From 07c9e10cbf0f9e507ee52f795e4b415eb8fecc65 Mon Sep 17 00:00:00 2001 From: Shirofune-Security <43838376+Shirofune-Security@users.noreply.github.com> Date: Sat, 24 Oct 2026 00:37:29 +0900 Subject: [PATCH] chore(ci): update GitHub Actions and SHA-pin docs.yml Updates GitHub Actions to their latest releases and switches .github/workflows/docs.yml from floating major tags to commit-SHA pins, so every actions/* reference is pinned by SHA with a version comment (matching the convention used in the other workflows). - actions/checkout v6.0.2 -> v7.0.1 (docs.yml was already @v7) - actions/setup-python v6 / v6.3.0 -> v7.1.0 - actions/setup-node v6.4.0 -> v7.1.0 - actions/upload-artifact v7.0.1 -> v7.0.2 - actions/configure-pages -> v6.0.0 (SHA-pinned) - actions/upload-pages-artifact -> v5.0.0 (SHA-pinned) - actions/deploy-pages -> v5.0.1 (SHA-pinned) peter-evans/create-pull-request (v8.1.1) and peter-evans/enable-pull-request-automerge (v3.0.0) are already on their latest releases and left unchanged. Safe for our usage: checkout v7 only changes pull_request_target / workflow_run behavior (unused here); setup-python v7 drops the unused pip-install input (both usages pass only python-version / cache). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/check-audit.yml | 2 +- .github/workflows/create-csv.yml | 2 +- .github/workflows/create-rule-meta.yml | 8 ++++---- .github/workflows/docs.yml | 10 +++++----- .github/workflows/release.yml | 8 ++++---- .github/workflows/test-domain-ntlm.yml | 2 +- .github/workflows/update-attack-remap.yml | 4 ++-- 7 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/check-audit.yml b/.github/workflows/check-audit.yml index 857adb3d..92ea9779 100644 --- a/.github/workflows/check-audit.yml +++ b/.github/workflows/check-audit.yml @@ -15,7 +15,7 @@ jobs: os: [windows-latest, windows-2022, windows-2025] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check PowerShell version(PowerShell core) run: | $PSVersionTable.PSVersion diff --git a/.github/workflows/create-csv.yml b/.github/workflows/create-csv.yml index 95a54948..e7296e76 100644 --- a/.github/workflows/create-csv.yml +++ b/.github/workflows/create-csv.yml @@ -13,7 +13,7 @@ jobs: os: [windows-2022, windows-2025] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Generate csv from auditpol /list /subcategory:* /r run: | $data = auditpol /list /subcategory:* /r diff --git a/.github/workflows/create-rule-meta.yml b/.github/workflows/create-rule-meta.yml index fbd3f914..96e6c921 100644 --- a/.github/workflows/create-rule-meta.yml +++ b/.github/workflows/create-rule-meta.yml @@ -13,19 +13,19 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout self repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha }} path: WELA - name: Checkout wela-extractor - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Yamato-Security/WELA-RulesGenerator path: wela-extractor - name: Checkout hayabusa-rules - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Yamato-Security/hayabusa-rules path: hayabusa-rules @@ -83,7 +83,7 @@ jobs: - name: upload change log if: env.change_exist == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: changed_rule_log path: ${{ github.workspace }}/changed_rule.logs diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 163aa24c..f236af33 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -27,12 +27,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.x" cache: pip @@ -47,10 +47,10 @@ jobs: run: mkdocs build --strict --config-file website/mkdocs.yml - name: Configure Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: website/site @@ -63,4 +63,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 96c929f5..7d4c973e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.inputs.branch_or_tag }} submodules: 'true' @@ -48,14 +48,14 @@ jobs: - name: Upload Artifacts if: contains(matrix.info.os, 'windows') == true - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.set_artifact_name.outputs.artifact_name }} path: release-binaries/* - name: Setup node if: matrix.info.os == 'macos-latest' - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20 @@ -69,7 +69,7 @@ jobs: - name: Upload Document Artifacts if: matrix.info.os == 'macos-latest' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wela-documents path: | diff --git a/.github/workflows/test-domain-ntlm.yml b/.github/workflows/test-domain-ntlm.yml index d94dfec0..2a4118fe 100644 --- a/.github/workflows/test-domain-ntlm.yml +++ b/.github/workflows/test-domain-ntlm.yml @@ -10,7 +10,7 @@ jobs: test: runs-on: windows-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Test domain NTLM policy in Windows PowerShell 5.1 shell: powershell run: ./tests/DomainNtlm.Tests.ps1 diff --git a/.github/workflows/update-attack-remap.yml b/.github/workflows/update-attack-remap.yml index 2a14d0c6..41707e18 100644 --- a/.github/workflows/update-attack-remap.yml +++ b/.github/workflows/update-attack-remap.yml @@ -15,10 +15,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout self repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.12'