You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2023/01/25 10:00:54 UTC
[cxf] branch main updated: [StepSecurity] ci: Harden GitHub Actions (#1090)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 4ab7b061ba [StepSecurity] ci: Harden GitHub Actions (#1090)
4ab7b061ba is described below
commit 4ab7b061ba3b944f6c22842c3f4be10bfcf4efc0
Author: StepSecurity Bot <bo...@stepsecurity.io>
AuthorDate: Wed Jan 25 02:00:47 2023 -0800
[StepSecurity] ci: Harden GitHub Actions (#1090)
Signed-off-by: StepSecurity Bot <bo...@stepsecurity.io>
Signed-off-by: StepSecurity Bot <bo...@stepsecurity.io>
---
.github/workflows/codeql-analysis.yml | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2d5dbe50f5..6eab174bbf 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,18 +37,18 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v3
+ uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2
- name: Setup JDK 17
- uses: actions/setup-java@v3
+ uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
with:
distribution: 'temurin'
java-version: '17'
- name: Cache local Maven repository
- uses: actions/cache@v3
+ uses: actions/cache@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -61,7 +61,7 @@ jobs:
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v2
+ uses: github/codeql-action/init@a34ca99b4610d924e04c68db79e503e1f79f9f02 # v2.1.39
with:
languages: ${{ matrix.language }}
#config-file: ./.github/codeql/codeql-cxf-config.yml
@@ -89,4 +89,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v2
+ uses: github/codeql-action/analyze@a34ca99b4610d924e04c68db79e503e1f79f9f02 # v2.1.39