From 463f5a6ee122f7a7f4bff99d9640a59b09208d39 Mon Sep 17 00:00:00 2001 From: ppigazzini Date: Mon, 20 Apr 2026 17:37:33 +0200 Subject: [PATCH] ci: pin root workflow actions to immutable SHAs Pin every external action used by the root GitHub workflow set to a full-length commit SHA and keep the selected release tag as a same-line comment. Update the root workflows to the latest stable tagged action versions found during the audit while preserving existing release guards, permissions, and reusable workflow wiring. closes https://github.com/official-stockfish/Stockfish/pull/6754 No functional change. --- .github/workflows/arm_compilation.yml | 4 ++-- .github/workflows/avx2_compilers.yml | 2 +- .github/workflows/clang-format.yml | 8 ++++---- .github/workflows/codeql.yml | 6 +++--- .github/workflows/compilation.yml | 26 +++++++++++++------------- .github/workflows/games.yml | 4 ++-- .github/workflows/iwyu.yml | 4 ++-- .github/workflows/matetrack.yml | 6 +++--- .github/workflows/sanitizers.yml | 2 +- .github/workflows/stockfish.yml | 6 +++--- .github/workflows/tests.yml | 8 ++++---- .github/workflows/upload_binaries.yml | 8 ++++---- 12 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/arm_compilation.yml b/.github/workflows/arm_compilation.yml index 86d222182..ce85871e5 100644 --- a/.github/workflows/arm_compilation.yml +++ b/.github/workflows/arm_compilation.yml @@ -23,7 +23,7 @@ jobs: working-directory: src shell: ${{ matrix.config.shell }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -89,7 +89,7 @@ jobs: run: git clean -fx - name: Upload artifact for (pre)-release - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} path: | diff --git a/.github/workflows/avx2_compilers.yml b/.github/workflows/avx2_compilers.yml index 075553bde..594eafee0 100644 --- a/.github/workflows/avx2_compilers.yml +++ b/.github/workflows/avx2_compilers.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies run: | diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index 46607c1e9..3d283aa8f 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -20,12 +20,12 @@ jobs: name: Clang-Format runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.pull_request.head.sha }} - name: Run clang-format style check - uses: jidicula/clang-format-action@4726374d1aa3c6aecf132e5197e498979588ebc8 # @v4.15.0 + uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0 id: clang-format continue-on-error: true with: @@ -34,7 +34,7 @@ jobs: - name: Comment on PR if: steps.clang-format.outcome == 'failure' - uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # @v2.5.0 + uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: message: | clang-format 20 needs to be run on this PR. @@ -47,7 +47,7 @@ jobs: - name: Comment on PR if: steps.clang-format.outcome != 'failure' - uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # @v2.5.0 + uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: message: | _(execution **${{ github.run_id }}** / attempt **${{ github.run_attempt }}**)_ diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a338083cf..775a543bb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,13 +29,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -50,6 +50,6 @@ jobs: run: make -j build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/compilation.yml b/.github/workflows/compilation.yml index bb6826474..8a0a24002 100644 --- a/.github/workflows/compilation.yml +++ b/.github/workflows/compilation.yml @@ -24,26 +24,26 @@ jobs: working-directory: src shell: ${{ matrix.config.shell }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Install fixed GCC on Linux if: runner.os == 'Linux' - uses: egor-tensin/setup-gcc@eaa888eb19115a521fa72b65cd94fe1f25bbcaac # @v1.3 + uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0 with: version: 11 - name: Setup msys and install required packages if: runner.os == 'Windows' - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: msystem: ${{ matrix.config.msys_sys }} install: mingw-w64-${{ matrix.config.msys_env }} make git zip - name: Download SDE package if: runner.os == 'Linux' || runner.os == 'Windows' - uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 + uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0 with: environmentVariableName: SDE_DIR sdeVersion: 9.33.0 @@ -85,7 +85,7 @@ jobs: run: git clean -fx - name: Upload artifact for (pre)-release - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} path: | @@ -100,18 +100,18 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false fetch-depth: 0 - name: Install GCC 15 - uses: egor-tensin/setup-gcc@eaa888eb19115a521fa72b65cd94fe1f25bbcaac # @v1.3 + uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0 with: version: 15 - name: Download SDE package - uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 + uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0 with: environmentVariableName: SDE_DIR sdeVersion: 9.33.0 @@ -141,7 +141,7 @@ jobs: git -C src clean -fx - name: Upload artifact for (pre)-release - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ubuntu x86-64-universal path: | @@ -156,19 +156,19 @@ jobs: run: shell: msys2 {0} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false fetch-depth: 0 - name: Setup msys and install required packages - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: msystem: mingw64 install: mingw-w64-x86_64-gcc make git zip - name: Download SDE package - uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 + uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0 with: environmentVariableName: SDE_DIR sdeVersion: 9.33.0 @@ -200,7 +200,7 @@ jobs: git -C src clean -fx - name: Upload artifact for (pre)-release - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows x86-64-universal path: | diff --git a/.github/workflows/games.yml b/.github/workflows/games.yml index a50ca594b..9c3283d92 100644 --- a/.github/workflows/games.yml +++ b/.github/workflows/games.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout SF repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.pull_request.head.sha }} path: Stockfish @@ -20,7 +20,7 @@ jobs: run: make -j build debug=yes - name: Checkout fastchess repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: Disservin/fastchess path: fastchess diff --git a/.github/workflows/iwyu.yml b/.github/workflows/iwyu.yml index f8898b1c9..bd3d17b3b 100644 --- a/.github/workflows/iwyu.yml +++ b/.github/workflows/iwyu.yml @@ -11,13 +11,13 @@ jobs: shell: bash steps: - name: Checkout Stockfish - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: path: Stockfish persist-credentials: false - name: Checkout include-what-you-use - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: include-what-you-use/include-what-you-use ref: f25caa280dc3277c4086ec345ad279a2463fea0f diff --git a/.github/workflows/matetrack.yml b/.github/workflows/matetrack.yml index fcaa0b063..8a701c8d9 100644 --- a/.github/workflows/matetrack.yml +++ b/.github/workflows/matetrack.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Checkout SF repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.pull_request.head.sha }} path: Stockfish @@ -20,7 +20,7 @@ jobs: run: make -j profile-build - name: Checkout matetrack repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: vondele/matetrack path: matetrack @@ -33,7 +33,7 @@ jobs: - name: cache syzygy id: cache-syzygy - uses: actions/cache@v4 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: | matetrack/3-4-5-wdl/ diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml index d9b783eb6..cb5e5c0d3 100644 --- a/.github/workflows/sanitizers.yml +++ b/.github/workflows/sanitizers.yml @@ -48,7 +48,7 @@ jobs: working-directory: src shell: ${{ matrix.config.shell }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/.github/workflows/stockfish.yml b/.github/workflows/stockfish.yml index d156dad79..3e69d9225 100644 --- a/.github/workflows/stockfish.yml +++ b/.github/workflows/stockfish.yml @@ -19,7 +19,7 @@ jobs: permissions: contents: write # For deleting/creating a prerelease steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -68,7 +68,7 @@ jobs: # to this pre-release. - name: Create Prerelease if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false' - uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} @@ -80,7 +80,7 @@ jobs: arm_matrix: ${{ steps.set-arm-matrix.outputs.arm_matrix }} universal_matrix: ${{ steps.set-universal-matrix.outputs.universal_matrix }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - id: set-matrix diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ab0cc52d4..03fe1b7d1 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -112,7 +112,7 @@ jobs: working-directory: src shell: ${{ matrix.config.shell }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -139,11 +139,11 @@ jobs: - name: Set up QEMU if: matrix.config.base_image - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - name: Set up Docker Buildx if: matrix.config.base_image - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - name: Build Docker container if: matrix.config.base_image @@ -161,7 +161,7 @@ jobs: - name: Setup msys and install required packages if: runner.os == 'Windows' - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: msystem: ${{ matrix.config.msys_sys }} install: mingw-w64-${{ matrix.config.msys_env }} make git expect diff --git a/.github/workflows/upload_binaries.yml b/.github/workflows/upload_binaries.yml index d4d1eed29..d91f75ecd 100644 --- a/.github/workflows/upload_binaries.yml +++ b/.github/workflows/upload_binaries.yml @@ -24,12 +24,12 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Download artifact from compilation - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} path: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} @@ -71,7 +71,7 @@ jobs: - name: Release if: startsWith(github.ref_name, 'sf_') && github.ref_type == 'tag' - uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: files: stockfish-${{ matrix.config.simple_name }}-${{ matrix.binaries }}.${{ matrix.config.archive_ext }} token: ${{ secrets.token }} @@ -105,7 +105,7 @@ jobs: - name: Prerelease if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false' continue-on-error: true - uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 with: name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }}