ci: fix TOB-SCREUC-7, pin 3rd-party actions (#1138)

* fix(ci): disable cache-binary option

* ci: pin 3rd-party actions

Author: Thegaram

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/docker-arm64.yaml

@@ -19,22 +19,25 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
+
       - name: Set up QEMU
         run: |
           docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
           docker buildx create --name multiarch --driver docker-container --use
+
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
         with:
           cache-binary: false
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Build docker image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           platforms: linux/arm64
           context: .

.github/workflows/docker.yaml

@@ -13,29 +13,33 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@v2
+
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
+
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
       with:
         cache-binary: false
     - name: Extract docker metadata
       id: meta
-      uses: docker/metadata-action@v3
+      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
       with:
         images: scrolltech/l2geth
         tags: |
           type=ref,event=tag,enable=${{ github.event_name == 'push' }}
           type=raw,value=latest,enable=${{ github.event_name == 'release' }}
         flavor: |
           latest=false
+
     - name: Login to Docker Hub
-      uses: docker/login-action@v2
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
+
     - name: Build docker image
-      uses: docker/build-push-action@v2
+      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
       with:
         context: .
         file: Dockerfile

.github/workflows/l2geth_ci.yml

@@ -13,6 +13,7 @@ on:
       - ready_for_review
 name: CI
 jobs:
+
   build-mock-ccc-geth: # build geth with mock circuit capacity checker
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -21,11 +22,14 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.21.x
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - name: Build
       run: |
         make nccc_geth
+
   build-geth: # build geth with circuit capacity checker
     if: github.event_name == 'push' # will only be triggered when pushing to main & staging & develop & alpha
     runs-on: ubuntu-latest
@@ -34,19 +38,23 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.21.x
+
     - name: Install rust
-      uses: actions-rs/toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@9399c7bb15d4c7d47b27263d024f0a4978346ba4 # v1.11.0
       with:
         toolchain: nightly-2023-12-03
         override: true
         components: rustfmt, clippy
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - name: Build
       run: |
         make libzkp
         sudo cp ./rollup/ccc/libzkp/libzkp.so /usr/local/lib/
         make geth
+
   check:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -55,12 +63,15 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.21.x
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - name: Lint
       run: |
         rm -rf $HOME/.cache/golangci-lint
         make lint
+
   goimports-lint:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -69,17 +80,22 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.18.x
+
     - name: Install goimports
       run: go install golang.org/x/tools/cmd/[email protected]
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - run: goimports -local github.com/scroll-tech/go-ethereum/ -w .
+
     # If there are any diffs from goimports, fail.
     - name: Verify no changes from goimports
       run: |
         if [ -n "$(git status --porcelain)" ]; then
           exit 1
         fi
+
   go-mod-tidy-lint:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -88,15 +104,19 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.21.x
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - run: go mod tidy
+
     # If there are any diffs from go mod tidy, fail.
     - name: Verify no changes from go mod tidy
       run: |
         if [ -n "$(git status --porcelain)" ]; then
           exit 1
         fi
+
   test:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -105,10 +125,13 @@ jobs:
       uses: actions/setup-go@v2
       with:
         go-version: 1.21.x
+
     - name: Checkout code
       uses: actions/checkout@v2
+
     - name: Test
       run: |
         make test
+
     - name: Upload coverage report
       run: bash <(curl -s https://codecov.io/bash)