From 7c8f38774b307cccb5d70acd142693a140377450 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Wed, 5 Aug 2026 11:05:00 +0200 Subject: [PATCH] ci: pin actions to commit SHAs Version tags are movable pointers: whoever controls an action's repo can re-point them, and the previous commit's CVE is the proof it happens in practice, to this very repository's dependency set. These workflows hold real credentials: release.yml publishes the whole lucide npm family with OIDC trusted publishing, ci.yml creates the GitHub releases, and the comment and review workflows carry pull-request write tokens. Pinning by full commit SHA makes the reviewed code the code that runs. Every pin keeps a version comment, resolved from the upstream repo and cross-checked against its release tag (softprops v1 has no patch tag, the comment names the floating tag it replaced). Dependabot understands SHA pins and keeps bumping them with the comment in sync; the repo has no dependabot.yml yet, adding one with the github-actions ecosystem is a one-block follow-up. --- .github/workflows/angular.yml | 12 ++++---- .github/workflows/ci.yml | 10 +++---- .../close-issue-with-banned-phrases.yml | 2 +- .github/workflows/close-stale-prs.yml | 2 +- .github/workflows/comment-icon-preview.yml | 6 ++-- .github/workflows/icons.yml | 12 ++++---- .github/workflows/labeler.yml | 4 +-- .github/workflows/lint-code.yml | 6 ++-- .github/workflows/lint-pr-title.yml | 2 +- .github/workflows/linting-icons.yml | 16 +++++------ .github/workflows/lucide-astro.yml | 12 ++++---- .github/workflows/lucide-font.yml | 8 +++--- .github/workflows/lucide-lab.yml | 6 ++-- .github/workflows/lucide-preact.yml | 6 ++-- .github/workflows/lucide-react-native.yml | 12 ++++---- .github/workflows/lucide-react.yml | 12 ++++---- .github/workflows/lucide-shared.yml | 6 ++-- .github/workflows/lucide-solid.yml | 12 ++++---- .github/workflows/lucide-static.yml | 6 ++-- .github/workflows/lucide-svelte-5.yml | 18 ++++++------ .github/workflows/lucide-vue.yml | 12 ++++---- .github/workflows/lucide.yml | 12 ++++---- .../workflows/pull-request-icon-preview.yml | 10 +++---- .../pull-request-metadata-suggestions.yml | 6 ++-- .github/workflows/release.yml | 28 +++++++++---------- .github/workflows/repo-journal.yml | 2 +- .github/workflows/request-review.yml | 2 +- 27 files changed, 121 insertions(+), 121 deletions(-) diff --git a/.github/workflows/angular.yml b/.github/workflows/angular.yml index 64ec0c903..cba7835f4 100644 --- a/.github/workflows/angular.yml +++ b/.github/workflows/angular.yml @@ -11,9 +11,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -27,9 +27,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5abb506c7..c1657562d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,7 @@ jobs: outputs: RELEASE_ENVIRONMENT: ${{ steps.environment.outputs.RELEASE_ENVIRONMENT }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Fetch tags run: git fetch --all --tags @@ -63,9 +63,9 @@ jobs: outputs: VERSION: ${{ steps.new-version.outputs.NEW_VERSION }} steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -100,7 +100,7 @@ jobs: echo '${{ steps.change-log.outputs.CHANGE_LOG }}' - name: Create Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 with: tag_name: ${{ steps.new-version.outputs.NEW_VERSION }} name: Version ${{ steps.new-version.outputs.NEW_VERSION }} diff --git a/.github/workflows/close-issue-with-banned-phrases.yml b/.github/workflows/close-issue-with-banned-phrases.yml index e6958de12..773d25911 100644 --- a/.github/workflows/close-issue-with-banned-phrases.yml +++ b/.github/workflows/close-issue-with-banned-phrases.yml @@ -11,7 +11,7 @@ jobs: issues: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Load stopwords from JSON & check issue title & body if: contains(github.event.issue.labels.*.name, '🙌 icon request') diff --git a/.github/workflows/close-stale-prs.yml b/.github/workflows/close-stale-prs.yml index 0b47315f4..0bdeb0b2b 100644 --- a/.github/workflows/close-stale-prs.yml +++ b/.github/workflows/close-stale-prs.yml @@ -9,7 +9,7 @@ jobs: permissions: pull-requests: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-pr-message: This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 5 days. diff --git a/.github/workflows/comment-icon-preview.yml b/.github/workflows/comment-icon-preview.yml index 1ba1aa89e..91a72c376 100644 --- a/.github/workflows/comment-icon-preview.yml +++ b/.github/workflows/comment-icon-preview.yml @@ -14,7 +14,7 @@ jobs: github.event.workflow_run.conclusion == 'success' steps: - name: 'Download artifact' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -42,7 +42,7 @@ jobs: id: pr-number - name: Find Comment - uses: peter-evans/find-comment@v2 + uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0 id: pr-comment with: issue-number: ${{ steps.pr-number.outputs.number }} @@ -50,7 +50,7 @@ jobs: body-includes: Added or changed icons - name: Create or update comment - uses: peter-evans/create-or-update-comment@v3 + uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0 with: comment-id: ${{ steps.pr-comment.outputs.comment-id }} issue-number: ${{ steps.pr-number.outputs.number }} diff --git a/.github/workflows/icons.yml b/.github/workflows/icons.yml index 42865b6b8..ac382be5e 100644 --- a/.github/workflows/icons.yml +++ b/.github/workflows/icons.yml @@ -13,9 +13,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -29,9 +29,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 7dc5c2879..69c87f8a2 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -9,5 +9,5 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/labeler@v5 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0 diff --git a/.github/workflows/lint-code.yml b/.github/workflows/lint-code.yml index 8fb9a83d5..ce7f23c0c 100644 --- a/.github/workflows/lint-code.yml +++ b/.github/workflows/lint-code.yml @@ -7,9 +7,9 @@ jobs: lint-code: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml index a336a39a5..32af252d4 100644 --- a/.github/workflows/lint-pr-title.yml +++ b/.github/workflows/lint-pr-title.yml @@ -12,7 +12,7 @@ jobs: name: PR Title Lint runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/linting-icons.yml b/.github/workflows/linting-icons.yml index c02613b53..1f4fad795 100644 --- a/.github/workflows/linting-icons.yml +++ b/.github/workflows/linting-icons.yml @@ -17,9 +17,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -29,7 +29,7 @@ jobs: - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 with: files: | icons/* @@ -46,9 +46,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -65,6 +65,6 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Check Uniqueness of Aliases run: "! cat <(printf \"%s\\n\" icons/*.json | while read -r name; do basename \"$name\" .json; done) <(jq -cr 'select(.aliases) | .aliases[] | if type==\"string\" then . else .name end' icons/*.json) | sort | uniq -c | grep -ve '^\\s*1 '" diff --git a/.github/workflows/lucide-astro.yml b/.github/workflows/lucide-astro.yml index 09bcb19b8..d2a3ad6f6 100644 --- a/.github/workflows/lucide-astro.yml +++ b/.github/workflows/lucide-astro.yml @@ -15,9 +15,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v2 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b # v2.4.1 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: 'package.json' cache: 'pnpm' @@ -31,9 +31,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: pnpm/action-setup@v2 - - uses: actions/setup-node@v3.8.1 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b # v2.4.1 + - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version-file: 'package.json' cache: 'pnpm' diff --git a/.github/workflows/lucide-font.yml b/.github/workflows/lucide-font.yml index 6842a01ce..490d07883 100644 --- a/.github/workflows/lucide-font.yml +++ b/.github/workflows/lucide-font.yml @@ -13,9 +13,9 @@ jobs: lucide-font: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -30,7 +30,7 @@ jobs: run: pnpm build:font - name: 'Upload to Artifacts' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: lucide-font path: lucide-font diff --git a/.github/workflows/lucide-lab.yml b/.github/workflows/lucide-lab.yml index f4c62c39c..ca3f607d6 100644 --- a/.github/workflows/lucide-lab.yml +++ b/.github/workflows/lucide-lab.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-preact.yml b/.github/workflows/lucide-preact.yml index fc7b1c824..43d58256f 100644 --- a/.github/workflows/lucide-preact.yml +++ b/.github/workflows/lucide-preact.yml @@ -16,9 +16,9 @@ jobs: lucide-preact: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-react-native.yml b/.github/workflows/lucide-react-native.yml index 99436b33e..3db77b624 100644 --- a/.github/workflows/lucide-react-native.yml +++ b/.github/workflows/lucide-react-native.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -32,9 +32,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-react.yml b/.github/workflows/lucide-react.yml index 77f85f7d0..ed89e1a36 100644 --- a/.github/workflows/lucide-react.yml +++ b/.github/workflows/lucide-react.yml @@ -17,9 +17,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -33,9 +33,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-shared.yml b/.github/workflows/lucide-shared.yml index 56c4b1931..9a07f4ee0 100644 --- a/.github/workflows/lucide-shared.yml +++ b/.github/workflows/lucide-shared.yml @@ -13,9 +13,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-solid.yml b/.github/workflows/lucide-solid.yml index a8515c761..b31cf0486 100644 --- a/.github/workflows/lucide-solid.yml +++ b/.github/workflows/lucide-solid.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -32,9 +32,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-static.yml b/.github/workflows/lucide-static.yml index aa604eaa5..224491d82 100644 --- a/.github/workflows/lucide-static.yml +++ b/.github/workflows/lucide-static.yml @@ -11,9 +11,9 @@ jobs: lucide-static: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-svelte-5.yml b/.github/workflows/lucide-svelte-5.yml index 84f3a415f..7e828c9d9 100644 --- a/.github/workflows/lucide-svelte-5.yml +++ b/.github/workflows/lucide-svelte-5.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -32,9 +32,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -48,9 +48,9 @@ jobs: typecheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide-vue.yml b/.github/workflows/lucide-vue.yml index c653429bb..a80cddf18 100644 --- a/.github/workflows/lucide-vue.yml +++ b/.github/workflows/lucide-vue.yml @@ -16,9 +16,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -32,9 +32,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/lucide.yml b/.github/workflows/lucide.yml index 578b71f36..91ab79166 100644 --- a/.github/workflows/lucide.yml +++ b/.github/workflows/lucide.yml @@ -15,9 +15,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -31,9 +31,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/pull-request-icon-preview.yml b/.github/workflows/pull-request-icon-preview.yml index 814673683..c95bb3a9e 100644 --- a/.github/workflows/pull-request-icon-preview.yml +++ b/.github/workflows/pull-request-icon-preview.yml @@ -14,18 +14,18 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v6 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: 'package.json' - name: Get changed files id: changed-files - uses: tj-actions/changed-files@v46 + uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 with: files: icons/*.svg - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 - name: Install svgson for code preview (safer and faster than installing all deps) run: npm install svgson@5.3.1 --force @@ -40,7 +40,7 @@ jobs: env: CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }} - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: pr_number path: pr/ diff --git a/.github/workflows/pull-request-metadata-suggestions.yml b/.github/workflows/pull-request-metadata-suggestions.yml index a6b2acfd2..6657f5006 100644 --- a/.github/workflows/pull-request-metadata-suggestions.yml +++ b/.github/workflows/pull-request-metadata-suggestions.yml @@ -16,11 +16,11 @@ jobs: steps: # We checkout the main branch of main repository for security reasons. # This is to prevent the workflow from running on a forked repository. - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: lucide-icons/lucide - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e72e488db..ad4b92321 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,9 +60,9 @@ jobs: '@lucide/vue', ] steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -93,10 +93,10 @@ jobs: contents: read steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -123,9 +123,9 @@ jobs: runs-on: ubuntu-latest needs: prepare steps: - - uses: actions/checkout@v6 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: cache: 'pnpm' node-version-file: 'package.json' @@ -142,7 +142,7 @@ jobs: BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }} - name: 'Upload to Artifacts' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: lucide-font path: lucide-font @@ -155,15 +155,15 @@ jobs: id-token: write # Required for OIDC contents: write steps: - - uses: actions/checkout@v6 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 - name: Zip font and icons run: | zip -r lucide-font-${{ needs.prepare.outputs.VERSION }}.zip lucide-font zip -r lucide-icons-${{ needs.prepare.outputs.VERSION }}.zip icons - name: Release zip and fonts - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: tag_name: ${{ needs.prepare.outputs.VERSION }} diff --git a/.github/workflows/repo-journal.yml b/.github/workflows/repo-journal.yml index 09638bac5..4e7a7812d 100644 --- a/.github/workflows/repo-journal.yml +++ b/.github/workflows/repo-journal.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Node.js environment - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 24 diff --git a/.github/workflows/request-review.yml b/.github/workflows/request-review.yml index 5487639d7..33145d792 100644 --- a/.github/workflows/request-review.yml +++ b/.github/workflows/request-review.yml @@ -13,7 +13,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 ref: refs/pull/${{ github.event.pull_request.number }}/merge