From 7e361920348dba1fa8a0ad7bc218b0d5b1ab5eb1 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Thu, 16 Jul 2026 15:53:46 +0300 Subject: [PATCH] :wrench: Pin mattermost-notify action to its v2.1.0 commit SHA The notify steps referenced mattermost/action-mattermost-notify@master, a mutable branch that runs in CI with access to the MATTERMOST_WEBHOOK_URL secret. Pinning to the immutable commit of the latest release (v2.1.0, ae31bb6) keeps the exact reviewed code from executing, per GitHub third-party action hardening guidance, while staying easy to bump. --- .github/workflows/build-bundle.yml | 2 +- .github/workflows/build-docker-devenv.yml | 2 +- .github/workflows/build-docker.yml | 2 +- .github/workflows/build-tag.yml | 2 +- .github/workflows/plugins-deploy-api-doc.yml | 2 +- .github/workflows/plugins-deploy-package.yml | 2 +- .github/workflows/plugins-deploy-styles-doc.yml | 2 +- .github/workflows/release.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml index e31382ccd4..441587eea3 100644 --- a/.github/workflows/build-bundle.yml +++ b/.github/workflows/build-bundle.yml @@ -85,7 +85,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/build-docker-devenv.yml b/.github/workflows/build-docker-devenv.yml index f94064833e..5faafba350 100644 --- a/.github/workflows/build-docker-devenv.yml +++ b/.github/workflows/build-docker-devenv.yml @@ -40,7 +40,7 @@ jobs: cache-to: type=registry,ref=${{ env.DOCKER_IMAGE }}:buildcache,mode=max - name: Notify Mattermost - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml index 0972f1e25d..e2497f3093 100644 --- a/.github/workflows/build-docker.yml +++ b/.github/workflows/build-docker.yml @@ -175,7 +175,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/build-tag.yml b/.github/workflows/build-tag.yml index 58fa0413c0..c47d19570c 100644 --- a/.github/workflows/build-tag.yml +++ b/.github/workflows/build-tag.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Notify Mattermost - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/plugins-deploy-api-doc.yml b/.github/workflows/plugins-deploy-api-doc.yml index 51be85e45e..7208646c1a 100644 --- a/.github/workflows/plugins-deploy-api-doc.yml +++ b/.github/workflows/plugins-deploy-api-doc.yml @@ -131,7 +131,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/plugins-deploy-package.yml b/.github/workflows/plugins-deploy-package.yml index 137ba6f7fa..cbc8e109cd 100644 --- a/.github/workflows/plugins-deploy-package.yml +++ b/.github/workflows/plugins-deploy-package.yml @@ -114,7 +114,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/plugins-deploy-styles-doc.yml b/.github/workflows/plugins-deploy-styles-doc.yml index 47f0d1cc24..29d2ac4fea 100644 --- a/.github/workflows/plugins-deploy-styles-doc.yml +++ b/.github/workflows/plugins-deploy-styles-doc.yml @@ -129,7 +129,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 76e3d91964..47305864f2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -103,7 +103,7 @@ jobs: - name: Notify Mattermost if: failure() - uses: mattermost/action-mattermost-notify@master + uses: mattermost/action-mattermost-notify@ae31bb6f9e26a54336e79696f108a2c91cf55b4e # v2.1.0 with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK }} MATTERMOST_CHANNEL: bot-alerts-cicd