Skip to content

chore(deps): update github actions #4186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update github actions #4186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ai-platform-snippets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@
contents: 'read'
id-token: 'write'
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -50,23 +50,23 @@
create_credentials_file: 'true'
access_token_lifetime: 600s
- id: secrets
uses: 'google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce' # v2
uses: 'google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262' # v3
with:
secrets: |-
caip_id:nodejs-docs-samples-tests/nodejs-docs-samples-ai-platform-caip-project-id
location:nodejs-docs-samples-tests/nodejs-docs-samples-ai-platform-location
- name: Set environment variables
run: |
echo "CAIP_PROJECT_ID=${{ steps.secrets.outputs.caip_id }}" >> $GITHUB_ENV

Check failure on line 60 in .github/workflows/ai-platform-snippets.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
echo "LOCATION=${{ steps.secrets.outputs.location }}" >> $GITHUB_ENV

Check failure on line 61 in .github/workflows/ai-platform-snippets.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ci-scripts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,14 @@
- .github/scripts/**

jobs:
test:

Check warning on line 27 in .github/workflows/ci-scripts.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

ci-scripts.yaml:27: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
defaults:
run:
working-directory: .github/scripts
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

Check warning on line 33 in .github/workflows/ci-scripts.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

ci-scripts.yaml:33: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

Check warning on line 34 in .github/workflows/ci-scripts.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

ci-scripts.yaml:34: action's hash pin has mismatched or missing version comment: points to commit 249970729cb0
with:
node-version: 20
- run: npm install
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/custard-ci-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.

name: (legacy dev) Custard CI

Check warning on line 15 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

custard-ci-dev.yaml:15: overly broad permissions: default permissions used due to no permissions: block
on:
push:
branches:
Expand All @@ -26,7 +26,7 @@
GO_VERSION: ^1.22.0

jobs:
affected:

Check warning on line 29 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

custard-ci-dev.yaml:29: overly broad permissions: default permissions used due to no permissions: block
name: (legacy) Finding affected tests
runs-on: ubuntu-latest
timeout-minutes: 2
Expand All @@ -34,18 +34,18 @@
nodejs-paths: ${{ steps.nodejs.outputs.paths }}
nodejs-setups: ${{ steps.nodejs.outputs.setups }}
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

Check warning on line 37 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

custard-ci-dev.yaml:37: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
with:
fetch-depth: 0
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

Check warning on line 40 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

custard-ci-dev.yaml:40: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
with:
repository: GoogleCloudPlatform/cloud-samples-tools
ref: v0.3.2
path: cloud-samples-tools
- name: Create `bin` directory for cloud-samples-tools binaries
run: mkdir bin
working-directory: cloud-samples-tools
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
with:
go-version: ${{ env.GO_VERSION }}
- name: Build Custard (from cloud-samples-tools)
Expand Down Expand Up @@ -78,11 +78,11 @@
CI_SETUP: ${{ toJson(fromJson(needs.affected.outputs.nodejs-setups)[matrix.path])}}
steps:
- name: CI Setup
run: echo "${{ env.CI_SETUP }}"

Check failure on line 81 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code

Check failure on line 81 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-ci-dev.yaml:81: code injection via template expansion: may expand into attacker-controllable code
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

Check warning on line 82 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

custard-ci-dev.yaml:82: action's hash pin has mismatched or missing version comment: points to commit 3d3c42e5aac5
with:
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

Check warning on line 85 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

custard-ci-dev.yaml:85: action's hash pin has mismatched or missing version comment: points to commit 249970729cb0
with:
node-version: ${{ fromJson(env.CI_SETUP).node-version }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
Expand All @@ -96,7 +96,7 @@
id_token_audience: 'https://action.test/' # service must have this custom audience
id_token_include_email: true
- name: Export environment variables
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
id: vars
with:
script: |
Expand All @@ -104,14 +104,14 @@
const projectId = '${{ env.GOOGLE_SAMPLES_PROJECT }}';
const setup = JSON.parse(process.env.CI_SETUP);
const serviceAccount = '${{ env.GOOGLE_SERVICE_ACCOUNT }}';
const idToken = '${{ steps.auth.outputs.id_token }}';

Check failure on line 107 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
return await setupVars({projectId, core, setup, serviceAccount, idToken})
- uses: google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce # v2
- uses: google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262 # v3
if: ${{ fromJson(steps.vars.outputs.result).secrets }}
with:
secrets: ${{ fromJson(steps.vars.outputs.result).secrets }}
export_to_environment: true
- name: Run tests for ${{ matrix.path }}
run: |
timeout ${{ fromJson(env.CI_SETUP).timeout-minutes }}m \

Check failure on line 116 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
make test dir=${{ matrix.path }}

Check failure on line 117 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code

Check failure on line 117 in .github/workflows/custard-ci-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-ci-dev.yaml:117: code injection via template expansion: may expand into attacker-controllable code
24 changes: 12 additions & 12 deletions .github/workflows/custard-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
# IMPORTANT: DO NOT CHANGE THE NAME OF THIS WORKFLOW!
# The workflow named "Custard CI" triggers both custard-run.yaml and custard-run-dev.yaml.
# TODO: To sunset old tests remove `affected`, `lint`, and `test` jobs (only keep `region-tags`).
name: Custard CI

Check warning on line 18 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

custard-ci.yaml:18: overly broad permissions: default permissions used due to no permissions: block
on:
push:
branches:
Expand All @@ -38,18 +38,18 @@
nodejs-paths: ${{ steps.nodejs.outputs.paths }}
nodejs-setups: ${{ steps.nodejs.outputs.setups }}
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
fetch-depth: 0
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
repository: GoogleCloudPlatform/cloud-samples-tools
ref: v0.3.2
path: cloud-samples-tools
- name: Create `bin` directory for cloud-samples-tools binaries
run: mkdir bin
working-directory: cloud-samples-tools
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
with:
go-version: ${{ env.GO_VERSION }}
- name: Build Custard (from cloud-samples-tools)
Expand All @@ -70,20 +70,20 @@
timeout-minutes: 5
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: 20
- run: npm install
- name: Run lint
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
with:
script: |
const { execSync } = await import("node:child_process");

const cmd = 'npx gts lint';
const affected = ${{ needs.affected.outputs.nodejs-paths }};

Check failure on line 86 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
if (affected.length === 0) {
console.log("No packages were affected, nothing to lint.")
}
Expand Down Expand Up @@ -115,8 +115,8 @@
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: 20
- run: ./.github/workflows/utils/region-tags-tests.sh
Expand All @@ -139,11 +139,11 @@
CI_SETUP: ${{ toJson(fromJson(needs.affected.outputs.nodejs-setups)[matrix.path])}}
steps:
- name: CI Setup
run: echo "${{ env.CI_SETUP }}"

Check failure on line 142 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code

Check failure on line 142 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-ci.yaml:142: code injection via template expansion: may expand into attacker-controllable code
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: ${{ fromJson(env.CI_SETUP).node-version }}
- uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
Expand All @@ -157,7 +157,7 @@
id_token_audience: 'https://action.test/' # service must have this custom audience
id_token_include_email: true
- name: Export environment variables
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
id: vars
with:
script: |
Expand All @@ -165,9 +165,9 @@
const projectId = '${{ env.GOOGLE_SAMPLES_PROJECT }}';
const setup = JSON.parse(process.env.CI_SETUP);
const serviceAccount = '${{ env.GOOGLE_SERVICE_ACCOUNT }}';
const idToken = '${{ steps.auth.outputs.id_token }}';

Check failure on line 168 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection 

code injection via template expansion: may expand into attacker-controllable code
return await setupVars({projectId, core, setup, serviceAccount, idToken})
- uses: google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce # v2
- uses: google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262 # v3
if: ${{ fromJson(steps.vars.outputs.result).secrets }}
with:
secrets: ${{ fromJson(steps.vars.outputs.result).secrets }}
Expand All @@ -175,4 +175,4 @@
- name: Run tests for ${{ matrix.path }}
run: |
timeout ${{ fromJson(env.CI_SETUP).timeout-minutes }}m \
make test dir=${{ matrix.path }}

Check failure on line 178 in .github/workflows/custard-ci.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-ci.yaml:178: code injection via template expansion: may expand into attacker-controllable code
2 changes: 1 addition & 1 deletion .github/workflows/custard-run-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

name: (dev) Custard run

on:

Check failure on line 17 in .github/workflows/custard-run-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

dangerous-triggers 

custard-run-dev.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
# Run tests when a pull request is created or updated.
# This allows to run tests from forked repos (after reviewer's approval).
workflow_run:
Expand Down Expand Up @@ -81,7 +81,7 @@
job-name: ${{ github.job }} (${{ matrix.path }})
if: ${{ !!github.event.workflow_run }}
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
ref: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
- name: Authenticate
Expand Down Expand Up @@ -110,7 +110,7 @@
- name: Run tests for ${{ matrix.path }}
run: |
timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
make test dir=${{ matrix.path }}

Check failure on line 113 in .github/workflows/custard-run-dev.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-run-dev.yaml:113: code injection via template expansion: may expand into attacker-controllable code
env:
# TODO: remove this when the self-contained runner lands.
SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/custard-run.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

name: Custard run

on:

Check failure on line 17 in .github/workflows/custard-run.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

dangerous-triggers 

custard-run.yaml:17: use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely
# Run tests when a pull request is created or updated.
# This allows to run tests from forked repos (after reviewer's approval).
workflow_run:
Expand Down Expand Up @@ -76,11 +76,11 @@
name: Custard CI / ${{ github.job }}
if: ${{ !!github.event.workflow_run }}
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
ref: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version: 20
- run: npm install
Expand Down Expand Up @@ -127,7 +127,7 @@
job-name: ${{ github.job }} (${{ matrix.path }})
if: ${{ !!github.event.workflow_run }}
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
with:
ref: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
- name: Authenticate
Expand Down Expand Up @@ -156,7 +156,7 @@
- name: Run tests for ${{ matrix.path }}
run: |
timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
make test dir=${{ matrix.path }}

Check failure on line 159 in .github/workflows/custard-run.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

custard-run.yaml:159: code injection via template expansion: may expand into attacker-controllable code
env:
# TODO: remove this when the self-contained runner lands.
SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/dialogflow-cx.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 120
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -50,19 +50,19 @@ jobs:
create_credentials_file: 'true'
access_token_lifetime: 600s
- id: secrets
uses: 'google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce' # v2
uses: 'google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262' # v3
with:
secrets: |-
agent_id:nodejs-docs-samples-tests/nodejs-docs-samples-dialogflow-cx-agent-id
test_id:nodejs-docs-samples-tests/nodejs-docs-samples-dialogflow-cx-test-id
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/functions-slack.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 120
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -50,19 +50,19 @@ jobs:
create_credentials_file: 'true'
access_token_lifetime: 600s
- id: secrets
uses: 'google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce' # v2
uses: 'google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262' # v3
with:
secrets: |-
slack_secret:nodejs-docs-samples-tests/nodejs-docs-samples-slack-secret
kg_api_key:nodejs-docs-samples-tests/nodejs-docs-samples-kg-api-key
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/iam-deny.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
run:
working-directory: 'iam/deny'
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -53,14 +53,14 @@ jobs:
service_account: 'kokoro-ca@isakovf-iam-deny-samples.iam.gserviceaccount.com'
create_credentials_file: 'true'
access_token_lifetime: 600s
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/storagetransfer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
run:
working-directory: 'storagetransfer'
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -53,19 +53,19 @@ jobs:
create_credentials_file: 'true'
access_token_lifetime: 600s
- id: secrets
uses: 'google-github-actions/get-secretmanager-secrets@e5bb06c2ca53b244f978d33348d18317a7f263ce' # v2
uses: 'google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262' # v3
with:
secrets: |-
sts_aws_secret:nodejs-docs-samples-tests/nodejs-docs-samples-storagetransfer-aws
sts_azure_secret:nodejs-docs-samples-tests/nodejs-docs-samples-storagetransfer-azure
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
contents: 'read'
id-token: 'write'
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{github.event.pull_request.head.sha}}
- uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3.0.0
Expand All @@ -40,14 +40,14 @@
service_account: 'kokoro-system-test@long-door-651.iam.gserviceaccount.com'
create_credentials_file: 'true'
access_token_lifetime: 600s
- uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 16
- name: Get npm cache directory
id: npm-cache-dir
shell: bash
run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
- uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
id: npm-cache
with:
path: ${{ steps.npm-cache-dir.outputs.dir }}
Expand All @@ -59,9 +59,9 @@
- name: set testing env vars for scheduled run
if: github.event.action == 'schedule'
run: |
echo "MOCHA_REPORTER_SUITENAME=${{ inputs.name }}" >> $GITHUB_ENV

Check failure on line 62 in .github/workflows/test.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

test.yaml:62: code injection via template expansion: may expand into attacker-controllable code
echo "MOCHA_REPORTER=xunit" >> $GITHUB_ENV
- name: Run Tests
run: make test dir=${{ inputs.path }}

Check failure on line 65 in .github/workflows/test.yaml

View workflow job for this annotation

GitHub Actions / zizmor-output

template-injection 

test.yaml:65: code injection via template expansion: may expand into attacker-controllable code
env:
GOOGLE_SAMPLES_PROJECT: "long-door-651"
Loading