From 14c355054b9b7e74a968938bb2d4f1d964e6a256 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 13:14:30 -0400 Subject: [PATCH 1/3] ci: pin GitHub Actions to commit SHAs Part of Platform Engineering supply chain security hardening. Dependabot will keep these SHAs current automatically. --- .github/dependabot.yml | 7 +++++++ .github/workflows/build-gnutls.yml | 4 ++-- .github/workflows/build-mbedtls.yml | 6 +++--- .github/workflows/build-nice.yml | 2 +- .github/workflows/build-nomedia.yml | 6 +++--- .github/workflows/build-nowebsocket.yml | 2 +- .github/workflows/build-openssl.yml | 8 ++++---- .github/workflows/check-version.yml | 2 +- 8 files changed, 22 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fcd9800ba..16d9cea23 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,10 @@ updates: directory: "examples/signaling-server-nodejs" schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directories: + - ".github/workflows" + schedule: + interval: "weekly" + cooldown: + default-days: 15 diff --git a/.github/workflows/build-gnutls.yml b/.github/workflows/build-gnutls.yml index 7974d67db..0d2ae6cf5 100644 --- a/.github/workflows/build-gnutls.yml +++ b/.github/workflows/build-gnutls.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev nettle-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: brew install gnutls nettle - name: submodules diff --git a/.github/workflows/build-mbedtls.yml b/.github/workflows/build-mbedtls.yml index ca203d394..7a845181b 100644 --- a/.github/workflows/build-mbedtls.yml +++ b/.github/workflows/build-mbedtls.yml @@ -8,9 +8,9 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: Set up Homebrew - uses: Homebrew/actions/setup-homebrew@master + uses: Homebrew/actions/setup-homebrew@98cfa07b984a61682e6cd3a0833fad2006cc84ba - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules @@ -24,7 +24,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules diff --git a/.github/workflows/build-nice.yml b/.github/workflows/build-nice.yml index bf5ec16ee..30db8d12b 100644 --- a/.github/workflows/build-nice.yml +++ b/.github/workflows/build-nice.yml @@ -8,7 +8,7 @@ jobs: build-nice: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev libnice-dev - name: submodules diff --git a/.github/workflows/build-nomedia.yml b/.github/workflows/build-nomedia.yml index 1fd75a6b4..e0a84375f 100644 --- a/.github/workflows/build-nomedia.yml +++ b/.github/workflows/build-nomedia.yml @@ -8,7 +8,7 @@ jobs: build-nomedia: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libssl-dev - name: submodules @@ -22,8 +22,8 @@ jobs: build-nomedia-windows: runs-on: windows-latest steps: - - uses: actions/checkout@v2 - - uses: ilammy/msvc-dev-cmd@v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/build-nowebsocket.yml b/.github/workflows/build-nowebsocket.yml index 8de1f9d5e..9e8824986 100644 --- a/.github/workflows/build-nowebsocket.yml +++ b/.github/workflows/build-nowebsocket.yml @@ -10,7 +10,7 @@ jobs: build-nowebsocket: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules diff --git a/.github/workflows/build-openssl.yml b/.github/workflows/build-openssl.yml index f1a925bea..1128d5880 100644 --- a/.github/workflows/build-openssl.yml +++ b/.github/workflows/build-openssl.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: HOMEBREW_NO_INSTALL_CLEANUP=1 brew reinstall openssl@1.1 - name: submodules @@ -38,8 +38,8 @@ jobs: build-windows: runs-on: windows-latest steps: - - uses: actions/checkout@v2 - - uses: ilammy/msvc-dev-cmd@v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index 7e095eea7..a1a837245 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -8,7 +8,7 @@ jobs: check-version: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules From 70959272c204534cacb01c74500e2e76d304dee6 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 13:55:13 -0400 Subject: [PATCH 2/3] ci: add version comments to SHA-pinned actions --- .github/workflows/build-gnutls.yml | 4 ++-- .github/workflows/build-mbedtls.yml | 6 +++--- .github/workflows/build-nice.yml | 2 +- .github/workflows/build-nomedia.yml | 6 +++--- .github/workflows/build-nowebsocket.yml | 2 +- .github/workflows/build-openssl.yml | 8 ++++---- .github/workflows/check-version.yml | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-gnutls.yml b/.github/workflows/build-gnutls.yml index 0d2ae6cf5..6a7cd8d85 100644 --- a/.github/workflows/build-gnutls.yml +++ b/.github/workflows/build-gnutls.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev nettle-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: brew install gnutls nettle - name: submodules diff --git a/.github/workflows/build-mbedtls.yml b/.github/workflows/build-mbedtls.yml index 7a845181b..a058b99a2 100644 --- a/.github/workflows/build-mbedtls.yml +++ b/.github/workflows/build-mbedtls.yml @@ -8,9 +8,9 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Set up Homebrew - uses: Homebrew/actions/setup-homebrew@98cfa07b984a61682e6cd3a0833fad2006cc84ba + uses: Homebrew/actions/setup-homebrew@98cfa07b984a61682e6cd3a0833fad2006cc84ba # master - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules @@ -24,7 +24,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules diff --git a/.github/workflows/build-nice.yml b/.github/workflows/build-nice.yml index 30db8d12b..cc43ae98b 100644 --- a/.github/workflows/build-nice.yml +++ b/.github/workflows/build-nice.yml @@ -8,7 +8,7 @@ jobs: build-nice: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev libnice-dev - name: submodules diff --git a/.github/workflows/build-nomedia.yml b/.github/workflows/build-nomedia.yml index e0a84375f..753daedad 100644 --- a/.github/workflows/build-nomedia.yml +++ b/.github/workflows/build-nomedia.yml @@ -8,7 +8,7 @@ jobs: build-nomedia: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev - name: submodules @@ -22,8 +22,8 @@ jobs: build-nomedia-windows: runs-on: windows-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/build-nowebsocket.yml b/.github/workflows/build-nowebsocket.yml index 9e8824986..5f65694aa 100644 --- a/.github/workflows/build-nowebsocket.yml +++ b/.github/workflows/build-nowebsocket.yml @@ -10,7 +10,7 @@ jobs: build-nowebsocket: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules diff --git a/.github/workflows/build-openssl.yml b/.github/workflows/build-openssl.yml index 1128d5880..729e5ffe9 100644 --- a/.github/workflows/build-openssl.yml +++ b/.github/workflows/build-openssl.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: HOMEBREW_NO_INSTALL_CLEANUP=1 brew reinstall openssl@1.1 - name: submodules @@ -38,8 +38,8 @@ jobs: build-windows: runs-on: windows-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 - - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index a1a837245..cae4b13a3 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -8,7 +8,7 @@ jobs: check-version: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules From 2bf604f2ce4925525f9b974a997490212925b377 Mon Sep 17 00:00:00 2001 From: Alexandra DeWit Date: Wed, 22 Apr 2026 14:55:41 -0400 Subject: [PATCH 3/3] ci: add version comments to SHA-pinned actions --- .github/workflows/build-gnutls.yml | 4 ++-- .github/workflows/build-mbedtls.yml | 6 +++--- .github/workflows/build-nice.yml | 2 +- .github/workflows/build-nomedia.yml | 6 +++--- .github/workflows/build-nowebsocket.yml | 2 +- .github/workflows/build-openssl.yml | 8 ++++---- .github/workflows/check-version.yml | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-gnutls.yml b/.github/workflows/build-gnutls.yml index 6a7cd8d85..2e31ecd05 100644 --- a/.github/workflows/build-gnutls.yml +++ b/.github/workflows/build-gnutls.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev nettle-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: brew install gnutls nettle - name: submodules diff --git a/.github/workflows/build-mbedtls.yml b/.github/workflows/build-mbedtls.yml index a058b99a2..3ed2d837a 100644 --- a/.github/workflows/build-mbedtls.yml +++ b/.github/workflows/build-mbedtls.yml @@ -8,9 +8,9 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: Set up Homebrew - uses: Homebrew/actions/setup-homebrew@98cfa07b984a61682e6cd3a0833fad2006cc84ba # master + uses: Homebrew/actions/setup-homebrew@98cfa07b984a61682e6cd3a0833fad2006cc84ba #master - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules @@ -24,7 +24,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: Install Mbed TLS run: brew update && brew install mbedtls - name: submodules diff --git a/.github/workflows/build-nice.yml b/.github/workflows/build-nice.yml index cc43ae98b..931c07025 100644 --- a/.github/workflows/build-nice.yml +++ b/.github/workflows/build-nice.yml @@ -8,7 +8,7 @@ jobs: build-nice: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libgnutls28-dev libnice-dev - name: submodules diff --git a/.github/workflows/build-nomedia.yml b/.github/workflows/build-nomedia.yml index 753daedad..0bcef537e 100644 --- a/.github/workflows/build-nomedia.yml +++ b/.github/workflows/build-nomedia.yml @@ -8,7 +8,7 @@ jobs: build-nomedia: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev - name: submodules @@ -22,8 +22,8 @@ jobs: build-nomedia-windows: runs-on: windows-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/build-nowebsocket.yml b/.github/workflows/build-nowebsocket.yml index 5f65694aa..d9dd12072 100644 --- a/.github/workflows/build-nowebsocket.yml +++ b/.github/workflows/build-nowebsocket.yml @@ -10,7 +10,7 @@ jobs: build-nowebsocket: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules diff --git a/.github/workflows/build-openssl.yml b/.github/workflows/build-openssl.yml index 729e5ffe9..a9e315f62 100644 --- a/.github/workflows/build-openssl.yml +++ b/.github/workflows/build-openssl.yml @@ -8,7 +8,7 @@ jobs: build-linux: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules @@ -22,7 +22,7 @@ jobs: build-macos: runs-on: macos-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: HOMEBREW_NO_INSTALL_CLEANUP=1 brew reinstall openssl@1.1 - name: submodules @@ -38,8 +38,8 @@ jobs: build-windows: runs-on: windows-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1 - name: install packages run: choco install openssl --version=3.1.1 - name: submodules diff --git a/.github/workflows/check-version.yml b/.github/workflows/check-version.yml index cae4b13a3..1d3291002 100644 --- a/.github/workflows/check-version.yml +++ b/.github/workflows/check-version.yml @@ -8,7 +8,7 @@ jobs: check-version: runs-on: ubuntu-latest steps: - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2 - name: install packages run: sudo apt update && sudo apt install libssl-dev libsrtp2-dev - name: submodules