From 97b2bd962003ac53abe2acc2299ce7635f8bff5b Mon Sep 17 00:00:00 2001 From: Vamshi-Microsoft Date: Tue, 30 Jun 2026 14:40:37 +0530 Subject: [PATCH] ci: pin third-party GitHub Actions to verified release SHAs --- .github/workflows/broken-links-checker.yml | 19 +++++++++++++------ .github/workflows/pr-title-checker.yml | 2 +- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index 9901fa1..5e764e1 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -24,17 +24,24 @@ jobs: - name: Get changed markdown files (PR only) id: changed-markdown-files if: github.event_name == 'pull_request' - uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46 - with: - files: | - **/*.md + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + changed_files=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- '*.md' | tr '\n' ' ' | sed 's/ *$//') + if [ -n "$changed_files" ]; then + echo "any_changed=true" >> "$GITHUB_OUTPUT" + else + echo "any_changed=false" >> "$GITHUB_OUTPUT" + fi + echo "all_changed_files=$changed_files" >> "$GITHUB_OUTPUT" # For PR: Check broken links only in changed files - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.4.1 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --exclude-mail --no-progress --exclude ^https?:// @@ -47,7 +54,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.4.1 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --exclude-mail --no-progress --exclude ^https?:// diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index b7e70e5..851d554 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}