From 297f4e26a5bca33141e15fde0b8443450b30957b Mon Sep 17 00:00:00 2001 From: Felipe Knorr Kuhn Date: Wed, 19 Aug 2026 13:58:37 +0900 Subject: [PATCH 1/4] Pin workflows to their shas --- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/on-tag.yml | 8 ++++---- .github/workflows/project-review-status.yml | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0ac4b0b5..6d1cfe53 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: name: Compile Check runs-on: mempool-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -23,7 +23,7 @@ jobs: name: Formatter runs-on: mempool-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -34,7 +34,7 @@ jobs: name: Run Tests runs-on: mempool-ci steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -47,9 +47,9 @@ jobs: env: FREEBSD_VER: "14.3" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Cache dependencies for FreeBSD - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: | .cargohome/registry @@ -57,7 +57,7 @@ jobs: target key: freebsd-${{ env.FREEBSD_VER }}-cargo-checks-${{ hashFiles('**/Cargo.lock') }} - name: Compile Checks in FreeBSD - uses: vmactions/freebsd-vm@v1 + uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1 with: usesh: true release: "${{ env.FREEBSD_VER }}" @@ -97,7 +97,7 @@ jobs: '-F electrum-discovery,liquid', ] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml index c587c80b..b79a3f0a 100644 --- a/.github/workflows/on-tag.yml +++ b/.github/workflows/on-tag.yml @@ -42,21 +42,21 @@ jobs: run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin - name: Checkout project - uses: actions/checkout@v3 + uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 id: qemu - name: Setup Docker buildx action - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 id: buildx - name: Available platforms run: echo ${{ steps.buildx.outputs.platforms }} - name: Cache Docker layers - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 id: cache with: path: /tmp/.buildx-cache diff --git a/.github/workflows/project-review-status.yml b/.github/workflows/project-review-status.yml index fa9e1184..c8512717 100644 --- a/.github/workflows/project-review-status.yml +++ b/.github/workflows/project-review-status.yml @@ -8,7 +8,7 @@ on: jobs: project-automation: - uses: mempool/.github/.github/workflows/project-board-automation.yml@master + uses: mempool/.github/.github/workflows/project-board-automation.yml@86b3a255a9a60ac3396d516bd26a64a171aef7d5 # master with: project-number: 8 secrets: From 13789887e5afd134678f5214926946b9a58bb85d Mon Sep 17 00:00:00 2001 From: Felipe Knorr Kuhn Date: Wed, 19 Aug 2026 15:29:17 +0900 Subject: [PATCH 2/4] Upgrade and pin actions --- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/on-tag.yml | 8 ++++---- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6d1cfe53..daa379f2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: name: Compile Check runs-on: mempool-ci steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -23,7 +23,7 @@ jobs: name: Formatter runs-on: mempool-ci steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -34,7 +34,7 @@ jobs: name: Run Tests runs-on: mempool-ci steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: @@ -47,9 +47,9 @@ jobs: env: FREEBSD_VER: "14.3" steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Cache dependencies for FreeBSD - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | .cargohome/registry @@ -57,7 +57,7 @@ jobs: target key: freebsd-${{ env.FREEBSD_VER }}-cargo-checks-${{ hashFiles('**/Cargo.lock') }} - name: Compile Checks in FreeBSD - uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1 + uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3 with: usesh: true release: "${{ env.FREEBSD_VER }}" @@ -97,7 +97,7 @@ jobs: '-F electrum-discovery,liquid', ] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust uses: './.github/actions/ci-rust-setup' with: diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml index b79a3f0a..ee061d6c 100644 --- a/.github/workflows/on-tag.yml +++ b/.github/workflows/on-tag.yml @@ -42,21 +42,21 @@ jobs: run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin - name: Checkout project - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up QEMU - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 id: qemu - name: Setup Docker buildx action - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 id: buildx - name: Available platforms run: echo ${{ steps.buildx.outputs.platforms }} - name: Cache Docker layers - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: cache with: path: /tmp/.buildx-cache From 3eeb7d73a744db7750238d3d4b9e441cb82d69a0 Mon Sep 17 00:00:00 2001 From: Felipe Knorr Kuhn Date: Wed, 19 Aug 2026 15:45:00 +0900 Subject: [PATCH 3/4] Bump the project automation hash --- .github/workflows/project-review-status.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/project-review-status.yml b/.github/workflows/project-review-status.yml index c8512717..63f68e45 100644 --- a/.github/workflows/project-review-status.yml +++ b/.github/workflows/project-review-status.yml @@ -8,7 +8,7 @@ on: jobs: project-automation: - uses: mempool/.github/.github/workflows/project-board-automation.yml@86b3a255a9a60ac3396d516bd26a64a171aef7d5 # master + uses: mempool/.github/.github/workflows/project-board-automation.yml@1b41bb42b0876d8469dc5c5878711aeffb678266 # master with: project-number: 8 secrets: From d32a76c0b121af82e4021302e5957d8f41a43d73 Mon Sep 17 00:00:00 2001 From: Felipe Knorr Kuhn Date: Wed, 19 Aug 2026 16:03:15 +0900 Subject: [PATCH 4/4] Fix the missing permissions --- .github/workflows/project-review-status.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/project-review-status.yml b/.github/workflows/project-review-status.yml index 63f68e45..7ff6f354 100644 --- a/.github/workflows/project-review-status.yml +++ b/.github/workflows/project-review-status.yml @@ -6,6 +6,9 @@ on: issues: types: [opened] +permissions: + contents: read + jobs: project-automation: uses: mempool/.github/.github/workflows/project-board-automation.yml@1b41bb42b0876d8469dc5c5878711aeffb678266 # master