Skip to content

Commit 5a49eb0

Browse files
mmorel-35mmorel-35
authored
setup OSSF Scorecard workflow (#10224)
Signed-off-by: Matthieu MOREL <[email protected]>
1 parent 9ec6401 commit 5a49eb0

24 files changed

+220
-101
lines changed

‎.github/workflows/auto-update-otel-sdk.yml

+6-4
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
latest-version: ${{ steps.check-versions.outputs.latest-version }}
1515
already-opened: ${{ steps.check-versions.outputs.already-opened }}
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
1818

1919
- id: check-versions
2020
name: Check versions
@@ -43,14 +43,16 @@ jobs:
4343
echo "already-opened=$already_opened" >> $GITHUB_OUTPUT
4444
4545
update-otel-sdk:
46+
permissions:
47+
contents: write # for Git to git push
4648
runs-on: ubuntu-latest
4749
if: |
4850
needs.check-versions.outputs.current-version != needs.check-versions.outputs.latest-version &&
4951
needs.check-versions.outputs.already-opened != 'true'
5052
needs:
5153
- check-versions
5254
steps:
53-
- uses: actions/checkout@v4
55+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5456

5557
- name: Update version
5658
env:
@@ -64,13 +66,13 @@ jobs:
6466
run: .github/scripts/gha-free-disk-space.sh
6567

6668
- name: Set up JDK for running Gradle
67-
uses: actions/setup-java@v4
69+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
6870
with:
6971
distribution: temurin
7072
java-version: 17.0.6
7173

7274
- name: Update license report
73-
uses: gradle/gradle-build-action@v2
75+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
7476
with:
7577
arguments: generateLicenseReport
7678

‎.github/workflows/backport.yml

+6-1
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@ on:
66
description: "The pull request # to backport"
77
required: true
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
backport:
14+
permissions:
15+
contents: write # for Git to git push
1116
runs-on: ubuntu-latest
1217
steps:
1318
- run: |
@@ -16,7 +21,7 @@ jobs:
1621
exit 1
1722
fi
1823
19-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2025
with:
2126
# history is needed to run git cherry-pick below
2227
fetch-depth: 0

‎.github/workflows/build-common.yml

+35-32
Original file line numberDiff line numberDiff line change
@@ -23,23 +23,26 @@ on:
2323
GE_CACHE_PASSWORD:
2424
required: false
2525

26+
permissions:
27+
contents: read
28+
2629
jobs:
2730
spotless:
2831
runs-on: ubuntu-latest
2932
steps:
30-
- uses: actions/checkout@v4
33+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3134

3235
- name: Free disk space
3336
run: .github/scripts/gha-free-disk-space.sh
3437

3538
- name: Set up JDK for running Gradle
36-
uses: actions/setup-java@v4
39+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
3740
with:
3841
distribution: temurin
3942
java-version: 17.0.6
4043

4144
- name: Spotless
42-
uses: gradle/gradle-build-action@v2
45+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
4346
env:
4447
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
4548
GE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
@@ -53,26 +56,26 @@ jobs:
5356
gradle-wrapper-validation:
5457
runs-on: ubuntu-latest
5558
steps:
56-
- uses: actions/checkout@v4
59+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5760

58-
- uses: gradle/[email protected]
61+
- uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1.1.0
5962

6063
license-check:
6164
runs-on: ubuntu-latest
6265
steps:
63-
- uses: actions/checkout@v4
66+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
6467

6568
- name: Free disk space
6669
run: .github/scripts/gha-free-disk-space.sh
6770

6871
- name: Set up JDK for running Gradle
69-
uses: actions/setup-java@v4
72+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
7073
with:
7174
distribution: temurin
7275
java-version: 17.0.6
7376

7477
- name: Generate license report
75-
uses: gradle/gradle-build-action@v2
78+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
7679
env:
7780
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
7881
GE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
@@ -107,7 +110,7 @@ jobs:
107110
extra-dependency-management-enforcement:
108111
runs-on: ubuntu-latest
109112
steps:
110-
- uses: actions/checkout@v4
113+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
111114

112115
- name: Dependency check
113116
run: |
@@ -130,13 +133,13 @@ jobs:
130133
build:
131134
runs-on: ubuntu-latest
132135
steps:
133-
- uses: actions/checkout@v4
136+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
134137

135138
- name: Free disk space
136139
run: .github/scripts/gha-free-disk-space.sh
137140

138141
- name: Set up JDK for running Gradle
139-
uses: actions/setup-java@v4
142+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
140143
with:
141144
distribution: temurin
142145
java-version: 17.0.6
@@ -146,7 +149,7 @@ jobs:
146149
sed -i "s/org.gradle.jvmargs=/org.gradle.jvmargs=-Xmx3g /" gradle.properties
147150
148151
- name: Build
149-
uses: gradle/gradle-build-action@v2
152+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
150153
env:
151154
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
152155
GE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
@@ -173,7 +176,7 @@ jobs:
173176
fi
174177
175178
- name: Upload agent jar
176-
uses: actions/upload-artifact@v4
179+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
177180
with:
178181
path: javaagent/build/libs/opentelemetry-javaagent-*-SNAPSHOT.jar
179182

@@ -201,34 +204,34 @@ jobs:
201204
vm: openj9
202205
fail-fast: false
203206
steps:
204-
- uses: actions/checkout@v4
207+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
205208

206209
- name: Free disk space
207210
run: .github/scripts/gha-free-disk-space.sh
208211

209212
- id: setup-test-java
210213
name: Set up JDK ${{ matrix.test-java-version }}-${{ matrix.vm }} for running tests
211-
uses: actions/setup-java@v4
214+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
212215
with:
213216
# using zulu because new releases get published quickly
214217
distribution: ${{ matrix.vm == 'hotspot' && 'zulu' || 'adopt-openj9'}}
215218
java-version: ${{ matrix.test-java-version }}
216219

217220
- name: Set up JDK for running Gradle
218-
uses: actions/setup-java@v4
221+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
219222
with:
220223
distribution: temurin
221224
java-version: 17.0.6
222225

223226
# vaadin 14 tests fail with node 18
224227
- name: Set up Node
225-
uses: actions/setup-node@v4
228+
uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
226229
with:
227230
node-version: 16
228231

229232
# vaadin tests use pnpm
230233
- name: Cache pnpm modules
231-
uses: actions/cache@v3
234+
uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
232235
with:
233236
path: ~/.pnpm-store
234237
key: ${{ runner.os }}-test-cache-pnpm-modules
@@ -241,7 +244,7 @@ jobs:
241244
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
242245
GE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
243246
GE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
244-
uses: gradle/gradle-build-action@v2
247+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
245248
with:
246249
# "check" is needed to activate all tests for listing purposes
247250
# listTestsInPartition writes test tasks that apply to the given partition to a file named
@@ -261,7 +264,7 @@ jobs:
261264
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
262265
GE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
263266
GE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
264-
uses: gradle/gradle-build-action@v2
267+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
265268
with:
266269
# spotless is checked separately since it's a common source of failure
267270
arguments: >
@@ -278,15 +281,15 @@ jobs:
278281

279282
- name: Upload deadlock detector artifacts if any
280283
if: failure()
281-
uses: actions/upload-artifact@v4
284+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
282285
with:
283286
name: deadlock-detector-test-${{ matrix.test-java-version }}-${{ matrix.vm }}-${{ matrix.test-partition }}
284287
path: /tmp/deadlock-detector-*
285288
if-no-files-found: ignore
286289

287290
- name: Upload jvm crash dump files if any
288291
if: failure()
289-
uses: actions/upload-artifact@v4
292+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
290293
with:
291294
name: javacore-test-${{ matrix.test-java-version }}-${{ matrix.test-partition }}
292295
path: |
@@ -323,19 +326,19 @@ jobs:
323326
run: git config --system core.longpaths true
324327
if: matrix.os == 'windows-latest'
325328

326-
- uses: actions/checkout@v4
329+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
327330

328331
- name: Free disk space
329332
run: .github/scripts/gha-free-disk-space.sh
330333

331334
- name: Set up JDK for running Gradle
332-
uses: actions/setup-java@v4
335+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
333336
with:
334337
distribution: temurin
335338
java-version: 17.0.6
336339

337340
- name: Set up Gradle cache
338-
uses: gradle/gradle-build-action@v2
341+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
339342
with:
340343
# only push cache for one matrix option per OS since github action cache space is limited
341344
cache-read-only: ${{ inputs.cache-read-only || matrix.smoke-test-suite != 'tomcat' }}
@@ -359,7 +362,7 @@ jobs:
359362

360363
- name: Upload jvm crash dump files if any
361364
if: failure()
362-
uses: actions/upload-artifact@v4
365+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
363366
with:
364367
name: javacore-smoke-test-${{ matrix.smoke-test-suite }}-${{ matrix.os }}
365368
# we expect crash dumps either in root director or in smoke-tests
@@ -380,19 +383,19 @@ jobs:
380383
gradle-plugins:
381384
runs-on: ubuntu-latest
382385
steps:
383-
- uses: actions/checkout@v4
386+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
384387

385388
- name: Free disk space
386389
run: .github/scripts/gha-free-disk-space.sh
387390

388391
- name: Set up JDK for running Gradle
389-
uses: actions/setup-java@v4
392+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
390393
with:
391394
distribution: temurin
392395
java-version: 17.0.6
393396

394397
- name: Build
395-
uses: gradle/gradle-build-action@v2
398+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
396399
with:
397400
arguments: build ${{ inputs.no-build-cache && '--no-build-cache' || '' }}
398401
build-root-directory: gradle-plugins
@@ -401,19 +404,19 @@ jobs:
401404
examples:
402405
runs-on: ubuntu-latest
403406
steps:
404-
- uses: actions/checkout@v4
407+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
405408

406409
- name: Free disk space
407410
run: .github/scripts/gha-free-disk-space.sh
408411

409412
- name: Set up JDK for running Gradle
410-
uses: actions/setup-java@v4
413+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
411414
with:
412415
distribution: temurin
413416
java-version: 17.0.6
414417

415418
- name: Set up Gradle cache
416-
uses: gradle/gradle-build-action@v2
419+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
417420
with:
418421
cache-read-only: ${{ inputs.cache-read-only }}
419422

‎.github/workflows/build.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,13 @@ jobs:
6565
# skipping release branches because the versions in those branches are not snapshots
6666
if: github.ref_name == 'main' && github.repository == 'open-telemetry/opentelemetry-java-instrumentation'
6767
steps:
68-
- uses: actions/checkout@v4
68+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
6969

7070
- name: Free disk space
7171
run: .github/scripts/gha-free-disk-space.sh
7272

7373
- name: Set up JDK for running Gradle
74-
uses: actions/setup-java@v4
74+
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
7575
with:
7676
distribution: temurin
7777
java-version: 17.0.6
@@ -83,7 +83,7 @@ jobs:
8383
SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
8484
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
8585
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
86-
uses: gradle/gradle-build-action@v2
86+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
8787
with:
8888
arguments: assemble publishToSonatype
8989
# gradle enterprise is used for the build cache
@@ -96,7 +96,7 @@ jobs:
9696
SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
9797
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
9898
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
99-
uses: gradle/gradle-build-action@v2
99+
uses: gradle/gradle-build-action@982da8e78c05368c70dac0351bb82647a9e9a5d2 # v2.11.1
100100
with:
101101
build-root-directory: gradle-plugins
102102
arguments: build publishToSonatype

0 commit comments

Comments
 (0)