From f20c7eb4758e36973fe98d3731236c8b5b1e2b1b Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 15 Oct 2026 10:19:41 -0400 Subject: [PATCH 1/5] ci: Pin all external actions using pinact --- .github/workflows/cleanup-stale-ec2.yml | 2 +- .github/workflows/nix-build.yml | 12 ++++++------ .github/workflows/nix-dependency-analysis.yml | 8 ++++---- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/cleanup-stale-ec2.yml b/.github/workflows/cleanup-stale-ec2.yml index c24d894da0..f935b3e116 100644 --- a/.github/workflows/cleanup-stale-ec2.yml +++ b/.github/workflows/cleanup-stale-ec2.yml @@ -25,7 +25,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ matrix.region }} diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index fa15ad8865..1d53150ad1 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -48,7 +48,7 @@ jobs: - name: Upload drvPaths artifact if: github.event_name == 'pull_request' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: head-drvpaths path: /tmp/drvpaths/*.json @@ -313,7 +313,7 @@ jobs: # HEAD side already done in eval - name: Download head drvPaths - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: head-drvpaths path: /tmp/head-drvpaths @@ -330,7 +330,7 @@ jobs: run: ./head/ci/version-diff/diff.sh "${{ matrix.system }}" - name: Upload diff artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: diff-${{ matrix.system }} path: /tmp/diff.txt @@ -348,7 +348,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: Download diff artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: pattern: diff-* path: diffs @@ -358,7 +358,7 @@ jobs: run: ./ci/version-diff/comment.sh - name: Find existing version diff comment - uses: peter-evans/find-comment@v3 + uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 id: fc with: issue-number: ${{ github.event.pull_request.number }} @@ -366,7 +366,7 @@ jobs: body-includes: "" - name: Comment on PR - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 with: comment-id: ${{ steps.fc.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml index d4b4fd8990..4630e71f49 100644 --- a/.github/workflows/nix-dependency-analysis.yml +++ b/.github/workflows/nix-dependency-analysis.yml @@ -60,7 +60,7 @@ jobs: fi - name: Find existing dependency comment - uses: peter-evans/find-comment@v3 + uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 id: fc-dep if: github.event_name == 'pull_request' with: @@ -69,7 +69,7 @@ jobs: body-includes: "" - name: Create or update dependency comment - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-dep.outputs.comment-id }} @@ -112,7 +112,7 @@ jobs: fi - name: Find existing extension comment - uses: peter-evans/find-comment@v3 + uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 id: fc-ext if: github.event_name == 'pull_request' with: @@ -121,7 +121,7 @@ jobs: body-includes: "" - name: Create or update extension comment - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-ext.outputs.comment-id }} From 7b4d6fdaedf78bae58944f6042292b1ea2632579 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 15 Oct 2026 10:21:40 -0400 Subject: [PATCH 2/5] ci: Update all the actions! Latest and greatest!!! Also to drop deprecated nodejs20 warnings. --- .github/actions/install-nix/action.yml | 2 +- .github/actions/shared-checkout/action.yml | 2 +- .github/workflows/ami-release-nix.yml | 16 +++++----- .../workflows/check-extension-versions.yml | 4 +-- .github/workflows/cleanup-stale-ec2.yml | 2 +- .github/workflows/cli-release.yml | 8 ++--- .github/workflows/cli-smoke-test.yml | 6 ++-- .github/workflows/docker-image-test.yml | 6 ++-- .../workflows/dockerhub-release-matrix.yml | 14 ++++---- .github/workflows/manual-docker-release.yml | 14 ++++---- .github/workflows/mirror-postgrest.yml | 4 +-- .github/workflows/mirror.yml | 8 ++--- .github/workflows/nix-build.yml | 32 +++++++++---------- .github/workflows/nix-dependency-analysis.yml | 8 ++--- .github/workflows/publish-migrations-prod.yml | 2 +- .../workflows/publish-migrations-staging.yml | 2 +- ...ublish-nix-pgupgrade-bin-flake-version.yml | 8 ++--- .../publish-nix-pgupgrade-scripts.yml | 8 ++--- .github/workflows/qemu-image-build.yml | 10 +++--- .github/workflows/testinfra-ami-build.yml | 8 ++--- .../update-flake-lock-non-critical.yml | 4 +-- .github/workflows/update-flake-lock.yml | 6 ++-- 22 files changed, 87 insertions(+), 87 deletions(-) diff --git a/.github/actions/install-nix/action.yml b/.github/actions/install-nix/action.yml index ba987904d2..8fffe1bcc7 100644 --- a/.github/actions/install-nix/action.yml +++ b/.github/actions/install-nix/action.yml @@ -35,7 +35,7 @@ runs: ROLE_TO_ASSUME: ${{ inputs.role-to-assume }} - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 if: steps.resolve-push-to-cache.outputs.value == 'true' with: role-to-assume: ${{ inputs.role-to-assume }} diff --git a/.github/actions/shared-checkout/action.yml b/.github/actions/shared-checkout/action.yml index a490dd26d2..3bdea0fdee 100644 --- a/.github/actions/shared-checkout/action.yml +++ b/.github/actions/shared-checkout/action.yml @@ -4,7 +4,7 @@ runs: using: "composite" steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} ref: ${{ github.event.pull_request.head.sha || github.sha }} diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml index 9b90e92290..c167ad654f 100644 --- a/.github/workflows/ami-release-nix.yml +++ b/.github/workflows/ami-release-nix.yml @@ -71,7 +71,7 @@ jobs: fi - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -136,7 +136,7 @@ jobs: tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" . - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -148,7 +148,7 @@ jobs: aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz" - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -160,14 +160,14 @@ jobs: aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz" - name: GitHub OIDC Auth - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-region: us-east-1 role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role role-session-name: shared-services-jump - name: Assume destination role - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: aws-region: us-east-1 role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512 @@ -204,7 +204,7 @@ jobs: echo "Catalog uploaded to ${CATALOG_S3}" - name: Create release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: name: ${{ env.RELEASE_TAG }} tag_name: ${{ env.RELEASE_TAG }} @@ -245,7 +245,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -255,7 +255,7 @@ jobs: - name: Configure AWS credentials for cleanup if: always() - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} diff --git a/.github/workflows/check-extension-versions.yml b/.github/workflows/check-extension-versions.yml index f74e2a3c67..5d2430ac3d 100644 --- a/.github/workflows/check-extension-versions.yml +++ b/.github/workflows/check-extension-versions.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix uses: ./.github/actions/install-nix @@ -24,7 +24,7 @@ jobs: run: nix run .#check-ext-versions - name: Create Pull Request - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore: update extension versions" diff --git a/.github/workflows/cleanup-stale-ec2.yml b/.github/workflows/cleanup-stale-ec2.yml index f935b3e116..6a99134214 100644 --- a/.github/workflows/cleanup-stale-ec2.yml +++ b/.github/workflows/cleanup-stale-ec2.yml @@ -25,7 +25,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ matrix.region }} diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml index 999e311d0b..4f2499edcb 100644 --- a/.github/workflows/cli-release.yml +++ b/.github/workflows/cli-release.yml @@ -72,7 +72,7 @@ jobs: shopt -u dotglob - name: Upload artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: supabase-postgres-${{ matrix.arch }} path: supabase-postgres-${{ steps.version.outputs.version }}-${{ matrix.arch }} @@ -95,7 +95,7 @@ jobs: arch: linux-arm64 steps: - name: Download artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: supabase-postgres-${{ matrix.arch }} path: . @@ -398,7 +398,7 @@ jobs: contents: write steps: - name: Download all artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts @@ -453,7 +453,7 @@ jobs: fi - name: Create Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ steps.release_tag.outputs.tag }} files: release/* diff --git a/.github/workflows/cli-smoke-test.yml b/.github/workflows/cli-smoke-test.yml index 1e6eec0aa1..06765f4c80 100644 --- a/.github/workflows/cli-smoke-test.yml +++ b/.github/workflows/cli-smoke-test.yml @@ -23,7 +23,7 @@ jobs: base_hash: ${{ steps.check.outputs.base_hash }} steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: ./.github/actions/install-nix @@ -47,7 +47,7 @@ jobs: pg_version: ['15', '17'] steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: ./.github/actions/install-nix @@ -56,7 +56,7 @@ jobs: run: docker context create builders - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: endpoint: builders diff --git a/.github/workflows/docker-image-test.yml b/.github/workflows/docker-image-test.yml index 8d907e8859..f094a21d26 100644 --- a/.github/workflows/docker-image-test.yml +++ b/.github/workflows/docker-image-test.yml @@ -28,7 +28,7 @@ jobs: input_hash: ${{ steps.check.outputs.input_hash }} steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: ./.github/actions/install-nix @@ -57,7 +57,7 @@ jobs: - { dockerfile: Dockerfile-multigres, target: variant-orioledb-17, name: multigres-orioledb-17 } steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: ./.github/actions/install-nix @@ -66,7 +66,7 @@ jobs: run: docker context create builders - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: endpoint: builders diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml index aa8cea4ebb..06e68e2f94 100644 --- a/.github/workflows/dockerhub-release-matrix.yml +++ b/.github/workflows/dockerhub-release-matrix.yml @@ -102,10 +102,10 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - uses: ./.github/actions/install-nix - run: docker context create builders - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: endpoint: builders - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -142,7 +142,7 @@ jobs: echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT fi - id: build - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: push: true build-args: | @@ -163,8 +163,8 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - uses: ./.github/actions/install-nix - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -193,7 +193,7 @@ jobs: run: | echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results - name: Upload Results Artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: merge_results-${{ matrix.version }} path: results.txt @@ -232,7 +232,7 @@ jobs: $"versions=$versions_str" | save --append $env.GITHUB_ENV ' - name: Download Results Artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: merge_results-* - name: Combine Results diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml index cd3ac94984..5d89b0e154 100644 --- a/.github/workflows/manual-docker-release.yml +++ b/.github/workflows/manual-docker-release.yml @@ -99,10 +99,10 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - uses: ./.github/actions/install-nix - run: docker context create builders - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: endpoint: builders - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -149,7 +149,7 @@ jobs: echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT fi - id: build - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: push: true build-args: | @@ -170,8 +170,8 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - uses: ./.github/actions/install-nix - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -200,7 +200,7 @@ jobs: run: | echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results - name: Upload Results Artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: merge_results-${{ matrix.version }} path: results.txt @@ -239,7 +239,7 @@ jobs: $"versions=$versions_str" | save --append $env.GITHUB_ENV ' - name: Download Results Artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: merge_results-* - name: Combine Results diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml index 6d2d03532e..0d264e266f 100644 --- a/.github/workflows/mirror-postgrest.yml +++ b/.github/workflows/mirror-postgrest.yml @@ -20,7 +20,7 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - id: args - uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4.50.1 + uses: mikefarah/yq@504fc38780cc46be8444ea1b72fb55919fc0bfb0 # v4.54.1 with: cmd: yq '.postgrest_release' 'ansible/vars.yml' @@ -31,7 +31,7 @@ jobs: contents: read packages: write id-token: write - uses: supabase/cli/.github/workflows/mirror-image.yml@main + uses: supabase/cli/.github/workflows/mirror-image.yml@e9da2363fa52ccfb1cfb49611cabd8e49cb21577 # v3.0.0-next.16 with: image: postgrest/postgrest:v${{ needs.version.outputs.postgrest_release }} secrets: inherit diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index e7ca8b2371..5de2bd459b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -25,19 +25,19 @@ jobs: id-token: write steps: - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: us-east-1 - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: public.ecr.aws - - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: akhilerm/tag-push-action@85bf542f43f5f2060ef76262a67ee3607cb6db37 # v2.1.0 + - uses: akhilerm/tag-push-action@eadeefebd39db8a47e146115649adae1fce576a6 # v2.3.0 with: src: docker.io/supabase/postgres:${{ inputs.version }} dst: | diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 1d53150ad1..2d15f7b254 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -26,7 +26,7 @@ jobs: checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }} steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: ./.github/actions/install-nix @@ -48,7 +48,7 @@ jobs: - name: Upload drvPaths artifact if: github.event_name == 'pull_request' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: head-drvpaths path: /tmp/drvpaths/*.json @@ -74,7 +74,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -102,7 +102,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -128,7 +128,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -156,7 +156,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -182,7 +182,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -210,7 +210,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: ./.github/actions/install-nix @@ -298,12 +298,12 @@ jobs: runs-on: ${{ matrix.runs_on }} steps: - name: Checkout PR head - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: path: head - name: Checkout PR base - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} path: base @@ -313,7 +313,7 @@ jobs: # HEAD side already done in eval - name: Download head drvPaths - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: head-drvpaths path: /tmp/head-drvpaths @@ -330,7 +330,7 @@ jobs: run: ./head/ci/version-diff/diff.sh "${{ matrix.system }}" - name: Upload diff artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: diff-${{ matrix.system }} path: /tmp/diff.txt @@ -345,10 +345,10 @@ jobs: pull-requests: write steps: - name: Checkout Repo - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download diff artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: diff-* path: diffs @@ -358,7 +358,7 @@ jobs: run: ./ci/version-diff/comment.sh - name: Find existing version diff comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: fc with: issue-number: ${{ github.event.pull_request.number }} @@ -366,7 +366,7 @@ jobs: body-includes: "" - name: Comment on PR - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 with: comment-id: ${{ steps.fc.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml index 4630e71f49..212c4aa2c9 100644 --- a/.github/workflows/nix-dependency-analysis.yml +++ b/.github/workflows/nix-dependency-analysis.yml @@ -60,7 +60,7 @@ jobs: fi - name: Find existing dependency comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: fc-dep if: github.event_name == 'pull_request' with: @@ -69,7 +69,7 @@ jobs: body-includes: "" - name: Create or update dependency comment - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-dep.outputs.comment-id }} @@ -112,7 +112,7 @@ jobs: fi - name: Find existing extension comment - uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 id: fc-ext if: github.event_name == 'pull_request' with: @@ -121,7 +121,7 @@ jobs: body-includes: "" - name: Create or update extension comment - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-ext.outputs.comment-id }} diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml index aec370d7fd..b6fbf17d54 100644 --- a/.github/workflows/publish-migrations-prod.yml +++ b/.github/workflows/publish-migrations-prod.yml @@ -29,7 +29,7 @@ jobs: working-directory: ${{ github.workspace }}/migrations/db/migrations - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml index 8162bddac8..fca3564bd0 100644 --- a/.github/workflows/publish-migrations-staging.yml +++ b/.github/workflows/publish-migrations-staging.yml @@ -22,7 +22,7 @@ jobs: working-directory: ${{ github.workspace }}/migrations/db/migrations - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml index 1433ffdacd..2478d03511 100644 --- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml +++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml @@ -73,7 +73,7 @@ jobs: tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}" - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" @@ -88,7 +88,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -130,7 +130,7 @@ jobs: tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}" - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" @@ -145,7 +145,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml index ce08383a97..21c4ef0291 100644 --- a/.github/workflows/publish-nix-pgupgrade-scripts.yml +++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml @@ -77,7 +77,7 @@ jobs: tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" @@ -89,7 +89,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -132,7 +132,7 @@ jobs: tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" @@ -144,7 +144,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index b580dd8653..b00268208a 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -114,7 +114,7 @@ jobs: - name: configure aws credentials - staging if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }} - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.CONTROL_PLANE_DEV_ROLE }} aws-region: "us-east-1" @@ -122,7 +122,7 @@ jobs: - name: Login to Amazon ECR Staging if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }} id: login-ecr-private-dev - uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Build image env: @@ -143,7 +143,7 @@ jobs: # TODO (darora): temporarily also push to prod account from here - add a guard to only publish proper tagged releases to prod? - name: configure aws credentials - prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.CONTROL_PLANE_PROD_ROLE }} aws-region: "us-east-1" @@ -151,7 +151,7 @@ jobs: - name: Login to Amazon ECR Prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} id: login-ecr-private-prod - uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 - name: Push docker image to Amazon ECR Prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} @@ -165,7 +165,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml index 7caf30b165..735230df12 100644 --- a/.github/workflows/testinfra-ami-build.yml +++ b/.github/workflows/testinfra-ami-build.yml @@ -66,7 +66,7 @@ jobs: fi - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -114,7 +114,7 @@ jobs: >"ami-disk-usage-$POSTGRES_VERSION-$ARCH.json" - name: Upload AMI disk usage - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ami-disk-usage-${{ matrix.postgres_version }}-${{ matrix.target.arch }} path: ami-disk-usage-*.json @@ -133,7 +133,7 @@ jobs: - name: Configure AWS credentials for cleanup if: always() - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -149,7 +149,7 @@ jobs: runs-on: blacksmith-2vcpu-ubuntu-2404 steps: - name: Download AMI disk usage - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: ami-disk-usage-* path: ami-disk-usage diff --git a/.github/workflows/update-flake-lock-non-critical.yml b/.github/workflows/update-flake-lock-non-critical.yml index 7f8c79a190..b95bb6ca10 100644 --- a/.github/workflows/update-flake-lock-non-critical.yml +++ b/.github/workflows/update-flake-lock-non-critical.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix uses: ./.github/actions/install-nix @@ -31,7 +31,7 @@ jobs: treefmt-nix - name: Create Pull Request - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore: update flake.lock non-critical inputs (bimonthly)" diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index 645d2dc879..bb1ce7d574 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -15,13 +15,13 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ secrets.UPDATE_APP_ID }} private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ steps.app-token.outputs.token }} @@ -29,7 +29,7 @@ jobs: uses: ./.github/actions/install-nix - name: Update flake.lock and open PR - uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28 + uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 # v29 with: token: ${{ steps.app-token.outputs.token }} commit-msg: "chore: update flake.lock (monthly)" From 0458fd9f3b99167ed22f037d4eb30d39e5855fa8 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Fri, 16 Oct 2026 13:53:55 -0400 Subject: [PATCH 3/5] ci: Use `$/` self repository reference for uses According to docs[1] this is the preferred form. [1]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-using-an-action-in-the-same-repository-as-the-workflow-at-the-running-commit-recommended --- .github/workflows/ami-release-nix.yml | 8 ++--- .../workflows/check-extension-versions.yml | 2 +- .github/workflows/cli-release.yml | 6 ++-- .github/workflows/cli-smoke-test.yml | 6 ++-- .github/workflows/docker-image-test.yml | 6 ++-- .../workflows/dockerhub-release-matrix.yml | 12 +++---- .github/workflows/manual-docker-release.yml | 12 +++---- .github/workflows/nix-build.yml | 34 +++++++++---------- .github/workflows/nix-dependency-analysis.yml | 4 +-- ...ublish-nix-pgupgrade-bin-flake-version.yml | 4 +-- .../publish-nix-pgupgrade-scripts.yml | 6 ++-- .github/workflows/qemu-image-build.yml | 4 +-- .github/workflows/test.yml | 6 ++-- .github/workflows/testinfra-ami-build.yml | 8 ++--- .../update-flake-lock-non-critical.yml | 2 +- .github/workflows/update-flake-lock.yml | 2 +- 16 files changed, 61 insertions(+), 61 deletions(-) diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml index c167ad654f..6e662c20ec 100644 --- a/.github/workflows/ami-release-nix.yml +++ b/.github/workflows/ami-release-nix.yml @@ -31,7 +31,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -79,7 +79,7 @@ jobs: role-duration-seconds: 7200 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true aws-region: ${{ env.AWS_REGION }} @@ -88,13 +88,13 @@ jobs: - name: Resolve git sha id: resolve-git-sha - uses: ./.github/actions/resolve-git-sha + uses: $/.github/actions/resolve-git-sha with: flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }} - name: Build AMI id: build-ami - uses: ./.github/actions/build-ami + uses: $/.github/actions/build-ami with: ami_name_prefix: ${{ matrix.target.ami_name_prefix }} ami_regions: '["${{ env.AWS_REGION }}"]' diff --git a/.github/workflows/check-extension-versions.yml b/.github/workflows/check-extension-versions.yml index 5d2430ac3d..5c8b1af9b8 100644 --- a/.github/workflows/check-extension-versions.yml +++ b/.github/workflows/check-extension-versions.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Check for new extension versions env: diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml index 4f2499edcb..94460d207c 100644 --- a/.github/workflows/cli-release.yml +++ b/.github/workflows/cli-release.yml @@ -34,16 +34,16 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Run portability check - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#checks.${{ matrix.system }}.psql_17_cli_portable extra-args: --system ${{ matrix.system }} - name: Build portable CLI bundle - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#psql_17_cli_portable extra-args: --system ${{ matrix.system }} diff --git a/.github/workflows/cli-smoke-test.yml b/.github/workflows/cli-smoke-test.yml index 06765f4c80..903ea01bab 100644 --- a/.github/workflows/cli-smoke-test.yml +++ b/.github/workflows/cli-smoke-test.yml @@ -26,11 +26,11 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Check Docker image changes id: check - uses: ./.github/actions/check-docker-image-changes + uses: $/.github/actions/check-docker-image-changes with: event_name: ${{ github.event_name }} base_ref: ${{ github.base_ref }} @@ -50,7 +50,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Create Docker context run: docker context create builders diff --git a/.github/workflows/docker-image-test.yml b/.github/workflows/docker-image-test.yml index f094a21d26..bcc5c78bbd 100644 --- a/.github/workflows/docker-image-test.yml +++ b/.github/workflows/docker-image-test.yml @@ -31,11 +31,11 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Check Docker image changes id: check - uses: ./.github/actions/check-docker-image-changes + uses: $/.github/actions/check-docker-image-changes with: event_name: ${{ github.event_name }} base_ref: ${{ github.base_ref }} @@ -60,7 +60,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Create Docker context run: docker context create builders diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml index 06e68e2f94..b8415b7b05 100644 --- a/.github/workflows/dockerhub-release-matrix.yml +++ b/.github/workflows/dockerhub-release-matrix.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Generate build matrix id: set-matrix run: | @@ -75,7 +75,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -100,7 +100,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - run: docker context create builders - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: @@ -162,7 +162,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -209,7 +209,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Debug Input from Prepare run: | @@ -276,7 +276,7 @@ jobs: id-token: write strategy: matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }} - uses: ./.github/workflows/mirror.yml + uses: $/.github/workflows/mirror.yml with: version: ${{ matrix.version }} secrets: inherit diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml index 5d89b0e154..8d6d0703b3 100644 --- a/.github/workflows/manual-docker-release.yml +++ b/.github/workflows/manual-docker-release.yml @@ -17,7 +17,7 @@ jobs: outputs: matrix_config: ${{ steps.set-matrix.outputs.matrix_config }} steps: - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Generate build matrix @@ -72,7 +72,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -97,7 +97,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - run: docker context create builders - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: @@ -169,7 +169,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: @@ -216,7 +216,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Debug Input from Prepare run: | @@ -283,7 +283,7 @@ jobs: needs: combine_results strategy: matrix: ${{ fromJson(needs.combine_results.outputs.matrix) }} - uses: ./.github/workflows/mirror.yml + uses: $/.github/workflows/mirror.yml with: version: ${{ inputs.postgresVersion != '' && (contains(matrix.version, '-multigres') && format('{0}-multigres', inputs.postgresVersion) || inputs.postgresVersion) || matrix.version }} secrets: inherit diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 2d15f7b254..58dc57bb36 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -29,7 +29,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} @@ -77,14 +77,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -105,14 +105,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -131,14 +131,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -159,14 +159,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -185,14 +185,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -213,14 +213,14 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }} role-to-assume: ${{ secrets.DEV_AWS_ROLE }} - name: nix build if: ${{ matrix.attr != '' }} - uses: ./.github/actions/nix-build-retry + uses: $/.github/actions/nix-build-retry with: attr: .#${{ matrix.attr }} @@ -246,7 +246,7 @@ jobs: needs: - builds-aarch64-linux - builds-x86_64-linux - uses: ./.github/workflows/testinfra-ami-build.yml + uses: $/.github/workflows/testinfra-ami-build.yml secrets: DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} @@ -255,11 +255,11 @@ jobs: needs: - builds-aarch64-linux - builds-x86_64-linux - uses: ./.github/workflows/test.yml + uses: $/.github/workflows/test.yml containers: needs: builds-aarch64-linux - uses: ./.github/workflows/docker-image-test.yml + uses: $/.github/workflows/docker-image-test.yml secrets: DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }} NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }} @@ -309,7 +309,7 @@ jobs: path: base - name: Install nix - uses: ./head/.github/actions/install-nix + uses: $/.github/actions/install-nix # HEAD side already done in eval - name: Download head drvPaths diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml index 212c4aa2c9..e24ea2d540 100644 --- a/.github/workflows/nix-dependency-analysis.yml +++ b/.github/workflows/nix-dependency-analysis.yml @@ -33,7 +33,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: "false" env: @@ -85,7 +85,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: "false" env: diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml index 2478d03511..85673a7c2e 100644 --- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml +++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml @@ -19,7 +19,7 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -49,7 +49,7 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Grab release version id: process_release_version diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml index 21c4ef0291..a9ee6c98fd 100644 --- a/.github/workflows/publish-nix-pgupgrade-scripts.yml +++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions env: @@ -55,7 +55,7 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Grab release version id: process_release_version @@ -110,7 +110,7 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Grab release version id: process_release_version diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index b00268208a..a9bc31a1b3 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -67,7 +67,7 @@ jobs: echo "POSTGRES_MAJOR_VERSION=${{ matrix.postgres_version }}" >> $GITHUB_ENV - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Run checks if triggered manually if: ${{ github.event_name == 'workflow_dispatch' && matrix.arch == 'arm64' }} @@ -94,7 +94,7 @@ jobs: - name: Resolve git sha id: resolve-git-sha - uses: ./.github/actions/resolve-git-sha + uses: $/.github/actions/resolve-git-sha with: flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 095522ceb3..c1edc707aa 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions run: | @@ -35,11 +35,11 @@ jobs: - name: Checkout Repo uses: supabase/postgres/.github/actions/shared-checkout@HEAD - - uses: ./.github/actions/install-nix + - uses: $/.github/actions/install-nix - name: Resolve git sha id: resolve-git-sha - uses: ./.github/actions/resolve-git-sha + uses: $/.github/actions/resolve-git-sha with: flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }} diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml index 735230df12..2e40537147 100644 --- a/.github/workflows/testinfra-ami-build.yml +++ b/.github/workflows/testinfra-ami-build.yml @@ -28,7 +28,7 @@ jobs: uses: supabase/postgres/.github/actions/shared-checkout@HEAD - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -74,7 +74,7 @@ jobs: role-duration-seconds: 7200 - name: Install nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix with: push-to-cache: true aws-region: ${{ env.AWS_REGION }} @@ -83,13 +83,13 @@ jobs: - name: Resolve git sha id: resolve-git-sha - uses: ./.github/actions/resolve-git-sha + uses: $/.github/actions/resolve-git-sha with: flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }} - name: Build AMI id: build-ami - uses: ./.github/actions/build-ami + uses: $/.github/actions/build-ami with: ami_name_prefix: "supabase-postgres-${{ github.run_id }}-${{ matrix.target.arch }}" ami_regions: '["${{ env.AWS_REGION }}"]' diff --git a/.github/workflows/update-flake-lock-non-critical.yml b/.github/workflows/update-flake-lock-non-critical.yml index b95bb6ca10..14b92b7a66 100644 --- a/.github/workflows/update-flake-lock-non-critical.yml +++ b/.github/workflows/update-flake-lock-non-critical.yml @@ -16,7 +16,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Update non-critical flake inputs run: | diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index bb1ce7d574..52f1815c0b 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -26,7 +26,7 @@ jobs: token: ${{ steps.app-token.outputs.token }} - name: Install Nix - uses: ./.github/actions/install-nix + uses: $/.github/actions/install-nix - name: Update flake.lock and open PR uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 # v29 From 33e2d2528936b698b7c410188f731dcd52f9fd69 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Fri, 16 Oct 2026 15:41:25 -0400 Subject: [PATCH 4/5] ci: Remove the shared-checkout action Use the standard actions/checkout in every workflow, and delete our wrapper around it. We added the wrapper so CI could run on fork PRs after a maintainer approves them (#1643, #1644). We did not need it for that, because a standard checkout already works for fork PRs. The real problem was nix-build.yml, which passed a branch name as `ref` without `repository`. GitHub could not find a fork's branch in our repo. The wrapper also fetched full history and tags. No PR says why. Two jobs still need them: the `prepare` jobs in publish-nix-pgupgrade-scripts.yml and publish-nix-pgupgrade-bin-flake-version.yml check a release tag. They keep `fetch-depth: 0` and `fetch-tags: true`. All other checkouts are now shallow. We chose those two by searching the workflows for git commands. That search can miss a Nix build or script that reads git history. If a job breaks, add `fetch-depth: 0` to its checkout. PR runs now test the PR merged into the base branch, not the PR's own commit. This has not run on a fork PR yet. Assisted-by: Claude Sonnet 5.5 --- .github/actions/shared-checkout/action.yml | 12 ------------ .github/workflows/ami-release-nix.yml | 4 ++-- .github/workflows/cleanup-stale-ec2.yml | 2 +- .github/workflows/cli-release.yml | 2 +- .github/workflows/dockerhub-release-matrix.yml | 10 +++++----- .github/workflows/manual-docker-release.yml | 10 +++++----- .github/workflows/mirror-postgrest.yml | 2 +- .github/workflows/nix-dependency-analysis.yml | 4 ++-- .github/workflows/publish-migrations-prod.yml | 2 +- .github/workflows/publish-migrations-staging.yml | 2 +- .../publish-nix-pgupgrade-bin-flake-version.yml | 9 ++++++--- .github/workflows/publish-nix-pgupgrade-scripts.yml | 9 ++++++--- .github/workflows/qemu-image-build.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- .github/workflows/testinfra-ami-build.yml | 4 ++-- 15 files changed, 37 insertions(+), 43 deletions(-) delete mode 100644 .github/actions/shared-checkout/action.yml diff --git a/.github/actions/shared-checkout/action.yml b/.github/actions/shared-checkout/action.yml deleted file mode 100644 index 3bdea0fdee..0000000000 --- a/.github/actions/shared-checkout/action.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Checkout -description: Checkout repository for pull requests and branches -runs: - using: "composite" - steps: - - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} - ref: ${{ github.event.pull_request.head.sha || github.sha }} - fetch-depth: 0 - fetch-tags: true diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml index 6e662c20ec..6a000e55d6 100644 --- a/.github/workflows/ami-release-nix.yml +++ b/.github/workflows/ami-release-nix.yml @@ -28,7 +28,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -59,7 +59,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Debug AWS role secret run: | diff --git a/.github/workflows/cleanup-stale-ec2.yml b/.github/workflows/cleanup-stale-ec2.yml index 6a99134214..d155c9ff0d 100644 --- a/.github/workflows/cleanup-stale-ec2.yml +++ b/.github/workflows/cleanup-stale-ec2.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml index 94460d207c..c23f987876 100644 --- a/.github/workflows/cli-release.yml +++ b/.github/workflows/cli-release.yml @@ -31,7 +31,7 @@ jobs: arch: linux-arm64 steps: - name: Checkout repository - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml index b8415b7b05..208c1cb76f 100644 --- a/.github/workflows/dockerhub-release-matrix.yml +++ b/.github/workflows/dockerhub-release-matrix.yml @@ -21,7 +21,7 @@ jobs: matrix_config: ${{ steps.set-matrix.outputs.matrix_config }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Generate build matrix id: set-matrix @@ -74,7 +74,7 @@ jobs: build_args: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -99,7 +99,7 @@ jobs: timeout-minutes: 180 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - run: docker context create builders - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 @@ -161,7 +161,7 @@ jobs: runs-on: large-linux-x86 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 @@ -208,7 +208,7 @@ jobs: runs-on: large-linux-x86 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Debug Input from Prepare diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml index 8d6d0703b3..b63bbc389b 100644 --- a/.github/workflows/manual-docker-release.yml +++ b/.github/workflows/manual-docker-release.yml @@ -19,7 +19,7 @@ jobs: steps: - uses: $/.github/actions/install-nix - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Generate build matrix id: set-matrix run: | @@ -71,7 +71,7 @@ jobs: build_args: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -96,7 +96,7 @@ jobs: timeout-minutes: 180 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - run: docker context create builders - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 @@ -168,7 +168,7 @@ jobs: runs-on: blacksmith-8vcpu-ubuntu-2404 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 @@ -215,7 +215,7 @@ jobs: runs-on: blacksmith-8vcpu-ubuntu-2404 steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Debug Input from Prepare diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml index 0d264e266f..1dcc63c948 100644 --- a/.github/workflows/mirror-postgrest.yml +++ b/.github/workflows/mirror-postgrest.yml @@ -18,7 +18,7 @@ jobs: postgrest_release: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: args uses: mikefarah/yq@504fc38780cc46be8444ea1b72fb55919fc0bfb0 # v4.54.1 with: diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml index e24ea2d540..140d974ca7 100644 --- a/.github/workflows/nix-dependency-analysis.yml +++ b/.github/workflows/nix-dependency-analysis.yml @@ -30,7 +30,7 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404-arm steps: - name: Checkout repository - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -82,7 +82,7 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404 steps: - name: Checkout repository - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml index b6fbf17d54..96ba175601 100644 --- a/.github/workflows/publish-migrations-prod.yml +++ b/.github/workflows/publish-migrations-prod.yml @@ -22,7 +22,7 @@ jobs: GITHUB_REF: ${{ github.ref }} - name: Checkout repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Merging migration files run: cat $(ls -1) > ../migration-output.sql diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml index fca3564bd0..46f9b8bfd0 100644 --- a/.github/workflows/publish-migrations-staging.yml +++ b/.github/workflows/publish-migrations-staging.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Merging migration files run: cat $(ls -1) > ../migration-output.sql working-directory: ${{ github.workspace }}/migrations/db/migrations diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml index 85673a7c2e..f98d35c359 100644 --- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml +++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml @@ -17,7 +17,10 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + fetch-tags: true - uses: $/.github/actions/install-nix @@ -47,7 +50,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix @@ -106,7 +109,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Grab release version id: process_release_version diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml index a9ee6c98fd..6c8d8c85d3 100644 --- a/.github/workflows/publish-nix-pgupgrade-scripts.yml +++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml @@ -25,7 +25,10 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + fetch-tags: true - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -53,7 +56,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix @@ -108,7 +111,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index a9bc31a1b3..9b0e8dc17e 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -30,7 +30,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set PostgreSQL versions - only builds pg17 atm id: set-versions @@ -55,7 +55,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: enable KVM support run: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c1edc707aa..14b2e24ab3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,7 +14,7 @@ jobs: postgres_major_versions: ${{ steps.set-versions.outputs.postgres_major_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -33,7 +33,7 @@ jobs: POSTGRES_PASSWORD: password steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: $/.github/actions/install-nix diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml index 2e40537147..0a23104860 100644 --- a/.github/workflows/testinfra-ami-build.yml +++ b/.github/workflows/testinfra-ami-build.yml @@ -25,7 +25,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -54,7 +54,7 @@ jobs: steps: - name: Checkout Repo - uses: supabase/postgres/.github/actions/shared-checkout@HEAD + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Debug AWS role secret run: | From d5202ad5b95adbe99bcda7aa7a22118894761dfe Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Fri, 16 Oct 2026 14:23:47 -0400 Subject: [PATCH 5/5] ci: Use gh actions lockfile Switch from commit shas to proper lockfiles now that GHA has it in preview mode. This is better than commit ids because it also locks down transitive dependencies. Pinning to commits was best we could do but meant any actions we depended on that had its own dependencies at non-commit pins could use a different version w/o notice. --- .github/actionlint.yaml | 5 + .github/actions/install-nix/action.yml | 2 +- .github/workflows/actions.lock | 250 ++++++++++++++++++ .github/workflows/ami-release-nix.yml | 20 +- .../workflows/check-extension-versions.yml | 4 +- .github/workflows/cleanup-stale-ec2.yml | 12 +- .github/workflows/cli-release.yml | 10 +- .github/workflows/cli-smoke-test.yml | 6 +- .github/workflows/docker-image-test.yml | 6 +- .../workflows/dockerhub-release-matrix.yml | 24 +- .github/workflows/manual-docker-release.yml | 24 +- .github/workflows/mirror-postgrest.yml | 4 +- .github/workflows/mirror.yml | 8 +- .github/workflows/nix-build.yml | 32 +-- .github/workflows/nix-dependency-analysis.yml | 12 +- .github/workflows/publish-migrations-prod.yml | 4 +- .../workflows/publish-migrations-staging.yml | 4 +- ...ublish-nix-pgupgrade-bin-flake-version.yml | 14 +- .../publish-nix-pgupgrade-scripts.yml | 14 +- .github/workflows/qemu-image-build.yml | 14 +- .github/workflows/test.yml | 4 +- .github/workflows/testinfra-ami-build.yml | 12 +- .../update-flake-lock-non-critical.yml | 4 +- .github/workflows/update-flake-lock.yml | 6 +- 24 files changed, 375 insertions(+), 120 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index ff15338ead..2de12a9cee 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,3 +1,8 @@ +paths: # https://github.com/rhysd/actionlint/issues/711 + .github/*/*.yml: + ignore: + - 'reusable workflow call "\$/\.github/workflows/[a-z0-9-]+\.yml" at "uses" is not following the format' + - 'specifying action "\$/\.github/actions/[a-z0-9-]+" in invalid format' self-hosted-runner: labels: - aarch64-darwin diff --git a/.github/actions/install-nix/action.yml b/.github/actions/install-nix/action.yml index 8fffe1bcc7..1038302f2c 100644 --- a/.github/actions/install-nix/action.yml +++ b/.github/actions/install-nix/action.yml @@ -35,7 +35,7 @@ runs: ROLE_TO_ASSUME: ${{ inputs.role-to-assume }} - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 if: steps.resolve-push-to-cache.outputs.value == 'true' with: role-to-assume: ${{ inputs.role-to-assume }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000000..b3864ae79e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,250 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/ami-release-nix.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'rtcamp/action-slack-notify@v2.4.0' + - 'softprops/action-gh-release@v3.0.3' + '.github/workflows/check-extension-versions.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'peter-evans/create-pull-request@v8.1.1' + '.github/workflows/cleanup-stale-ec2.yml': + - 'actions/checkout@v6.0.1' + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v4.3.0' + - 'actions/upload-artifact@v4.6.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'slackapi/slack-github-action@v4.0.0' + '.github/workflows/cli-release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'softprops/action-gh-release@v3.0.3' + '.github/workflows/cli-smoke-test.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'docker/setup-buildx-action@v4.4.1' + '.github/workflows/docker-image-test.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'docker/setup-buildx-action@v4.4.1' + '.github/workflows/dockerhub-release-matrix.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'docker/build-push-action@v7.4.0' + - 'docker/login-action@v4.6.0' + - 'docker/setup-buildx-action@v4.4.1' + '.github/workflows/manual-docker-release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'docker/build-push-action@v7.4.0' + - 'docker/login-action@v4.6.0' + - 'docker/setup-buildx-action@v4.4.1' + '.github/workflows/mirror-postgrest.yml': + - 'actions/checkout@v7.0.1' + - 'mikefarah/yq@v4.54.1' + '.github/workflows/mirror.yml': + - 'akhilerm/tag-push-action@v2.3.0' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'docker/login-action@v4.6.0' + '.github/workflows/nix-build.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'peter-evans/create-or-update-comment@v5.0.0' + - 'peter-evans/find-comment@v4.0.0' + '.github/workflows/nix-dependency-analysis.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'peter-evans/create-or-update-comment@v5.0.0' + - 'peter-evans/find-comment@v4.0.0' + '.github/workflows/publish-migrations-prod.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + '.github/workflows/publish-migrations-staging.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + '.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'rtcamp/action-slack-notify@v2.4.0' + '.github/workflows/publish-nix-pgupgrade-scripts.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'rtcamp/action-slack-notify@v2.4.0' + '.github/workflows/qemu-image-build.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/amazon-ecr-login@v2.1.7' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'rtcamp/action-slack-notify@v2.4.0' + '.github/workflows/test.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + '.github/workflows/testinfra-ami-build.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/upload-artifact@v7.0.2' + - 'aws-actions/configure-aws-credentials@v6.3.0' + '.github/workflows/update-flake-lock-non-critical.yml': + - 'actions/checkout@v7.0.1' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'peter-evans/create-pull-request@v8.1.1' + '.github/workflows/update-flake-lock.yml': + - 'actions/checkout@v7.0.1' + - 'actions/create-github-app-token@v3.3.0' + - 'aws-actions/configure-aws-credentials@v6.3.0' + - 'determinatesystems/update-flake-lock@v29' +dependencies: + 'actions/checkout@v6.0.1': + ref: 'v6.0.1' + commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/create-github-app-token@v3.3.0': + ref: 'v3.3.0' + commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510' + owner_id: 44036562 + repo_id: 642580244 + 'actions/download-artifact@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093' + owner_id: 44036562 + repo_id: 192626254 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'akhilerm/tag-push-action@v2.3.0': + ref: 'v2.3.0' + commit: 'sha1-eadeefebd39db8a47e146115649adae1fce576a6' + owner_id: 7610845 + repo_id: 314832723 + 'aws-actions/amazon-ecr-login@v2.1.7': + ref: 'v2.1.7' + commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd' + owner_id: 57468012 + repo_id: 220389860 + 'aws-actions/configure-aws-credentials@v6.3.0': + ref: 'v6.3.0' + commit: 'sha1-e1253824e5c10ff9df46874f81ed3ec929e19cfd' + owner_id: 57468012 + repo_id: 220391287 + 'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd': + ref: 'v7.0.0' + commit: 'sha1-2dc316deee8e90f13e1a351ab510b4d5bc0c82cd' + owner_id: 1951866 + repo_id: 260488959 + 'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42': + ref: 'v1.3' + commit: 'sha1-6929a9a6d1807689191dcc8bbe62b54d70a32b42' + owner_id: 957246 + repo_id: 258052107 + 'determinatesystems/update-flake-lock@v29': + ref: 'v29' + commit: 'sha1-da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3' + owner_id: 80991770 + repo_id: 418625766 + uses: + - 'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd' + - 'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42' + - 'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18' + - 'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4' + - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1' + 'docker/build-push-action@v7.4.0': + ref: 'v7.4.0' + commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v4.6.0': + ref: 'v4.6.0' + commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f' + owner_id: 5429470 + repo_id: 287743349 + 'docker/setup-buildx-action@v4.4.1': + ref: 'v4.4.1' + commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069' + owner_id: 5429470 + repo_id: 288485773 + 'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18': + ref: 'v1.1.8' + commit: 'sha1-271ff311a4947af354c6abcd696a306553b9ec18' + owner_id: 10247 + repo_id: 244608449 + 'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e': + ref: 'v1.1.1' + commit: 'sha1-698a1d4d0ff1794152a93c03ee8ca5e03a310d4e' + owner_id: 168084 + repo_id: 271813698 + 'mikefarah/yq@v4.54.1': + ref: 'v4.54.1' + commit: 'sha1-504fc38780cc46be8444ea1b72fb55919fc0bfb0' + owner_id: 1151925 + repo_id: 43225113 + 'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4': + ref: 'v2.4.0' + commit: 'sha1-2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4' + owner_id: 85504 + repo_id: 304154389 + 'peter-evans/create-or-update-comment@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-e8674b075228eee787fea43ef493e45ece1004c9' + owner_id: 18365890 + repo_id: 223708643 + 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1': + ref: 'v8.1.1' + commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' + owner_id: 18365890 + repo_id: 197176365 + 'peter-evans/create-pull-request@v8.1.1': + ref: 'v8.1.1' + commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1' + owner_id: 18365890 + repo_id: 197176365 + 'peter-evans/find-comment@v4.0.0': + ref: 'v4.0.0' + commit: 'sha1-b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad' + owner_id: 18365890 + repo_id: 256447541 + 'rtcamp/action-slack-notify@v2.4.0': + ref: 'v2.4.0' + commit: 'sha1-33ca3be66c6f378fe1610fd1d5258632dbed5e58' + owner_id: 1128395 + repo_id: 173934970 + uses: + - 'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e' + 'slackapi/slack-github-action@v4.0.0': + ref: 'v4.0.0' + commit: 'sha1-dcb1066f776dd043e64d0e8ba94ca15cc7e1875d' + owner_id: 6962987 + repo_id: 306439799 + 'softprops/action-gh-release@v3.0.3': + ref: 'v3.0.3' + commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64' + owner_id: 2242 + repo_id: 204253808 diff --git a/.github/workflows/ami-release-nix.yml b/.github/workflows/ami-release-nix.yml index 6a000e55d6..42932395f6 100644 --- a/.github/workflows/ami-release-nix.yml +++ b/.github/workflows/ami-release-nix.yml @@ -28,7 +28,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -59,7 +59,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Debug AWS role secret run: | @@ -71,7 +71,7 @@ jobs: fi - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -136,7 +136,7 @@ jobs: tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" . - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -148,7 +148,7 @@ jobs: aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz" - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -160,14 +160,14 @@ jobs: aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz" - name: GitHub OIDC Auth - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: aws-region: us-east-1 role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role role-session-name: shared-services-jump - name: Assume destination role - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: aws-region: us-east-1 role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512 @@ -204,7 +204,7 @@ jobs: echo "Catalog uploaded to ${CATALOG_S3}" - name: Create release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + uses: softprops/action-gh-release@v3.0.3 with: name: ${{ env.RELEASE_TAG }} tag_name: ${{ env.RELEASE_TAG }} @@ -245,7 +245,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -255,7 +255,7 @@ jobs: - name: Configure AWS credentials for cleanup if: always() - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} diff --git a/.github/workflows/check-extension-versions.yml b/.github/workflows/check-extension-versions.yml index 5c8b1af9b8..a58f09e9fe 100644 --- a/.github/workflows/check-extension-versions.yml +++ b/.github/workflows/check-extension-versions.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -24,7 +24,7 @@ jobs: run: nix run .#check-ext-versions - name: Create Pull Request - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + uses: peter-evans/create-pull-request@v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore: update extension versions" diff --git a/.github/workflows/cleanup-stale-ec2.yml b/.github/workflows/cleanup-stale-ec2.yml index d155c9ff0d..c0bcbe5e2e 100644 --- a/.github/workflows/cleanup-stale-ec2.yml +++ b/.github/workflows/cleanup-stale-ec2.yml @@ -22,10 +22,10 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ matrix.region }} @@ -44,7 +44,7 @@ jobs: - name: Upload summary if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@v4.6.2 with: name: cleanup-summary-${{ matrix.region }} path: ${{ runner.temp }}/summary.txt @@ -61,13 +61,13 @@ jobs: steps: - name: Checkout scripts - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@v6.0.1 with: sparse-checkout: ci persist-credentials: false - name: Download summaries - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@v4.3.0 with: pattern: cleanup-summary-* path: summaries @@ -96,7 +96,7 @@ jobs: ci/build-slack-payload.sh summaries/*/summary.txt | tee "$RUNNER_TEMP/payload.json" - name: Slack Notification - uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 + uses: slackapi/slack-github-action@v4.0.0 with: webhook: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} webhook-type: incoming-webhook diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml index c23f987876..3c1db3a0e1 100644 --- a/.github/workflows/cli-release.yml +++ b/.github/workflows/cli-release.yml @@ -31,7 +31,7 @@ jobs: arch: linux-arm64 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -72,7 +72,7 @@ jobs: shopt -u dotglob - name: Upload artifacts - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: supabase-postgres-${{ matrix.arch }} path: supabase-postgres-${{ steps.version.outputs.version }}-${{ matrix.arch }} @@ -95,7 +95,7 @@ jobs: arch: linux-arm64 steps: - name: Download artifact - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: name: supabase-postgres-${{ matrix.arch }} path: . @@ -398,7 +398,7 @@ jobs: contents: write steps: - name: Download all artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: path: artifacts @@ -453,7 +453,7 @@ jobs: fi - name: Create Release - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + uses: softprops/action-gh-release@v3.0.3 with: tag_name: ${{ steps.release_tag.outputs.tag }} files: release/* diff --git a/.github/workflows/cli-smoke-test.yml b/.github/workflows/cli-smoke-test.yml index 903ea01bab..59d0c46f14 100644 --- a/.github/workflows/cli-smoke-test.yml +++ b/.github/workflows/cli-smoke-test.yml @@ -23,7 +23,7 @@ jobs: base_hash: ${{ steps.check.outputs.base_hash }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -47,7 +47,7 @@ jobs: pg_version: ['15', '17'] steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -56,7 +56,7 @@ jobs: run: docker context create builders - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + uses: docker/setup-buildx-action@v4.4.1 with: endpoint: builders diff --git a/.github/workflows/docker-image-test.yml b/.github/workflows/docker-image-test.yml index bcc5c78bbd..29b79719b7 100644 --- a/.github/workflows/docker-image-test.yml +++ b/.github/workflows/docker-image-test.yml @@ -28,7 +28,7 @@ jobs: input_hash: ${{ steps.check.outputs.input_hash }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -57,7 +57,7 @@ jobs: - { dockerfile: Dockerfile-multigres, target: variant-orioledb-17, name: multigres-orioledb-17 } steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -66,7 +66,7 @@ jobs: run: docker context create builders - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + uses: docker/setup-buildx-action@v4.4.1 with: endpoint: builders diff --git a/.github/workflows/dockerhub-release-matrix.yml b/.github/workflows/dockerhub-release-matrix.yml index 208c1cb76f..bf95dbe9fe 100644 --- a/.github/workflows/dockerhub-release-matrix.yml +++ b/.github/workflows/dockerhub-release-matrix.yml @@ -21,7 +21,7 @@ jobs: matrix_config: ${{ steps.set-matrix.outputs.matrix_config }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Generate build matrix id: set-matrix @@ -74,7 +74,7 @@ jobs: build_args: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -99,13 +99,13 @@ jobs: timeout-minutes: 180 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - run: docker context create builders - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/setup-buildx-action@v4.4.1 with: endpoint: builders - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -142,7 +142,7 @@ jobs: echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT fi - id: build - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + uses: docker/build-push-action@v7.4.0 with: push: true build-args: | @@ -161,10 +161,10 @@ jobs: runs-on: large-linux-x86 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/setup-buildx-action@v4.4.1 + - uses: docker/login-action@v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -193,7 +193,7 @@ jobs: run: | echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results - name: Upload Results Artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: merge_results-${{ matrix.version }} path: results.txt @@ -208,7 +208,7 @@ jobs: runs-on: large-linux-x86 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Debug Input from Prepare @@ -232,7 +232,7 @@ jobs: $"versions=$versions_str" | save --append $env.GITHUB_ENV ' - name: Download Results Artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: merge_results-* - name: Combine Results diff --git a/.github/workflows/manual-docker-release.yml b/.github/workflows/manual-docker-release.yml index b63bbc389b..1967dc0c0c 100644 --- a/.github/workflows/manual-docker-release.yml +++ b/.github/workflows/manual-docker-release.yml @@ -19,7 +19,7 @@ jobs: steps: - uses: $/.github/actions/install-nix - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Generate build matrix id: set-matrix run: | @@ -71,7 +71,7 @@ jobs: build_args: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL version environment variable run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV @@ -96,13 +96,13 @@ jobs: timeout-minutes: 180 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - run: docker context create builders - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/setup-buildx-action@v4.4.1 with: endpoint: builders - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -149,7 +149,7 @@ jobs: echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT fi - id: build - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + uses: docker/build-push-action@v7.4.0 with: push: true build-args: | @@ -168,10 +168,10 @@ jobs: runs-on: blacksmith-8vcpu-ubuntu-2404 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/setup-buildx-action@v4.4.1 + - uses: docker/login-action@v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -200,7 +200,7 @@ jobs: run: | echo "${{ steps.output_version.outputs.result }}" >> results.txt # Append results - name: Upload Results Artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: merge_results-${{ matrix.version }} path: results.txt @@ -215,7 +215,7 @@ jobs: runs-on: blacksmith-8vcpu-ubuntu-2404 steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Debug Input from Prepare @@ -239,7 +239,7 @@ jobs: $"versions=$versions_str" | save --append $env.GITHUB_ENV ' - name: Download Results Artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: merge_results-* - name: Combine Results diff --git a/.github/workflows/mirror-postgrest.yml b/.github/workflows/mirror-postgrest.yml index 1dcc63c948..215e409007 100644 --- a/.github/workflows/mirror-postgrest.yml +++ b/.github/workflows/mirror-postgrest.yml @@ -18,9 +18,9 @@ jobs: postgrest_release: ${{ steps.args.outputs.result }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - id: args - uses: mikefarah/yq@504fc38780cc46be8444ea1b72fb55919fc0bfb0 # v4.54.1 + uses: mikefarah/yq@v4.54.1 with: cmd: yq '.postgrest_release' 'ansible/vars.yml' diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 5de2bd459b..028f18c4bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -25,19 +25,19 @@ jobs: id-token: write steps: - name: configure aws credentials - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: us-east-1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@v4.6.0 with: registry: public.ecr.aws - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: akhilerm/tag-push-action@eadeefebd39db8a47e146115649adae1fce576a6 # v2.3.0 + - uses: akhilerm/tag-push-action@v2.3.0 with: src: docker.io/supabase/postgres:${{ inputs.version }} dst: | diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index 58dc57bb36..c71b9605a3 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -26,7 +26,7 @@ jobs: checks_matrix: ${{ steps.gen-matrix.outputs.checks_matrix }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -48,7 +48,7 @@ jobs: - name: Upload drvPaths artifact if: github.event_name == 'pull_request' - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: head-drvpaths path: /tmp/drvpaths/*.json @@ -74,7 +74,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -102,7 +102,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -128,7 +128,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -156,7 +156,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -182,7 +182,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -210,7 +210,7 @@ jobs: steps: - name: Checkout Repo if: ${{ matrix.attr != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix if: ${{ matrix.attr != '' }} uses: $/.github/actions/install-nix @@ -298,12 +298,12 @@ jobs: runs-on: ${{ matrix.runs_on }} steps: - name: Checkout PR head - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: path: head - name: Checkout PR base - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} path: base @@ -313,7 +313,7 @@ jobs: # HEAD side already done in eval - name: Download head drvPaths - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: name: head-drvpaths path: /tmp/head-drvpaths @@ -330,7 +330,7 @@ jobs: run: ./head/ci/version-diff/diff.sh "${{ matrix.system }}" - name: Upload diff artifact - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: diff-${{ matrix.system }} path: /tmp/diff.txt @@ -345,10 +345,10 @@ jobs: pull-requests: write steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Download diff artifacts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: diff-* path: diffs @@ -358,7 +358,7 @@ jobs: run: ./ci/version-diff/comment.sh - name: Find existing version diff comment - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 + uses: peter-evans/find-comment@v4.0.0 id: fc with: issue-number: ${{ github.event.pull_request.number }} @@ -366,7 +366,7 @@ jobs: body-includes: "" - name: Comment on PR - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 + uses: peter-evans/create-or-update-comment@v5.0.0 with: comment-id: ${{ steps.fc.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/nix-dependency-analysis.yml b/.github/workflows/nix-dependency-analysis.yml index 140d974ca7..d6682a0393 100644 --- a/.github/workflows/nix-dependency-analysis.yml +++ b/.github/workflows/nix-dependency-analysis.yml @@ -30,7 +30,7 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404-arm steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -60,7 +60,7 @@ jobs: fi - name: Find existing dependency comment - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 + uses: peter-evans/find-comment@v4.0.0 id: fc-dep if: github.event_name == 'pull_request' with: @@ -69,7 +69,7 @@ jobs: body-includes: "" - name: Create or update dependency comment - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 + uses: peter-evans/create-or-update-comment@v5.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-dep.outputs.comment-id }} @@ -82,7 +82,7 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404 steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -112,7 +112,7 @@ jobs: fi - name: Find existing extension comment - uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 + uses: peter-evans/find-comment@v4.0.0 id: fc-ext if: github.event_name == 'pull_request' with: @@ -121,7 +121,7 @@ jobs: body-includes: "" - name: Create or update extension comment - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 + uses: peter-evans/create-or-update-comment@v5.0.0 if: github.event_name == 'pull_request' with: comment-id: ${{ steps.fc-ext.outputs.comment-id }} diff --git a/.github/workflows/publish-migrations-prod.yml b/.github/workflows/publish-migrations-prod.yml index 96ba175601..7801b9e120 100644 --- a/.github/workflows/publish-migrations-prod.yml +++ b/.github/workflows/publish-migrations-prod.yml @@ -22,14 +22,14 @@ jobs: GITHUB_REF: ${{ github.ref }} - name: Checkout repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Merging migration files run: cat $(ls -1) > ../migration-output.sql working-directory: ${{ github.workspace }}/migrations/db/migrations - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" diff --git a/.github/workflows/publish-migrations-staging.yml b/.github/workflows/publish-migrations-staging.yml index 46f9b8bfd0..c5d0389701 100644 --- a/.github/workflows/publish-migrations-staging.yml +++ b/.github/workflows/publish-migrations-staging.yml @@ -16,13 +16,13 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Merging migration files run: cat $(ls -1) > ../migration-output.sql working-directory: ${{ github.workspace }}/migrations/db/migrations - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" diff --git a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml index f98d35c359..40a894fc21 100644 --- a/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml +++ b/.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml @@ -17,7 +17,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 fetch-tags: true @@ -50,7 +50,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix @@ -76,7 +76,7 @@ jobs: tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}" - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" @@ -91,7 +91,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -109,7 +109,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Grab release version id: process_release_version @@ -133,7 +133,7 @@ jobs: tar -czvf pg_upgrade_bin.tar.gz "${{ steps.process_release_version.outputs.major_version }}" - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" @@ -148,7 +148,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/publish-nix-pgupgrade-scripts.yml b/.github/workflows/publish-nix-pgupgrade-scripts.yml index 6c8d8c85d3..8754f07ae7 100644 --- a/.github/workflows/publish-nix-pgupgrade-scripts.yml +++ b/.github/workflows/publish-nix-pgupgrade-scripts.yml @@ -25,7 +25,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 fetch-tags: true @@ -56,7 +56,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix @@ -80,7 +80,7 @@ jobs: tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts - name: configure aws credentials - staging - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: "us-east-1" @@ -92,7 +92,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' @@ -111,7 +111,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix @@ -135,7 +135,7 @@ jobs: tar -czvf /tmp/pg_upgrade_scripts.tar.gz -C /tmp/ pg_upgrade_scripts - name: configure aws credentials - prod - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.PROD_AWS_ROLE }} aws-region: "us-east-1" @@ -147,7 +147,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml index 9b0e8dc17e..d59e81140b 100644 --- a/.github/workflows/qemu-image-build.yml +++ b/.github/workflows/qemu-image-build.yml @@ -30,7 +30,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Set PostgreSQL versions - only builds pg17 atm id: set-versions @@ -55,7 +55,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: enable KVM support run: | @@ -114,7 +114,7 @@ jobs: - name: configure aws credentials - staging if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }} - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.CONTROL_PLANE_DEV_ROLE }} aws-region: "us-east-1" @@ -122,7 +122,7 @@ jobs: - name: Login to Amazon ECR Staging if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/') }} id: login-ecr-private-dev - uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 + uses: aws-actions/amazon-ecr-login@v2.1.7 - name: Build image env: @@ -143,7 +143,7 @@ jobs: # TODO (darora): temporarily also push to prod account from here - add a guard to only publish proper tagged releases to prod? - name: configure aws credentials - prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.CONTROL_PLANE_PROD_ROLE }} aws-region: "us-east-1" @@ -151,7 +151,7 @@ jobs: - name: Login to Amazon ECR Prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} id: login-ecr-private-prod - uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7 + uses: aws-actions/amazon-ecr-login@v2.1.7 - name: Push docker image to Amazon ECR Prod if: ${{ matrix.arch == 'arm64' && (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/')) }} @@ -165,7 +165,7 @@ jobs: - name: Slack Notification on Failure if: ${{ failure() }} - uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 + uses: rtCamp/action-slack-notify@v2.4.0 env: SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }} SLACK_USERNAME: 'gha-failures-notifier' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 14b2e24ab3..87ea2f4d36 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,7 +14,7 @@ jobs: postgres_major_versions: ${{ steps.set-versions.outputs.postgres_major_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix - name: Set PostgreSQL versions id: set-versions @@ -33,7 +33,7 @@ jobs: POSTGRES_PASSWORD: password steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - uses: $/.github/actions/install-nix diff --git a/.github/workflows/testinfra-ami-build.yml b/.github/workflows/testinfra-ami-build.yml index 0a23104860..3a117756de 100644 --- a/.github/workflows/testinfra-ami-build.yml +++ b/.github/workflows/testinfra-ami-build.yml @@ -25,7 +25,7 @@ jobs: postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }} steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install nix uses: $/.github/actions/install-nix @@ -54,7 +54,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Debug AWS role secret run: | @@ -66,7 +66,7 @@ jobs: fi - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -114,7 +114,7 @@ jobs: >"ami-disk-usage-$POSTGRES_VERSION-$ARCH.json" - name: Upload AMI disk usage - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: ami-disk-usage-${{ matrix.postgres_version }}-${{ matrix.target.arch }} path: ami-disk-usage-*.json @@ -133,7 +133,7 @@ jobs: - name: Configure AWS credentials for cleanup if: always() - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 + uses: aws-actions/configure-aws-credentials@v6.3.0 with: role-to-assume: ${{ secrets.DEV_AWS_ROLE }} aws-region: ${{ env.AWS_REGION }} @@ -149,7 +149,7 @@ jobs: runs-on: blacksmith-2vcpu-ubuntu-2404 steps: - name: Download AMI disk usage - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: pattern: ami-disk-usage-* path: ami-disk-usage diff --git a/.github/workflows/update-flake-lock-non-critical.yml b/.github/workflows/update-flake-lock-non-critical.yml index 14b92b7a66..bc0829e8f7 100644 --- a/.github/workflows/update-flake-lock-non-critical.yml +++ b/.github/workflows/update-flake-lock-non-critical.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Nix uses: $/.github/actions/install-nix @@ -31,7 +31,7 @@ jobs: treefmt-nix - name: Create Pull Request - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + uses: peter-evans/create-pull-request@v8.1.1 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore: update flake.lock non-critical inputs (bimonthly)" diff --git a/.github/workflows/update-flake-lock.yml b/.github/workflows/update-flake-lock.yml index 52f1815c0b..e169116e4a 100644 --- a/.github/workflows/update-flake-lock.yml +++ b/.github/workflows/update-flake-lock.yml @@ -15,13 +15,13 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + uses: actions/create-github-app-token@v3.3.0 with: client-id: ${{ secrets.UPDATE_APP_ID }} private-key: ${{ secrets.UPDATE_APP_PRIVATE_KEY }} - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: token: ${{ steps.app-token.outputs.token }} @@ -29,7 +29,7 @@ jobs: uses: $/.github/actions/install-nix - name: Update flake.lock and open PR - uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3 # v29 + uses: DeterminateSystems/update-flake-lock@v29 with: token: ${{ steps.app-token.outputs.token }} commit-msg: "chore: update flake.lock (monthly)"