Skip to content

Commit 11b9e4d

Browse files
mdtrolimbonaut
mdtro
and
limbonaut
authored
ci: use envs in GHAs and pin versions (#2178)
* gha: use env to prevent shell injections * gha: pin action versions to sha * gha: use correct env syntax * Apply suggestions from code review Co-authored-by: Serhii Snitsaruk <[email protected]> --------- Co-authored-by: Serhii Snitsaruk <[email protected]>
1 parent cc4a467 commit 11b9e4d

12 files changed

+130
-109
lines changed

‎.github/workflows/build.yml‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ env:
1010
LOWEST_SUPPORTED_UNITY_VERSION: 2019
1111
DOTNET_CLI_TELEMETRY_OPTOUT: 1
1212
DOTNET_NOLOGO: 1
13+
GITHUB_ACTOR: ${{ github.actor }}
14+
GITHUB_SHA: ${{ github.sha }}
15+
UNITY_VERSION: ${{ inputs.unity-version }}
1316

1417
defaults:
1518
run:
@@ -21,19 +24,19 @@ jobs:
2124
runs-on: ubuntu-22.04
2225
steps:
2326
- name: Checkout
24-
uses: actions/checkout@v3
27+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
2528

2629
- name: Checkout submodules
2730
run: git submodule update --init --recursive src/sentry-dotnet
2831

2932
- name: Load env
3033
id: env
31-
run: echo "unityVersion=$(./scripts/ci-env.ps1 "unity${{ inputs.unity-version }}")" >> $env:GITHUB_OUTPUT
34+
run: echo "unityVersion=$(./scripts/ci-env.ps1 "unity${env:UNITY_VERSION}")" >> $env:GITHUB_OUTPUT
3235

3336
- run: echo "::add-mask::${{ secrets.LICENSE_SERVER_URL }}"
3437

3538
- name: Restore Unity Packages
36-
uses: actions/cache@v3
39+
uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3
3740
with:
3841
path: |
3942
samples/unity-of-bugs/Library/Packages
@@ -44,41 +47,41 @@ jobs:
4447
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned v3
4548
with:
4649
registry: ghcr.io
47-
username: ${{ github.actor }}
48-
password: ${{ secrets.GITHUB_TOKEN }}
50+
username: ${{ env.GITHUB_ACTOR }}
51+
password: ${{ secrets.GITHUB_TOKEN }}
4952

5053
- name: Start the Unity docker container
51-
run: ./scripts/ci-docker.sh '${{ inputs.unity-version }}' 'ios' '${{ secrets.UNITY_LICENSE_SERVER_CONFIG }}'
54+
run: ./scripts/ci-docker.sh "${UNITY_VERSION}" 'ios' '${{ secrets.UNITY_LICENSE_SERVER_CONFIG }}'
5255
shell: bash
5356

5457
- name: Install .NET SDK
5558
if: runner.os != 'Windows'
56-
uses: actions/setup-dotnet@v4
59+
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
5760
with:
5861
global-json-file: src/sentry-dotnet/global.json
5962

6063
- name: Install Android dotnet workflow
61-
run: dotnet workload install android --temp-dir "${{ runner.temp }}"
64+
run: dotnet workload install android --temp-dir "${env:RUNNER_TEMP}"
6265

6366
- name: Download CLI
6467
run: ./scripts/download-sentry-cli.ps1
6568

6669
- name: Download Android SDK
67-
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848
70+
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
6871
with:
6972
name: Android-sdk
7073
path: package-dev/Plugins/Android
7174
wait-timeout: 3600
7275

7376
- name: Download Linux SDK
74-
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848
77+
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
7578
with:
7679
name: Linux-sdk
7780
path: package-dev/Plugins/Linux
7881
wait-timeout: 3600
7982

8083
- name: Download Windows SDK
81-
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848
84+
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
8285
with:
8386
name: Windows-sdk
8487
path: package-dev/Plugins/Windows
@@ -97,16 +100,16 @@ jobs:
97100
run: docker exec unity /home/gh/.dotnet/tools/assemblyalias --target-directory "package-dev/Runtime" --internalize --prefix "Sentry." --assemblies-to-alias "Microsoft*;System*"
98101

99102
- name: Package for release
100-
if: ${{ inputs.unity-version == env.LOWEST_SUPPORTED_UNITY_VERSION }}
103+
if: ${{ env.UNITY_VERSION == env.LOWEST_SUPPORTED_UNITY_VERSION }}
101104
run: |
102105
docker exec unity dotnet msbuild /t:UnityConfigureSentryOptions /p:Configuration=Release /p:OutDir=other src/Sentry.Unity
103106
./scripts/pack.ps1
104107
105108
- name: Upload release artifacts
106-
uses: actions/upload-artifact@v4
107-
if: ${{ inputs.unity-version == env.LOWEST_SUPPORTED_UNITY_VERSION }}
109+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
110+
if: ${{ env.UNITY_VERSION == env.LOWEST_SUPPORTED_UNITY_VERSION }}
108111
with:
109-
name: ${{ github.sha }}
112+
name: ${{ env.GITHUB_SHA }}
110113
if-no-files-found: error
111114
path: |
112115
package-release.zip
@@ -117,16 +120,16 @@ jobs:
117120
docker exec unity dotnet msbuild /t:UnityPlayModeTest /p:Configuration=Release /p:OutDir=other test/Sentry.Unity.Tests
118121
119122
- name: Upload test artifacts (playmode)
120-
uses: actions/upload-artifact@v4
123+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
121124
with:
122-
name: Test results (playmode) - ${{inputs.unity-version}}
125+
name: Test results (playmode) - ${{ env.UNITY_VERSION }}
123126
path: artifacts/test/playmode
124127

125128
- name: Run Unity tests (editmode)
126129
run: docker exec unity dotnet msbuild /t:UnityEditModeTest /p:Configuration=Release /p:OutDir=other test/Sentry.Unity.Editor.Tests
127130

128131
- name: Upload test artifacts (editmode)
129-
uses: actions/upload-artifact@v4
132+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
130133
with:
131-
name: Test results (editmode) - ${{inputs.unity-version}}
134+
name: Test results (editmode) - ${{ env.UNITY_VERSION }}
132135
path: artifacts/test/editmode

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
uses: actions/checkout@v3
6868

6969
- name: Download UPM package
70-
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848
70+
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
7171
with:
7272
name: ${{ github.sha }}
7373
wait-timeout: 3600
@@ -118,7 +118,7 @@ jobs:
118118
uses: actions/checkout@v3
119119

120120
- name: Free Disk Space (Ubuntu)
121-
uses: jlumbroso/free-disk-space@f68fdb76e2ea636224182cfb7377ff9a1708f9b8
121+
uses: jlumbroso/free-disk-space@f68fdb76e2ea636224182cfb7377ff9a1708f9b8 # v1.3.0
122122
with:
123123
android: true
124124
dotnet: false
@@ -149,18 +149,18 @@ jobs:
149149
docker exec --user root unity apt-get -y -q install mono-devel
150150
151151
- name: Download IntegrationTest project
152-
uses: actions/download-artifact@v4
152+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
153153
with:
154154
name: smoke-test-${{ matrix.unity-version }}
155155

156156
- name: Extract project archive
157157
run: tar -xvzf test-project.tar.gz
158158

159159
# - name: Build without Sentry SDK
160-
# run: ./test/Scripts.Integration.Test/build-project.ps1 -UnityPath "${{ env.UNITY_PATH }}" -Platform "${{ matrix.platform }}"
160+
# run: ./test/Scripts.Integration.Test/build-project.ps1 -UnityPath "${env:UNITY_PATH}" -Platform "${{ matrix.platform }}"
161161

162162
- name: Download UPM package
163-
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848
163+
uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
164164
with:
165165
name: ${{ github.sha }}
166166
wait-timeout: 3600
@@ -187,7 +187,7 @@ jobs:
187187
188188
# Upload runtime initialization build
189189
- name: Upload test app
190-
uses: actions/upload-artifact@v4
190+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
191191
with:
192192
name: testapp-${{ matrix.platform }}-${{ matrix.unity-version }}-runtime
193193
if-no-files-found: error
@@ -196,7 +196,7 @@ jobs:
196196

197197
- name: Upload IntegrationTest project on failure
198198
if: ${{ failure() }}
199-
uses: actions/upload-artifact@v4
199+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
200200
with:
201201
name: failed-project-${{ matrix.platform }}-${{ matrix.unity-version }}
202202
path: |
@@ -302,7 +302,7 @@ jobs:
302302
uses: actions/checkout@v3
303303

304304
- name: Download test app artifact
305-
uses: actions/download-artifact@v4
305+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
306306
id: download
307307
with:
308308
name: testapp-${{ matrix.platform }}-${{ matrix.unity-version }}-runtime
@@ -345,7 +345,7 @@ jobs:
345345
# unity-config-path: /Library/Application Support/Unity/config/
346346
steps:
347347
- name: Checkout
348-
uses: actions/checkout@v3
348+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
349349

350350
- name: Load env
351351
id: env
@@ -365,18 +365,18 @@ jobs:
365365
Set-Content -Path '${{ matrix.unity-config-path }}services-config.json' -Value '${{ secrets.UNITY_LICENSE_SERVER_CONFIG }}'
366366
367367
- name: Download IntegrationTest project
368-
uses: actions/download-artifact@v4
368+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
369369
with:
370370
name: smoke-test-${{ matrix.unity-version }}
371371

372372
- name: Extract project archive
373373
run: tar -xvzf test-project.tar.gz
374374

375375
- name: Build without Sentry SDK
376-
run: ./test/Scripts.Integration.Test/build-project.ps1 -UnityPath "${{ env.UNITY_PATH }}"
376+
run: ./test/Scripts.Integration.Test/build-project.ps1 -UnityPath "${env:UNITY_PATH}"
377377

378378
- name: Download UPM package
379-
uses: actions/download-artifact@v4
379+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
380380
with:
381381
name: ${{ github.sha }}
382382

‎.github/workflows/format-code.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
runs-on: ubuntu-latest
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v3
11+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
1212
with:
1313
submodules: recursive
1414

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@ jobs:
2525
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
2626

2727
- name: Check out current commit (${{ github.sha }})
28-
uses: actions/checkout@v3
28+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
2929
with:
3030
token: ${{ steps.token.outputs.token }}
3131
fetch-depth: 0
3232

3333
- name: Prepare release ${{ github.event.inputs.version }}
34-
uses: getsentry/action-prepare-release@v1
34+
uses: getsentry/action-prepare-release@3cea80dc3938c0baf5ec4ce752ecb311f8780cdc # v1
3535
env:
3636
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
3737
with:

‎.github/workflows/sdk.yml‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,18 @@ on:
1616
env:
1717
DOTNET_CLI_TELEMETRY_OPTOUT: 1
1818
DOTNET_NOLOGO: 1
19+
TARGET: ${{ inputs.target }}
20+
CONTAINER: ${{ inputs.container }}
21+
RUNS_ON: ${{ inputs.runsOn }}
1922

2023
jobs:
2124
build:
22-
runs-on: ${{ inputs.runsOn }}
23-
container: ${{ inputs.container }}
25+
runs-on: ${{ env.RUNS_ON }}
26+
container: ${{ env.CONTAINER }}
2427
timeout-minutes: 30
2528
steps:
2629
- name: Set up Git in container
27-
if: ${{ inputs.container != '' }}
30+
if: ${{ env.CONTAINER != '' }}
2831
# ubuntu:20.04 does not have git installed by default. Make it available
2932
# for actions/checkout to get a proper clone instead of downloading a
3033
# tarball using the GitHub REST API. This ensures that git submodule
@@ -40,13 +43,13 @@ jobs:
4043
env:
4144
DEBIAN_FRONTEND: noninteractive
4245

43-
- uses: actions/checkout@v3
46+
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
4447

4548
- name: Select submodules
4649
id: env
4750
shell: bash
4851
run: |
49-
if [[ "${{ inputs.target }}" == "Android" ]]; then
52+
if [[ "${TARGET}" == "Android" ]]; then
5053
submodules="modules/sentry-java"
5154
else
5255
submodules="modules/sentry-native"
@@ -58,22 +61,22 @@ jobs:
5861
- name: Get submodule status
5962
run: git submodule status --cached ${{ steps.env.outputs.submodules }} | tee submodules-status
6063

61-
- run: cp -r package-dev/Plugins/${{ inputs.target }} sdk-static || echo "never mind, no files checked in..."
64+
- run: cp -r package-dev/Plugins/${TARGET} sdk-static || echo "never mind, no files checked in..."
6265
shell: bash
6366

6467
- name: Restore from cache
65-
uses: actions/cache@v3
68+
uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3
6669
id: cache
6770
with:
6871
# Note: native SDKs are cached and only built if the respective 'package-dev/Plugins/' directories are empty.
6972
# Output changes only depending on the git sha of the submodules
7073
# hash of package/package.json for cache busting on release builds (version bump)
7174
path: |
7275
package-dev/Plugins
73-
key: sdk=${{ inputs.target }}-${{ hashFiles('submodules-status', 'package/package.json', 'Directory.Build.targets', 'sdk-static/**') }}
76+
key: sdk=${{ env.TARGET }}-${{ hashFiles('submodules-status', 'package/package.json', 'Directory.Build.targets', 'sdk-static/**') }}
7477

7578
- name: Installing Linux Dependencies
76-
if: ${{ inputs.target == 'Linux' && steps.cache.outputs.cache-hit != 'true' }}
79+
if: ${{ env.TARGET == 'Linux' && steps.cache.outputs.cache-hit != 'true' }}
7780
shell: bash
7881
run: |
7982
apt-get update
@@ -88,19 +91,19 @@ jobs:
8891
if: steps.cache.outputs.cache-hit != 'true'
8992
run: |
9093
git submodule update --init --recursive ${{ steps.env.outputs.submodules }}
91-
dotnet msbuild /t:Build${{ inputs.target }}SDK /p:Configuration=Release /p:OutDir=other src/Sentry.Unity
94+
dotnet msbuild /t:Build${TARGET}SDK /p:Configuration=Release /p:OutDir=other src/Sentry.Unity
9295
9396
- name: Upload build logs on failure
9497
if: ${{ failure() }}
95-
uses: actions/upload-artifact@v4
98+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
9699
with:
97100
path: ${{ steps.env.outputs.submodulesPath }}/build.log
98101
# Lower retention period - we only need this to retry CI.
99102
retention-days: 14
100103

101-
- uses: actions/upload-artifact@v4
104+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
102105
with:
103-
name: ${{ inputs.target }}-sdk
104-
path: package-dev/Plugins/${{ inputs.target }}
106+
name: ${{ env.TARGET }}-sdk
107+
path: package-dev/Plugins/${{ env.TARGET }}
105108
# Lower retention period - we only need this to retry CI.
106109
retention-days: 14

0 commit comments

Comments
 (0)