jirayu_sri/stockfish
1
0
Fork 0
mirror of https://github.com/official-stockfish/Stockfish.git synced 2026-07-22 12:47:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: pin root workflow actions to immutable SHAs

Browse Source 
Pin every external action used by the root GitHub workflow set to a full-length
commit SHA and keep the selected release tag as a same-line comment.

Update the root workflows to the latest stable tagged action versions found
during the audit while preserving existing release guards, permissions, and
reusable workflow wiring.

closes https://github.com/official-stockfish/Stockfish/pull/6754

No functional change.
This commit is contained in:
ppigazzini
2026-04-20 17:37:39 +02:00
committed by Joost VandeVondele
parent 4a6c7e77a5
commit 463f5a6ee1
12 changed files with 42 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/arm_compilation.yml
+2 -2
View File
@@ -23,7 +23,7 @@ jobs:
working-directory: src working-directory: src
shell: ${{ matrix.config.shell }} shell: ${{ matrix.config.shell }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
fetch-depth: 0 fetch-depth: 0
persist-credentials: false persist-credentials: false
@@ -89,7 +89,7 @@ jobs:
run: git clean -fx run: git clean -fx
- name: Upload artifact for (pre)-release - name: Upload artifact for (pre)-release
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }}
path: | path: |
.github/workflows/avx2_compilers.yml
+1 -1
View File
@@ -38,7 +38,7 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies - name: Install dependencies
run: | run: |
.github/workflows/clang-format.yml
+4 -4
View File
@@ -20,12 +20,12 @@ jobs:
name: Clang-Format name: Clang-Format
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.sha }} ref: ${{ github.event.pull_request.head.sha }}
- name: Run clang-format style check - name: Run clang-format style check
uses: jidicula/clang-format-action@4726374d1aa3c6aecf132e5197e498979588ebc8 # @v4.15.0 uses: jidicula/clang-format-action@654a770daa28443dd111d133e4083e21c1075674 # v4.18.0
id: clang-format id: clang-format
continue-on-error: true continue-on-error: true
with: with:
@@ -34,7 +34,7 @@ jobs:
- name: Comment on PR - name: Comment on PR
if: steps.clang-format.outcome == 'failure' if: steps.clang-format.outcome == 'failure'
uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # @v2.5.0 uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with: with:
message: | message: |
clang-format 20 needs to be run on this PR. clang-format 20 needs to be run on this PR.
@@ -47,7 +47,7 @@ jobs:
- name: Comment on PR - name: Comment on PR
if: steps.clang-format.outcome != 'failure' if: steps.clang-format.outcome != 'failure'
uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # @v2.5.0 uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with: with:
message: | message: |
_(execution **${{ github.run_id }}** / attempt **${{ github.run_attempt }}**)_ _(execution **${{ github.run_id }}** / attempt **${{ github.run_attempt }}**)_
.github/workflows/codeql.yml
+3 -3
View File
@@ -29,13 +29,13 @@ jobs:
steps: steps:
- name: Checkout repository - name: Checkout repository
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
# Initializes the CodeQL tools for scanning. # Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL - name: Initialize CodeQL
uses: github/codeql-action/init@v3 uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with: with:
languages: ${{ matrix.language }} languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file. # If you wish to specify custom queries, you can do so here or in a config file.
@@ -50,6 +50,6 @@ jobs:
run: make -j build run: make -j build
- name: Perform CodeQL Analysis - name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3 uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with: with:
category: "/language:${{matrix.language}}" category: "/language:${{matrix.language}}"
.github/workflows/compilation.yml
+13 -13
View File
@@ -24,26 +24,26 @@ jobs:
working-directory: src working-directory: src
shell: ${{ matrix.config.shell }} shell: ${{ matrix.config.shell }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
- name: Install fixed GCC on Linux - name: Install fixed GCC on Linux
if: runner.os == 'Linux' if: runner.os == 'Linux'
uses: egor-tensin/setup-gcc@eaa888eb19115a521fa72b65cd94fe1f25bbcaac # @v1.3 uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
with: with:
version: 11 version: 11
- name: Setup msys and install required packages - name: Setup msys and install required packages
if: runner.os == 'Windows' if: runner.os == 'Windows'
uses: msys2/setup-msys2@v2 uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
with: with:
msystem: ${{ matrix.config.msys_sys }} msystem: ${{ matrix.config.msys_sys }}
install: mingw-w64-${{ matrix.config.msys_env }} make git zip install: mingw-w64-${{ matrix.config.msys_env }} make git zip
- name: Download SDE package - name: Download SDE package
if: runner.os == 'Linux' || runner.os == 'Windows' if: runner.os == 'Linux' || runner.os == 'Windows'
uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0
with: with:
environmentVariableName: SDE_DIR environmentVariableName: SDE_DIR
sdeVersion: 9.33.0 sdeVersion: 9.33.0
@@ -85,7 +85,7 @@ jobs:
run: git clean -fx run: git clean -fx
- name: Upload artifact for (pre)-release - name: Upload artifact for (pre)-release
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }}
path: | path: |
@@ -100,18 +100,18 @@ jobs:
run: run:
shell: bash shell: bash
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
fetch-depth: 0 fetch-depth: 0
- name: Install GCC 15 - name: Install GCC 15
uses: egor-tensin/setup-gcc@eaa888eb19115a521fa72b65cd94fe1f25bbcaac # @v1.3 uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 # v2.0
with: with:
version: 15 version: 15
- name: Download SDE package - name: Download SDE package
uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0
with: with:
environmentVariableName: SDE_DIR environmentVariableName: SDE_DIR
sdeVersion: 9.33.0 sdeVersion: 9.33.0
@@ -141,7 +141,7 @@ jobs:
git -C src clean -fx git -C src clean -fx
- name: Upload artifact for (pre)-release - name: Upload artifact for (pre)-release
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: ubuntu x86-64-universal name: ubuntu x86-64-universal
path: | path: |
@@ -156,19 +156,19 @@ jobs:
run: run:
shell: msys2 {0} shell: msys2 {0}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
fetch-depth: 0 fetch-depth: 0
- name: Setup msys and install required packages - name: Setup msys and install required packages
uses: msys2/setup-msys2@v2 uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
with: with:
msystem: mingw64 msystem: mingw64
install: mingw-w64-x86_64-gcc make git zip install: mingw-w64-x86_64-gcc make git zip
- name: Download SDE package - name: Download SDE package
uses: petarpetrovt/setup-sde@f0fa5971dc275704531e94264dd23250c442aa41 # @v2.4 uses: petarpetrovt/setup-sde@2a27a21f27212e473f3cc59a6dac97d8dffe8970 # v3.0
with: with:
environmentVariableName: SDE_DIR environmentVariableName: SDE_DIR
sdeVersion: 9.33.0 sdeVersion: 9.33.0
@@ -200,7 +200,7 @@ jobs:
git -C src clean -fx git -C src clean -fx
- name: Upload artifact for (pre)-release - name: Upload artifact for (pre)-release
uses: actions/upload-artifact@v4 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with: with:
name: windows x86-64-universal name: windows x86-64-universal
path: | path: |
.github/workflows/games.yml
+2 -2
View File
@@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
steps: steps:
- name: Checkout SF repo - name: Checkout SF repo
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.sha }} ref: ${{ github.event.pull_request.head.sha }}
path: Stockfish path: Stockfish
@@ -20,7 +20,7 @@ jobs:
run: make -j build debug=yes run: make -j build debug=yes
- name: Checkout fastchess repo - name: Checkout fastchess repo
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
repository: Disservin/fastchess repository: Disservin/fastchess
path: fastchess path: fastchess
.github/workflows/iwyu.yml
+2 -2
View File
@@ -11,13 +11,13 @@ jobs:
shell: bash shell: bash
steps: steps:
- name: Checkout Stockfish - name: Checkout Stockfish
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
path: Stockfish path: Stockfish
persist-credentials: false persist-credentials: false
- name: Checkout include-what-you-use - name: Checkout include-what-you-use
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
repository: include-what-you-use/include-what-you-use repository: include-what-you-use/include-what-you-use
ref: f25caa280dc3277c4086ec345ad279a2463fea0f ref: f25caa280dc3277c4086ec345ad279a2463fea0f
.github/workflows/matetrack.yml
+3 -3
View File
@@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
steps: steps:
- name: Checkout SF repo - name: Checkout SF repo
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
ref: ${{ github.event.pull_request.head.sha }} ref: ${{ github.event.pull_request.head.sha }}
path: Stockfish path: Stockfish
@@ -20,7 +20,7 @@ jobs:
run: make -j profile-build run: make -j profile-build
- name: Checkout matetrack repo - name: Checkout matetrack repo
uses: actions/checkout@v4 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
repository: vondele/matetrack repository: vondele/matetrack
path: matetrack path: matetrack
@@ -33,7 +33,7 @@ jobs:
- name: cache syzygy - name: cache syzygy
id: cache-syzygy id: cache-syzygy
uses: actions/cache@v4 uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with: with:
path: | path: |
matetrack/3-4-5-wdl/ matetrack/3-4-5-wdl/
.github/workflows/sanitizers.yml
+1 -1
View File
@@ -48,7 +48,7 @@ jobs:
working-directory: src working-directory: src
shell: ${{ matrix.config.shell }} shell: ${{ matrix.config.shell }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
.github/workflows/stockfish.yml
+3 -3
View File
@@ -19,7 +19,7 @@ jobs:
permissions: permissions:
contents: write # For deleting/creating a prerelease contents: write # For deleting/creating a prerelease
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
@@ -68,7 +68,7 @@ jobs:
# to this pre-release. # to this pre-release.
- name: Create Prerelease - name: Create Prerelease
if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false' if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false'
uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with: with:
name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }}
tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }}
@@ -80,7 +80,7 @@ jobs:
arm_matrix: ${{ steps.set-arm-matrix.outputs.arm_matrix }} arm_matrix: ${{ steps.set-arm-matrix.outputs.arm_matrix }}
universal_matrix: ${{ steps.set-universal-matrix.outputs.universal_matrix }} universal_matrix: ${{ steps.set-universal-matrix.outputs.universal_matrix }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
- id: set-matrix - id: set-matrix
.github/workflows/tests.yml
+4 -4
View File
@@ -112,7 +112,7 @@ jobs:
working-directory: src working-directory: src
shell: ${{ matrix.config.shell }} shell: ${{ matrix.config.shell }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
fetch-depth: 0 fetch-depth: 0
persist-credentials: false persist-credentials: false
@@ -139,11 +139,11 @@ jobs:
- name: Set up QEMU - name: Set up QEMU
if: matrix.config.base_image if: matrix.config.base_image
uses: docker/setup-qemu-action@v3 uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx - name: Set up Docker Buildx
if: matrix.config.base_image if: matrix.config.base_image
uses: docker/setup-buildx-action@v3 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Build Docker container - name: Build Docker container
if: matrix.config.base_image if: matrix.config.base_image
@@ -161,7 +161,7 @@ jobs:
- name: Setup msys and install required packages - name: Setup msys and install required packages
if: runner.os == 'Windows' if: runner.os == 'Windows'
uses: msys2/setup-msys2@v2 uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
with: with:
msystem: ${{ matrix.config.msys_sys }} msystem: ${{ matrix.config.msys_sys }}
install: mingw-w64-${{ matrix.config.msys_env }} make git expect install: mingw-w64-${{ matrix.config.msys_env }} make git expect
.github/workflows/upload_binaries.yml
+4 -4
View File
@@ -24,12 +24,12 @@ jobs:
run: run:
shell: bash shell: bash
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: with:
persist-credentials: false persist-credentials: false
- name: Download artifact from compilation - name: Download artifact from compilation
uses: actions/download-artifact@v4 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} name: ${{ matrix.config.simple_name }} ${{ matrix.binaries }}
path: ${{ matrix.config.simple_name }} ${{ matrix.binaries }} path: ${{ matrix.config.simple_name }} ${{ matrix.binaries }}
@@ -71,7 +71,7 @@ jobs:
- name: Release - name: Release
if: startsWith(github.ref_name, 'sf_') && github.ref_type == 'tag' if: startsWith(github.ref_name, 'sf_') && github.ref_type == 'tag'
uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with: with:
files: stockfish-${{ matrix.config.simple_name }}-${{ matrix.binaries }}.${{ matrix.config.archive_ext }} files: stockfish-${{ matrix.config.simple_name }}-${{ matrix.binaries }}.${{ matrix.config.archive_ext }}
token: ${{ secrets.token }} token: ${{ secrets.token }}
@@ -105,7 +105,7 @@ jobs:
- name: Prerelease - name: Prerelease
if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false' if: github.ref_name == 'master' && env.CHANGES == '0' && env.OFFICIAL_RELEASE == 'false'
continue-on-error: true continue-on-error: true
uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with: with:
name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} name: Stockfish dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }}
tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }} tag_name: stockfish-dev-${{ env.COMMIT_DATE }}-${{ env.COMMIT_SHA }}