Merge pull request #799 from bschaatsbergen/pin-gha-actions

chore: bump and pin GitHub Actions by SHA instead of tag

Author: k8s-ci-robot

.github/workflows/build-image.yaml

@@ -16,20 +16,22 @@ jobs:
       run:
         working-directory: ./website
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 20
 
       - name: Install dependencies
         run: npm install --frozen-lockfile
+
       - name: Build website
         run: npm run build
 
       - name: Upload Build Artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: ./website/build
 
@@ -51,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # #v4.0.5

.github/workflows/deploy-docs.yaml

@@ -12,9 +12,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Release
-        uses: softprops/action-gh-release@v2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # 2.4.1
         with:
           generate_release_notes: true

.github/workflows/e2e-tests.yaml

@@ -20,10 +20,12 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
           go-version: stable
+
       - name: golangci-lint
         uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9
         with:

.github/workflows/github-release.yaml

@@ -7,10 +7,10 @@ jobs:
   postsubmit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-    - name: hydrate-goproxy
-      run: |
-        mkdir -p hydrate-goproxy
-        cd hydrate-goproxy
-        go mod init hydrate-goproxy
-        go get github.com/kubernetes-sigs/kro@${GITHUB_SHA}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - name: hydrate-goproxy
+        run: |
+          mkdir -p hydrate-goproxy
+          cd hydrate-goproxy
+          go mod init hydrate-goproxy
+          go get github.com/kubernetes-sigs/kro@${GITHUB_SHA}

.github/workflows/golangci-lint.yaml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
     paths:
-      - 'website/**'
+      - "website/**"
 
 jobs:
   test-deploy:
@@ -15,14 +15,16 @@ jobs:
       run:
         working-directory: ./website
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v5
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 20
-  
+
       - name: Install dependencies
         run: npm install --frozen-lockfile
+
       - name: Test build website
         run: npm run build

.github/workflows/integration-tests.yaml

@@ -1,14 +1,14 @@
 name: unit tests
 on:
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
       - "**.go"
       - go.mod
       - go.sum
       - scripts/ci/**
   pull_request:
-    branches: [ main ]
+    branches: [main]
     paths:
       - "**.go"
       - go.mod
@@ -18,16 +18,13 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go-version: [ '1.24' ]
 
     steps:
-      - uses: actions/checkout@v3
-      - name: Setup Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: "go.mod"
 
       - name: Run scripts/ci/presubmits/unit-tests
         run: scripts/ci/presubmits/unit-tests