned Workflow Actions + +Date: 2026-06-29 + +## Change + +- Pinned moving-branch GitHub Actions in X/Y/Z workflows to commit SHAs: + - `actions/checkout@main` -> `b9e0990d219a03df7633c93f6f005a8fecbcab22` + - `actions/upload-artifact@main` -> `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` + - `easimon/maximize-build-space@master` -> `c28619d8999a147d5e09c1199f84ff6af6ad5794` + - `klever1988/cachewrtbuild@main` -> `b729f807837dbc3455d02fd35192660d9b662121` + - `GitRML/delete-workflow-runs@main` -> `6c7cf4852e73c46502ee79494d99f5b504cacc6d` + - `xopenwrt/s3-upload-github-action@master` -> `3cb775b0a8ea63260fb38ab1e58a3694be6ddb4e` + +## Reason + +Pinning actions to immutable commits improves workflow reproducibility and reduces supply-chain drift from moving branch references.