Skip to content

chore: pin GitHub Actions to immutable commit SHAs (FEPLAT-5068) #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
casper-phantom wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

chore: pin GitHub Actions to immutable commit SHAs (FEPLAT-5068) #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/android-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,22 +13,22 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: 'yarn'
- name: Set up JDK
uses: actions/setup-java@v4
uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
with:
distribution: temurin
java-version: 17
- name: Install npm dependencies
run: yarn --frozen-lockfile
shell: bash
- name: Build Android test app
uses: gradle/gradle-build-action@v2
uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
file=".github/workflows/android-ci.yml"
printf '%s\n' "--- workflow context ---"
sed -n '1,100p' "$file"
printf '%s\n' "--- Gradle action references ---"
rg -n -C 3 'gradle/(gradle-build-action|actions)|setup-gradle|build-action' .github
printf '%s\n' "--- repository metadata ---"
if command -v gh >/dev/null 2>&1; then
  gh api repos/gradle/gradle-build-action --jq '{archived,disabled,default_branch,updated_at}'
  gh api repos/gradle/actions --jq '{archived,disabled,default_branch,updated_at}'
else
  curl -fsSL https://api.github.com/repos/gradle/gradle-build-action | jq '{archived,disabled,default_branch,updated_at}'
  curl -fsSL https://api.github.com/repos/gradle/actions | jq '{archived,disabled,default_branch,updated_at}'
fi

Repository: phantom/react-native-webview

Length of output: 2171

🌐 Web query:

Gradle Build Action archived replacement gradle/actions/setup-gradle migration existing inputs

💡 Result:

The gradle/gradle-build-action has been officially archived and superseded by gradle/actions/setup-gradle [1][2]. This change is part of an effort to standardize Gradle's GitHub Actions, aligning them with other common actions like setup-java or setup-node [3]. Key migration details: 1. Replacement: Replace any instance of uses: gradle/gradle-build-action@v3 (or earlier) in your GitHub Actions workflow files with uses: gradle/actions/setup-gradle@v6 (or the latest available version) [3][4][1]. 2. Functionality: The two actions are functionally equivalent, and existing workflows using v3 of the old action will transparently delegate to the new setup-gradle action [1][5]. 3. Arguments Parameter Deprecation: The arguments parameter, previously used to execute Gradle builds directly within the action, is deprecated [3]. You should migrate away from this pattern by splitting your workflow step into two parts: - Step 1: Call setup-gradle to configure the environment. - Step 2: Use a standard run step (e.g., run:./gradlew build) to execute your build [3]. 4. Wrapper Validation: The setup-gradle action now automatically validates the Gradle Wrapper [4][6]. If you were using the standalone wrapper-validation action previously, it is likely no longer necessary [6][7]. For detailed documentation and advanced configuration, refer to the official gradle/actions repository [3][8].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

curl -fsSL https://raw.githubusercontent.com/gradle/gradle-build-action/v2.12.0/action.yml \
  -o "$tmpdir/old.yml"
curl -fsSL https://raw.githubusercontent.com/gradle/actions/v6/action.yml \
  -o "$tmpdir/new.yml"
curl -fsSL https://raw.githubusercontent.com/gradle/actions/main/docs/deprecation-upgrade-guide.md \
  -o "$tmpdir/guide.md"

python3 - "$tmpdir/old.yml" "$tmpdir/new.yml" "$tmpdir/guide.md" <<'PY'
import re, sys
from pathlib import Path

old, new, guide = map(Path, sys.argv[1:])
old_text, new_text, guide_text = old.read_text(), new.read_text(), guide.read_text()

def inputs(text):
    block = text.split("inputs:", 1)[1] if "inputs:" in text else ""
    return re.findall(r"(?m)^  ([A-Za-z0-9_-]+):\s*$", block)

print("old action inputs:", inputs(old_text))
print("new action inputs:", inputs(new_text))
for name in ("gradle-version", "arguments", "build-root-directory"):
    print(f"{name}: old={'yes' if re.search(rf'(?m)^  {re.escape(name)}:\\s*$', old_text) else 'no'} "
          f"new={'yes' if re.search(rf'(?m)^  {re.escape(name)}:\\s*$', new_text) else 'no'}")
for term in ("arguments", "build-root-directory", "gradle-version", "setup-gradle"):
    hits = [line.strip() for line in guide_text.splitlines() if term in line]
    print(f"guide {term}:", hits[:8])
PY

Repository: phantom/react-native-webview

Length of output: 435

🏁 Script executed:

#!/bin/bash
set -eu
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

curl -fsSL https://raw.githubusercontent.com/gradle/gradle-build-action/v2.12.0/action.yml \
  -o "$tmpdir/old.yml"
curl -fsSL https://raw.githubusercontent.com/gradle/actions/v6/action.yml \
  -o "$tmpdir/new.yml"
curl -fsSL https://raw.githubusercontent.com/gradle/actions/main/docs/deprecation-upgrade-guide.md \
  -o "$tmpdir/guide.md"

python3 - "$tmpdir/old.yml" "$tmpdir/new.yml" "$tmpdir/guide.md" <<'PY'
import re, sys
from pathlib import Path

old, new, guide = map(Path, sys.argv[1:])
old_text = old.read_text()
new_text = new.read_text()
guide_text = guide.read_text()

def inputs(text):
    block = text.split("inputs:", 1)[1] if "inputs:" in text else ""
    return re.findall(r"(?m)^  ([A-Za-z0-9_-]+):\s*$", block)

print("old action inputs:", inputs(old_text))
print("new action inputs:", inputs(new_text))
for name in ("gradle-version", "arguments", "build-root-directory"):
    pattern = rf"(?m)^  {re.escape(name)}:\s*$"
    old_has = bool(re.search(pattern, old_text))
    new_has = bool(re.search(pattern, new_text))
    print(f"{name}: old={'yes' if old_has else 'no'} new={'yes' if new_has else 'no'}")

for term in ("arguments", "build-root-directory", "gradle-version", "setup-gradle"):
    hits = [line.strip() for line in guide_text.splitlines() if term in line]
    print(f"guide {term}:", hits[:8])
PY

Repository: phantom/react-native-webview

Length of output: 2182

Other (CWE-1104)

Reachability: External

Replace the archived Gradle action.

Replace gradle/gradle-build-action with gradle/actions/setup-gradle. Move the arguments command to a separate run step. Preserve gradle-version: wrapper and build-root-directory: example/android.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 31-31: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/android-ci.yml at line 31, Update the workflow step using
gradle/gradle-build-action to gradle/actions/setup-gradle, preserving
gradle-version: wrapper and build-root-directory: example/android. Remove the
action’s arguments configuration and add a separate run step that executes the
existing Gradle command.

Source: Linters/SAST tools

with:
gradle-version: wrapper
arguments: -PnewArchEnabled=${{matrix.newArchEnabled}} --no-daemon clean build check test
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/detox.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ jobs:
runs-on: 'macOS-latest'
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: 'yarn'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ios-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ jobs:
runs-on: macos-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: 'yarn'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/macos-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ jobs:
runs-on: macos-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- name: Set up Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 20
cache: 'yarn'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,13 @@ jobs:
pull-requests: write
steps:
- name: Checkout Repo
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Enable Corepack
run: corepack enable

- name: Setup Node.js 20.x
uses: actions/setup-node@v3
uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
with:
node-version: 20.x

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v3.0.14
- uses: actions/stale@87c2b794b9b47a9bec68ae03c01aeb572ffebdb1 # v3.0.14
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
stale-issue-message: 'Hello 👋, this issue has been opened for more than 2 months with no activity on it. If the issue is still here, please keep in mind that we need community support and help to fix it! Just comment something like _still searching for solutions_ and if you found one, please open a pull request! You have 7 days until this gets closed automatically'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/windows-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@ jobs:
runs-on: windows-2022

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
name: Checkout Code

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '20'
cache: 'yarn'

- name: Setup MSBuild
uses: microsoft/setup-msbuild@v1.1.3
uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1.3
with:
vs-version: '[17.0,)'
msbuild-architecture: x64
Expand Down
Loading