1515 id-token : write # Required for the attestations step
1616 attestations : write # Required for the attestations step
1717 steps :
18- - uses : actions/checkout@v5
19- - uses : actions/setup-java@v5
18+ - uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
19+ - uses : actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
2020 with :
2121 distribution : ' temurin'
2222 java-version : ${{ env.JAVA_VERSION }}
@@ -28,12 +28,12 @@ jobs:
2828 run : mvn -B verify --no-transfer-progress
2929 - name : Attest
3030 if : startsWith(github.ref, 'refs/tags/')
31- uses : actions/attest-build-provenance@v3
31+ uses : actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
3232 with :
3333 subject-path : |
3434 target/*.jar
3535 target/*.pom
36- - uses : actions/upload-artifact@v5
36+ - uses : actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
3737 with :
3838 name : artifacts
3939 path : target/*.jar
@@ -45,20 +45,18 @@ jobs:
4545 needs : [build]
4646 if : github.repository_owner == 'cryptomator' && (startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[deploy]'))
4747 steps :
48- - uses : actions/checkout@v5
49- - uses : actions/setup-java@v5
48+ - uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
49+ - uses : actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
5050 with :
5151 distribution : ' temurin'
5252 java-version : ${{ env.JAVA_VERSION }}
5353 cache : ' maven'
5454 server-id : central
5555 server-username : MAVEN_CENTRAL_USERNAME
5656 server-password : MAVEN_CENTRAL_PASSWORD
57- - name : Verify project version matches tag
57+ - name : Ensure to use tagged version
5858 if : startsWith(github.ref, 'refs/tags/')
59- run : |
60- PROJECT_VERSION=$(mvn help:evaluate "-Dexpression=project.version" -q -DforceStdout)
61- test "$PROJECT_VERSION" = "${GITHUB_REF##*/}"
59+ run : mvn versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
6260 - name : Verify project version is -SNAPSHOT
6361 if : startsWith(github.ref, 'refs/tags/') == false
6462 run : |
@@ -81,17 +79,15 @@ jobs:
8179 needs : [build]
8280 if : github.repository_owner == 'cryptomator' && (startsWith(github.ref, 'refs/tags/') || contains(github.event.head_commit.message, '[deploy]'))
8381 steps :
84- - uses : actions/checkout@v5
85- - uses : actions/setup-java@v5
82+ - uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
83+ - uses : actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
8684 with :
8785 java-version : ${{ env.JAVA_VERSION }}
8886 distribution : ' temurin'
8987 cache : ' maven'
90- - name : Verify project version matches tag
88+ - name : Ensure to use tagged version
9189 if : startsWith(github.ref, 'refs/tags/')
92- run : |
93- PROJECT_VERSION=$(mvn help:evaluate "-Dexpression=project.version" -q -DforceStdout)
94- test "$PROJECT_VERSION" = "${GITHUB_REF##*/}"
90+ run : mvn versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
9591 - name : Verify project version is -SNAPSHOT
9692 if : startsWith(github.ref, 'refs/tags/') == false
9793 run : |
@@ -114,7 +110,7 @@ jobs:
114110 if : startsWith(github.ref, 'refs/tags/')
115111 steps :
116112 - name : Create Release
117- uses : softprops/action-gh-release@v2
113+ uses : softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
118114 with :
119115 prerelease : true
120116 token : ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
0 commit comments