|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +# Script to get commit SHAs for GitHub Actions |
| 4 | +# Usage: ./get-action-commit-shas.sh |
| 5 | + |
| 6 | +set -e |
| 7 | + |
| 8 | +# Colors for output |
| 9 | +RED='\033[0;31m' |
| 10 | +GREEN='\033[0;32m' |
| 11 | +YELLOW='\033[1;33m' |
| 12 | +NC='\033[0m' # No Color |
| 13 | + |
| 14 | +echo -e "${YELLOW}Fetching commit SHAs for GitHub Actions...${NC}" |
| 15 | +echo |
| 16 | + |
| 17 | +# Function to get commit SHA for a GitHub action |
| 18 | +get_commit_sha() { |
| 19 | + local action_ref=$1 |
| 20 | + local repo=$(echo $action_ref | cut -d'@' -f1) |
| 21 | + local tag_or_sha=$(echo $action_ref | cut -d'@' -f2) |
| 22 | + |
| 23 | + # Skip if already a commit SHA (40 characters) |
| 24 | + if [[ ${#tag_or_sha} -eq 40 ]]; then |
| 25 | + echo -e "${GREEN}$action_ref${NC} (already pinned)" |
| 26 | + return |
| 27 | + fi |
| 28 | + |
| 29 | + # Skip master/main branches for now |
| 30 | + if [[ "$tag_or_sha" == "master" || "$tag_or_sha" == "main" ]]; then |
| 31 | + echo -e "${YELLOW}$action_ref${NC} (branch reference - consider pinning)" |
| 32 | + return |
| 33 | + fi |
| 34 | + |
| 35 | + echo -n "Fetching SHA for $repo@$tag_or_sha... " |
| 36 | + |
| 37 | + # Try multiple GitHub API endpoints to get the commit SHA |
| 38 | + local sha="" |
| 39 | + |
| 40 | + # First try as a tag reference |
| 41 | + local api_url="https://api.github.com/repos/$repo/git/refs/tags/$tag_or_sha" |
| 42 | + local response=$(curl -s -w "%{http_code}" "$api_url" 2>/dev/null) |
| 43 | + local http_code="${response: -3}" |
| 44 | + local body="${response%???}" |
| 45 | + |
| 46 | + if [[ "$http_code" == "200" ]]; then |
| 47 | + sha=$(echo "$body" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data['object']['sha'] if data['object']['type'] == 'commit' else '')" 2>/dev/null) |
| 48 | + if [[ -z "$sha" ]]; then |
| 49 | + # It's a tag object, get the commit it points to |
| 50 | + local tag_sha=$(echo "$body" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data['object']['sha'])" 2>/dev/null) |
| 51 | + if [[ -n "$tag_sha" ]]; then |
| 52 | + local tag_response=$(curl -s "https://api.github.com/repos/$repo/git/tags/$tag_sha" 2>/dev/null) |
| 53 | + sha=$(echo "$tag_response" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data['object']['sha'])" 2>/dev/null) |
| 54 | + fi |
| 55 | + fi |
| 56 | + fi |
| 57 | + |
| 58 | + # If tag approach didn't work, try as a branch/commit reference |
| 59 | + if [[ -z "$sha" ]]; then |
| 60 | + api_url="https://api.github.com/repos/$repo/commits/$tag_or_sha" |
| 61 | + response=$(curl -s -w "%{http_code}" "$api_url" 2>/dev/null) |
| 62 | + http_code="${response: -3}" |
| 63 | + body="${response%???}" |
| 64 | + |
| 65 | + if [[ "$http_code" == "200" ]]; then |
| 66 | + sha=$(echo "$body" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data['sha'])" 2>/dev/null) |
| 67 | + fi |
| 68 | + fi |
| 69 | + |
| 70 | + if [[ -n "$sha" && ${#sha} -eq 40 ]]; then |
| 71 | + echo -e "${GREEN}✓${NC}" |
| 72 | + echo " $repo@$sha # $tag_or_sha" |
| 73 | + else |
| 74 | + echo -e "${RED}✗ (could not fetch SHA)${NC}" |
| 75 | + echo -e " ${YELLOW}Manual lookup: https://github.com/$repo/releases/tag/$tag_or_sha${NC}" |
| 76 | + fi |
| 77 | +} |
| 78 | + |
| 79 | +# Extract all GitHub Actions from workflow files |
| 80 | +echo "Scanning workflow files for GitHub Actions..." |
| 81 | +echo |
| 82 | + |
| 83 | +# Find all unique action references |
| 84 | +actions=$(grep -h "uses:" .github/workflows/*.yaml | \ |
| 85 | + sed 's/.*uses: *//' | \ |
| 86 | + sed 's/ *#.*//' | \ |
| 87 | + sort -u) |
| 88 | + |
| 89 | +echo "Found the following actions:" |
| 90 | +echo "$actions" |
| 91 | +echo |
| 92 | +echo "Fetching commit SHAs:" |
| 93 | +echo |
| 94 | + |
| 95 | +# Process each action |
| 96 | +while IFS= read -r action; do |
| 97 | + get_commit_sha "$action" |
| 98 | +done <<< "$actions" |
| 99 | + |
| 100 | +echo |
| 101 | +echo -e "${YELLOW}Note: You can copy the output above to update your workflow files.${NC}" |
| 102 | +echo -e "${YELLOW}Remember to also update the comment with the version tag.${NC}" |
0 commit comments