gbucchino/openssh-portable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add script to lookup and pin Actions to hashes.

Browse Source 
Update recently changed Cygwin Actions and pin remaining unpinned ones.
This commit is contained in:
Darren Tucker
2026-06-22 19:32:25 +10:00
parent faa646a9bf
commit 01404fa5da
6 changed files with 59 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/pin_actions.sh
Executable
+33
View File
@@ -0,0 +1,33 @@
#!/bin/sh
#
# Look up specified version of Github Actions an pin to that specific
# revision.
#
set -e
github=https://github.com
for workflow in workflows/*.yml; do
echo workflow: $workflow
sed 's/ - / /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \
while read line; do
action_ver=$(awk '{print $2}' <<<${line})
action=$(cut -f1 -d@ <<<${action_ver})
ver=$(cut -f2 -d@ <<<${action_ver})
intendedver=$(awk '{print $4}' <<<${line})
if [ -z "${intendedver}" ]; then
intendedver=${ver}
fi
case "${action}" in
google/oss-fuzz/*) actiondir=google/oss-fuzz ;;
*) actiondir="${action}" ;;
esac
if [ ! -d /tmp/${actiondir} ]; then
git clone ${github}/${actiondir} /tmp/${actiondir}
fi
hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver})
sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \
${workflow}
done
done
.github/workflows/c-cpp.yml
+2 -2
View File
@@ -134,10 +134,10 @@ jobs:
- name: install cygwin
id: cygwin_install
if: ${{ startsWith(matrix.target, 'windows') }}
uses: cygwin/cygwin-install-action@4ef15ca7fd18a18f1000989fcfd968e06d146ce8 # master
uses: cygwin/cygwin-install-action@a3d72946b163026bbd0fa9a88379ccbda4bd86bb # master
env:
CYGWIN: "winsymlinks:native"
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: setup CI system
run: |
sh -c "timeout 1200 .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }} || .github/setup_ci.sh ${{ matrix.config }} ${{ matrix.target }}"
.github/workflows/cifuzz.yml
+3 -3
View File
@@ -12,20 +12,20 @@ jobs:
steps:
- name: Build Fuzzers
id: build
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
with:
oss-fuzz-project-name: 'openssh'
dry-run: false
language: c++
- name: Run Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@b1836d5aed2e5aaae7f618ddd40bbcc477119825 # master
with:
oss-fuzz-project-name: 'openssh'
fuzz-seconds: 600
dry-run: false
language: c++
- name: Upload Crash
uses: actions/upload-artifact@main
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
if: failure() && steps.build.outcome == 'success'
with:
name: artifacts
.github/workflows/selfhosted.yml
+4 -4
View File
@@ -105,7 +105,7 @@ jobs:
- name: shutdown VM if running
if: env.VM == 'true'
run: vmshutdown
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: autoreconf
- name: startup VM
@@ -119,7 +119,7 @@ jobs:
- name: configure
run: vmrun ./.github/configure.sh ${{ matrix.config }}
# - name: save config
# uses: actions/upload-artifact@main
# uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
# with:
# name: ${{ matrix.target }}-${{ matrix.config }}-config
# path: config.h
@@ -135,7 +135,7 @@ jobs:
run: vmrun 'for i in regress/failed*.log; do echo ====; echo logfile $i; echo =====; cat $i; done'
- name: save logs
if: failure()
uses: actions/upload-artifact@main
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: ${{ matrix.target }}-${{ matrix.config }}-logs
path: |
@@ -184,7 +184,7 @@ jobs:
- name: bigendian interop - save logs
if: failure() && env.BIGENDIAN == 'true'
uses: actions/upload-artifact@main
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: ${{ matrix.target }}-${{ matrix.config }}-interop-logs
path: |
.github/workflows/upstream.yml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
- name: shutdown VM if running
run: vmshutdown
working-directory: ${{ runner.temp }}
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: startup VM
run: vmstartup
working-directory: ${{ runner.temp }}
.github/workflows/vm.yml
+16 -16
View File
@@ -23,12 +23,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start DragonFlyBSD ${{ matrix.target }} VM
uses: vmactions/dragonflybsd-vm@v1
uses: vmactions/dragonflybsd-vm@4ba8127bd95c94b66fc4b885e37c99955ba308ea # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -86,12 +86,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start FreeBSD ${{ matrix.target }} VM
uses: vmactions/freebsd-vm@v1
uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -168,12 +168,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start NetBSD ${{ matrix.target }} VM
uses: vmactions/netbsd-vm@v1
uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -243,12 +243,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OmniOS ${{ matrix.target }} VM
uses: vmactions/omnios-vm@v1
uses: vmactions/omnios-vm@7f2be0b927aad1a78498c8aeeac4c4ce1fabd322 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -300,12 +300,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start OpenBSD ${{ matrix.target }} VM
uses: vmactions/openbsd-vm@v1
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
release: ${{ matrix.target }}
usesh: true
@@ -349,7 +349,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: start OpenBSD VM
uses: vmactions/openbsd-vm@v1
uses: vmactions/openbsd-vm@18edb32f4e48dae5865d7b8b3a9587bc01218a20 # v1
with:
copyback: false
nat: |
@@ -371,7 +371,7 @@ jobs:
echo "SNAPSHOT_VERSION=${ver}" >> $GITHUB_ENV
- name: check for cached sysupgrade
id: cache-sysupgrade
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
@@ -391,7 +391,7 @@ jobs:
rsync -av openbsd:/home/_sysupgrade/ /tmp/_sysupgrade/
- name: save sysupgrade to cache
if: steps.cache-sysupgrade.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
key: openbsd-sysupgrade ${{ env.SNAPSHOT_VERSION }}
path: /tmp/_sysupgrade/
@@ -431,7 +431,7 @@ jobs:
for i in regress-logs/failed*.log; do echo ===; echo LOGFILE: $i; echo ===; cat $i; echo; done
- name: save logs
if: failure()
uses: actions/upload-artifact@main
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # main
with:
name: openbsd-current-upstream-logs
path: regress-logs/*.log
@@ -449,12 +449,12 @@ jobs:
config: [default]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@main
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # main
- name: autoreconf
run: sh -c autoreconf
- name: start Solaris ${{ matrix.target }} VM
uses: vmactions/solaris-vm@v1
uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1
with:
release: ${{ matrix.target }}
usesh: true