Update workflows (#1307)

* Update workflows

* Update workflow

Author: andresmgot

.github/workflows/check-grafana-compatibility.yml

@@ -14,30 +14,34 @@ jobs:
   buildPR:
     name: Build PR
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
+        persist-credentials: false
         path: './grafana-plugin-sdk-go'
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
+        persist-credentials: false
         repository: 'grafana/grafana'
         path: './grafana'
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # 5.3.0
       with:
         cache: false
         go-version: '~1.22'
         check-latest: true
 
     - name: Check if branch exists in Grafana
       working-directory: './grafana'
+      env:
+        BRANCH: ${{ github.head_ref }}
       run: |
-        if git ls-remote --heads --quiet --exit-code origin ${{ github.head_ref }}
-        then
-          echo "Found branch ${{ github.head_ref }} in Grafana"
-          git fetch origin ${{ github.head_ref }}
-          git checkout ${{ github.head_ref }}
+        if git ls-remote --heads --quiet --exit-code origin "$BRANCH"; then
+          echo "Found branch $BRANCH in Grafana"
+          git fetch origin "$BRANCH" && git checkout "$BRANCH"
         else
-          echo "Branch ${{ github.head_ref }} not found in Grafana"
+          echo "Branch $BRANCH not found in Grafana"
         fi
 
     - name: Link sdk

.github/workflows/check-incompatibility.yml

@@ -14,11 +14,14 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
+        persist-credentials: false
         path: './grafana-plugin-sdk-go'
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # 5.3.0
       with:
         cache: false
         check-latest: true

.github/workflows/ci.yml

@@ -18,24 +18,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # 5.3.0
         with:
           go-version-file: ./go.mod
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
         with:
-          version: ${{env.GOLANGCI_LINT_VERSION}}
+          version: ${GOLANGCI_LINT_VERSION}
           args: |
             "./..." --timeout=7m
           skip-cache: true
           install-mode: binary
 
       - name: Setup Mage
-        uses: magefile/mage-action@v3
+        uses: magefile/mage-action@6f50bbb8ea47d56e62dee92392788acbc8192d0b # v3
         with:
           install-only: true
 

.github/workflows/stale.yml

@@ -9,7 +9,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
         with:
           # Number of days of inactivity before a stale Issue or Pull Request is closed.
           # Set to -1 to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.

.github/workflows/validate-protos.yml

@@ -12,13 +12,17 @@ on:
 jobs:
   main:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       # Run `git checkout`
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       # Install the `buf` CLI
-      - uses: bufbuild/buf-setup-action@v1
+      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
       # Perform breaking change detection against the `proto` directory in the `main` branch
-      - uses: bufbuild/buf-breaking-action@v1
+      - uses: bufbuild/buf-breaking-action@c57b3d842a5c3f3b454756ef65305a50a587c5ba # v1.1.4
         with:
           input: 'proto'
           against: 'https://github.com/grafana/grafana-plugin-sdk-go.git#branch=main,subdir=proto'