1*bb5c77e9SEd Maste#!/bin/sh 2*bb5c77e9SEd Maste# 3*bb5c77e9SEd Maste# Look up specified version of Github Actions an pin to that specific 4*bb5c77e9SEd Maste# revision. 5*bb5c77e9SEd Maste# 6*bb5c77e9SEd Maste 7*bb5c77e9SEd Masteset -e 8*bb5c77e9SEd Maste 9*bb5c77e9SEd Mastegithub=https://github.com 10*bb5c77e9SEd Maste 11*bb5c77e9SEd Mastefor workflow in workflows/*.yml; do 12*bb5c77e9SEd Maste sed 's/ - / /' ${workflow} | grep -v '^#' | awk '/uses:/ {print}' | \ 13*bb5c77e9SEd Maste while read line; do 14*bb5c77e9SEd Maste action_ver=$(awk '{print $2}' <<<${line}) 15*bb5c77e9SEd Maste action=$(cut -f1 -d@ <<<${action_ver}) 16*bb5c77e9SEd Maste ver=$(cut -f2 -d@ <<<${action_ver}) 17*bb5c77e9SEd Maste intendedver=$(awk '{print $4}' <<<${line}) 18*bb5c77e9SEd Maste if [ -z "${intendedver}" ]; then 19*bb5c77e9SEd Maste intendedver=${ver} 20*bb5c77e9SEd Maste fi 21*bb5c77e9SEd Maste case "${action}" in 22*bb5c77e9SEd Maste google/oss-fuzz/*) actiondir=google/oss-fuzz ;; 23*bb5c77e9SEd Maste *) actiondir="${action}" ;; 24*bb5c77e9SEd Maste esac 25*bb5c77e9SEd Maste if [ ! -d /tmp/${actiondir} ]; then 26*bb5c77e9SEd Maste git clone ${github}/${actiondir} /tmp/${actiondir} 27*bb5c77e9SEd Maste fi 28*bb5c77e9SEd Maste hash=$(cd /tmp/${actiondir} && git rev-parse ${intendedver}) 29*bb5c77e9SEd Maste sed -i -e "s|uses: ${action}@.*|uses: ${action}@${hash} # ${intendedver}|" \ 30*bb5c77e9SEd Maste ${workflow} 31*bb5c77e9SEd Maste done 32*bb5c77e9SEd Mastedone 33*bb5c77e9SEd Maste 34*bb5c77e9SEd Maste# Output actions for allowlist. 35*bb5c77e9SEd Masteawk 'BEGIN{IFS=":"} /^ +uses:.*@/{print $2","}' workflows/*.yml | sort -u 36