1#!/bin/sh 2# 3# Look up specified version of Github Actions an pin to that specific 4# revision. 5# 6 7set -e 8 9github=https://github.com 10 11for workflow in workflows/*.yml; do 12 sed 's/ - / /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \ 13 while read line; do 14 action_ver=$(awk '{print $2}' <<<${line}) 15 action=$(cut -f1 -d@ <<<${action_ver}) 16 ver=$(cut -f2 -d@ <<<${action_ver}) 17 intendedver=$(awk '{print $4}' <<<${line}) 18 if [ -z "${intendedver}" ]; then 19 intendedver=${ver} 20 fi 21 case "${action}" in 22 google/oss-fuzz/*) actiondir=google/oss-fuzz ;; 23 *) actiondir="${action}" ;; 24 esac 25 if [ ! -d /tmp/${actiondir} ]; then 26 git clone ${github}/${actiondir} /tmp/${actiondir} 27 fi 28 hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver}) 29 sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \ 30 ${workflow} 31 done 32done 33 34# Output actions for allowlist. 35awk 'BEGIN{IFS=":"} /^ +uses:.*@/{print $2","}' workflows/*.yml | sort -u 36