git.iko.soy/typeable/oauth2-proxy
on master help sign in
ci: hardening by replacing all tags using immutable commit hashes (#3507)

Signed-off-by: Jan Larwig <jan@larwig.com>

commitc4043233cf5205805e8d803d1164373b3e832449 authorJan Larwig <jan@larwig.com> dateTue 18 Aug 2026, 09:31 (1 month ago) parentd707a36
8 files changed+34−34
compare with master
unifiedsplit
.github/workflows/ci.yml+8−8 .github/workflows/codeql.yml+4−4 .github/workflows/create-release.yml+2−2 .github/workflows/docs.yml+7−7 .github/workflows/labeler.yml+1−1 .github/workflows/nightly.yml+4−4 .github/workflows/publish-release.yml+7−7 .github/workflows/stale.yml+1−1
.github/workflows/ci.yml+8−8
@@ -19,7 +19,7 @@ jobs:
1919 runs-on: ubuntu-latest
2020 steps:
2121 - name: Check out code
22− uses: actions/checkout@v7
22+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2323 with:
2424 fetch-depth: 0
2525
@@ -30,7 +30,7 @@ jobs:
3030 id: go-version
3131
3232 - name: Set up Go
33− uses: actions/setup-go@v6
33+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
3434 with:
3535 go-version: ${{ steps.go-version.outputs.version }}
3636 check-latest: true
@@ -68,14 +68,14 @@ jobs:
6868
6969 - name: Upload Coverage Report
7070 if: github.event_name == 'push'
71− uses: qltysh/qlty-action/coverage@v2
71+ uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0
7272 with:
7373 oidc: true
7474 files: lcov.info
7575
7676 - name: Run Trivy vulnerability scanner
7777 if: (!startsWith(github.head_ref, 'release'))
78− uses: aquasecurity/trivy-action@0.35.0
78+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
7979 with:
8080 scan-type: 'rootfs'
8181 scan-ref: './oauth2-proxy'
@@ -87,7 +87,7 @@ jobs:
8787
8888 - name: Upload Trivy scan results
8989 if: (!startsWith(github.head_ref, 'release'))
90− uses: github/codeql-action/upload-sarif@v4
90+ uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
9191 with:
9292 sarif_file: 'trivy-results.sarif'
9393
@@ -95,16 +95,16 @@ jobs:
9595 runs-on: ubuntu-latest
9696 steps:
9797 - name: Check out code
98− uses: actions/checkout@v7
98+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
9999 with:
100100 fetch-depth: 0
101101
102102 - name: Set up QEMU
103− uses: docker/setup-qemu-action@v3
103+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
104104
105105 - name: Set up Docker Buildx
106106 id: buildx
107− uses: docker/setup-buildx-action@v3
107+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
108108
109109 - name: Docker Build
110110 if: (!startsWith(github.head_ref, 'release'))
.github/workflows/codeql.yml+4−4
@@ -32,18 +32,18 @@ jobs:
3232
3333 steps:
3434 - name: Checkout repository
35− uses: actions/checkout@v7
35+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3636
3737 # Initializes the CodeQL tools for scanning.
3838 - name: Initialize CodeQL
39− uses: github/codeql-action/init@v3
39+ uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
4040 with:
4141 languages: go
4242
4343 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
4444 # If this step fails, then you should remove it and run the build manually (see below)
4545 - name: Autobuild
46− uses: github/codeql-action/autobuild@v3
46+ uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
4747
4848 # ℹ️ Command-line programs to run using the OS shell.
4949 # 📚 https://git.io/JvXDl
@@ -57,4 +57,4 @@ jobs:
5757 # make release
5858
5959 - name: Perform CodeQL Analysis
60− uses: github/codeql-action/analyze@v3
60+ uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
.github/workflows/create-release.yml+2−2
@@ -17,7 +17,7 @@ jobs:
1717 runs-on: ubuntu-latest
1818 steps:
1919 - name: Check out code
20− uses: actions/checkout@v7
20+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2121 with:
2222 ref: master
2323 fetch-depth: 0
@@ -54,7 +54,7 @@ jobs:
5454 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
5555
5656 - name: Setup node
57− uses: actions/setup-node@v6
57+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
5858 with:
5959 node-version-file: docs/package.json
6060
.github/workflows/docs.yml+7−7
@@ -14,13 +14,13 @@ jobs:
1414 if: github.event_name == 'pull_request'
1515 runs-on: ubuntu-latest
1616 steps:
17− - uses: actions/checkout@v7
17+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1818
1919 - name: Setup Pages
2020 id: pages
21− uses: actions/configure-pages@v5
21+ uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
2222
23− - uses: actions/setup-node@v6
23+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
2424 with:
2525 # renovate: datasource=node-version depName=node
2626 node-version: 24
@@ -35,9 +35,9 @@ jobs:
3535 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
3636 runs-on: ubuntu-latest
3737 steps:
38− - uses: actions/checkout@v7
38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3939
40− - uses: actions/setup-node@v6
40+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
4141 with:
4242 # renovate: datasource=node-version depName=node
4343 node-version: 24
@@ -49,7 +49,7 @@ jobs:
4949 npm run build
5050
5151 - name: Upload artifact
52− uses: actions/upload-pages-artifact@v5
52+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
5353 with:
5454 path: ./docs/build
5555
@@ -65,4 +65,4 @@ jobs:
6565 steps:
6666 - name: Deploy to GitHub Pages
6767 id: deployment
68− uses: actions/deploy-pages@v4
68+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
.github/workflows/labeler.yml+1−1
@@ -9,7 +9,7 @@ jobs:
99 pull-requests: write
1010 runs-on: ubuntu-latest
1111 steps:
12− - uses: actions/labeler@v6
12+ - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
1313 with:
1414 sync-labels: true
1515 dot: true
.github/workflows/nightly.yml+4−4
@@ -12,21 +12,21 @@ jobs:
1212 if: github.repository == 'oauth2-proxy/oauth2-proxy'
1313 steps:
1414 - name: Check out code
15− uses: actions/checkout@v7
15+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1616 with:
1717 ref: master
1818 fetch-depth: 0
1919 fetch-tags: true
2020
2121 - name: Set up QEMU
22− uses: docker/setup-qemu-action@v3
22+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
2323
2424 - name: Set up Docker Buildx
2525 id: buildx
26− uses: docker/setup-buildx-action@v3
26+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
2727
2828 - name: Login to quay.io
29− uses: docker/login-action@v3
29+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
3030 with:
3131 registry: quay.io/oauth2-proxy
3232 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}
.github/workflows/publish-release.yml+7−7
@@ -20,7 +20,7 @@ jobs:
2020 tag: ${{ steps.tag.outputs.version }}
2121 steps:
2222 - name: Check out code
23− uses: actions/checkout@v7
23+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2424 with:
2525 ref: ${{ github.event.pull_request.merge_commit_sha }}
2626 fetch-depth: 0
@@ -50,7 +50,7 @@ jobs:
5050 id: go-version
5151
5252 - name: Set up Go
53− uses: actions/setup-go@v6
53+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
5454 with:
5555 go-version: ${{ steps.go-version.outputs.version }}
5656 check-latest: true
@@ -64,7 +64,7 @@ jobs:
6464
6565 # Upload artifacts in case of workflow failure
6666 - name: Upload Artifacts
67− uses: actions/upload-artifact@v7
67+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
6868 with:
6969 name: oauth2-proxy-artifacts
7070 path: |
@@ -100,21 +100,21 @@ jobs:
100100 runs-on: ubuntu-latest
101101 steps:
102102 - name: Check out code
103− uses: actions/checkout@v7
103+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
104104 with:
105105 ref: ${{ needs.publish.outputs.tag }}
106106 fetch-depth: 0
107107 fetch-tags: true
108108
109109 - name: Set up QEMU
110− uses: docker/setup-qemu-action@v3
110+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
111111
112112 - name: Set up Docker Buildx
113113 id: buildx
114− uses: docker/setup-buildx-action@v3
114+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
115115
116116 - name: Login to quay.io
117− uses: docker/login-action@v3
117+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
118118 with:
119119 registry: quay.io/oauth2-proxy
120120 username: ${{ secrets.REGISTRY_USERNAME }}
.github/workflows/stale.yml+1−1
@@ -10,7 +10,7 @@ jobs:
1010 runs-on: ubuntu-latest
1111
1212 steps:
13− - uses: actions/stale@v10
13+ - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
1414 with:
1515 repo-token: ${{ secrets.GITHUB_TOKEN }}
1616 days-before-stale: 180