From 348370830a11d843434ed72f8a2a802fed8789d2 Mon Sep 17 00:00:00 2001 From: Wendell Smith Date: Thu, 12 Mar 2026 15:21:29 -0400 Subject: [PATCH 1/2] ci: add protected environment to release job --- .github/workflows/release-plz.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index 35663d2d..a9f71565 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -21,6 +21,7 @@ jobs: release-plz-release: name: Release runs-on: ubuntu-latest + environment: protected-main-env steps: - uses: actions/checkout@v4 with: From bd290b101f3b468a0fcf91d9b25deaa91a693b23 Mon Sep 17 00:00:00 2001 From: Wendell Smith Date: Thu, 12 Mar 2026 15:29:02 -0400 Subject: [PATCH 2/2] ci: pin all actions by SHA, add dependabot, update to latest --- .github/dependabot.yml | 10 ++++++++++ .github/workflows/docs.yml | 8 ++++---- .github/workflows/release-plz.yml | 4 ++-- .github/workflows/rust.yml | 10 +++++----- 4 files changed, 21 insertions(+), 11 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..ee861b6c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + groups: + gh-actions-packages: + patterns: + - "*" diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index e19decc2..a5bffba3 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -21,9 +21,9 @@ jobs: name: Build docs runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1 + - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 - name: Build docs id: build_docs @@ -34,7 +34,7 @@ jobs: - name: Upload docs id: upload_docs - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: target/doc @@ -47,4 +47,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index a9f71565..a6354f6b 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -23,12 +23,12 @@ jobs: runs-on: ubuntu-latest environment: protected-main-env steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: # Full history is needed so release-plz can find the last release # tag and generate accurate changelogs. fetch-depth: 0 - - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1 + - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 - uses: release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5.128 with: # "release" compares Cargo.toml version to crates.io; if newer, diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 92189568..4d8159f2 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -20,7 +20,7 @@ jobs: name: Format runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check formatting run: cargo fmt -- --check --config imports_granularity=Module,group_imports=StdExternalCrate @@ -28,11 +28,11 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 # Uses rust cache action, stnadard in Rust community. # Added to allowlist here: # https://github.com/DataDog/substrait-explain/settings/actions - - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1 + - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 - name: Lint with Clippy run: cargo clippy --features protoc -- -D warnings - name: Lint with Clippy (All features) @@ -42,8 +42,8 @@ jobs: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1 - name: Run tests run: cargo test --all-features --verbose