ci: Updating the workflows/actions to use the step-security version. (#…

…2924) * ci: Updating the workflows/actions to use the step-security version. Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech> * Updating the setup-go version to 5.0.2 Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech> * Adding minimal viable permissions to the modified workflows. Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech> --------- Signed-off-by: Vasil Boyadzhiev <vasil.boyadzhiev@limechain.tech> Co-authored-by: Roger Barker <roger.barker@swirldslabs.com>
hashgraph · Sep 18, 2024 · 90d1e24 · 90d1e24
1 parent b160863
commit 90d1e24
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 5 deletions.
diff --git a/.github/workflows/acceptance-workflow.yml b/.github/workflows/acceptance-workflow.yml
@@ -36,6 +36,7 @@ jobs:
     timeout-minutes: 50
     permissions:
       contents: write
+      actions: read
       # issues: read
     steps:
       - name: Harden Runner
@@ -82,7 +83,7 @@ jobs:
         run: docker stop json-rpc-relay json-rpc-relay-ws
 
       - name: Run acceptance tests
-        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+        uses: step-security/retry@2ab886c0de89f68f146c9b43f53e61abc59c46dc # v3.0.1
         with:
           max_attempts: 3
           timeout_minutes: 30

diff --git a/.github/workflows/dev-tool-workflow.yml b/.github/workflows/dev-tool-workflow.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: smart-contracts-linux-medium
     permissions:
       contents: write
+      actions: read
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
@@ -33,7 +34,7 @@ jobs:
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
       - name: Install go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: '1.22.3'
 
@@ -64,7 +65,7 @@ jobs:
         run: cd ${{ inputs.directory }}/ && npm ci
 
       - name: Run the tests
-        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+        uses: step-security/retry@2ab886c0de89f68f146c9b43f53e61abc59c46dc # v3.0.1
         with:
           max_attempts: 10
           timeout_minutes: 10

diff --git a/.github/workflows/postman.yml b/.github/workflows/postman.yml
@@ -17,6 +17,7 @@ jobs:
     runs-on: smart-contracts-linux-medium
     permissions:
       contents: write
+      actions: read
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
@@ -59,7 +60,7 @@ jobs:
         run: npm install -g newman
 
       - name: Run the newman script
-        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+        uses: step-security/retry@2ab886c0de89f68f146c9b43f53e61abc59c46dc # v3.0.1
         with:
           max_attempts: 10
           timeout_minutes: 10

diff --git a/.github/workflows/release-acceptance.yml b/.github/workflows/release-acceptance.yml
@@ -16,6 +16,9 @@ on:
 jobs:
   release-acceptance-test:
     runs-on: smart-contracts-linux-medium
+    permissions:
+      contents: read
+      actions: read
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
@@ -66,7 +69,7 @@ jobs:
         run: npm install @hashgraph/hedera-local -g        
 
       - name: Run acceptance tests
-        uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+        uses: step-security/retry@2ab886c0de89f68f146c9b43f53e61abc59c46dc # v3.0.1
         with:
           max_attempts: 3
           timeout_minutes: 20