Pin commit hash of github actions to avoid supply chain attacks

[Yang-33]

Changes

To avoid supply chain attacks, specify actions in GitHub Actions workflows using commit hashes instead of version numbers. Pinact-action will fail the CI job if this is not done. Renovate already supports updates in the commit hash state, so there is no issue.

(At this point, since this repository provides YAML, it might be considered unnecessary, but having it prepared doesn't hurt.)

References

• https://github.com/suzuki-shunsuke/pinact-action
  • does pinact-action verify the checksum of the version of aqua it is using? Yes!:
• https://github.com/suzuki-shunsuke/pinact

Other repositories

• line/line-bot-sdk-python Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-python#772
• line/line-bot-sdk-php Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-php#680
• line/line-bot-sdk-nodejs Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-nodejs#1201
• line/line-bot-sdk-java Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-java#1576
• line/line-bot-sdk-go Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-go#555
• line/line-bot-sdk-ruby Pin commit hash of github actions to avoid supply chain attacks line-bot-sdk-ruby#405
• line/line-openapi Pin commit hash of github actions to avoid supply chain attacks #90

[github-actions]

NODEJS

You can check generated code in nodejs

Check the diff here

[github-actions]

JAVA

You can check generated code in java

Check the diff here

[github-actions]

PYTHON

You can check generated code in python

Check the diff here

[github-actions]

GO

You can check generated code in go

Check the diff here

[github-actions]

PHP

You can check generated code in php

Check the diff here