Merge pull request #37927 from apache/gcp-actions

Pin to SHA for GCP GitHub Actions

Author: Amar3tto

.github/workflows/beam_CleanUpGCPResources.yml

@@ -74,7 +74,7 @@ jobs:
         with:
           disable-cache: true
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Install gcloud bigtable cli
         run: gcloud components install cbt
       - name: run cleanup GCP resources

.github/workflows/beam_Infrastructure_PolicyEnforcer.yml

@@ -56,7 +56,7 @@ jobs:
           pip install -r requirements.txt
           
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
 
       - name: Run IAM Policy Enforcement
         working-directory: ./infra/enforcement

.github/workflows/beam_Infrastructure_SecurityLogging.yml

@@ -58,7 +58,7 @@ jobs:
           pip install -r requirements.txt
           
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
 
       - name: Initialize Log Sinks
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml

@@ -50,7 +50,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
 
       - name: Setup Python
         uses: actions/setup-python@v4

.github/workflows/beam_Infrastructure_UsersPermissions.yml

@@ -49,7 +49,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.merged == true && github.base_ref || github.event.pull_request.head.sha }}
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Install Terraform
         uses: hashicorp/setup-terraform@v3
         with:

.github/workflows/beam_Playground_Precommit.yml

@@ -75,7 +75,7 @@ jobs:
           sudo apt-get install sbt --yes
           sudo wget https://codeload.github.com/spotify/scio.g8/zip/7c1ba7c1651dfd70976028842e721da4107c0d6d -O scio.g8.zip && unzip scio.g8.zip && sudo mv scio.g8-7c1ba7c1651dfd70976028842e721da4107c0d6d /opt/scio.g8
       - name: Set up Cloud SDK and its components
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
         with:
           install_components: 'beta,cloud-datastore-emulator'
           version: '${{ env.DATASTORE_EMULATOR_VERSION }}'

.github/workflows/beam_PostCommit_Python_Arm.yml

@@ -84,12 +84,12 @@ jobs:
           sudo curl -L https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
           sudo chmod +x /usr/local/bin/docker-compose
       - name: Authenticate on GCP
-        uses: google-github-actions/auth@v3.0.0
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
           credentials_json: ${{ secrets.GCP_SA_KEY }}
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
       - name: GCloud Docker credential helper

.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow.yml

@@ -80,12 +80,12 @@ jobs:
           java-version: default
           python-version: ${{ matrix.python_version }}
       - name: Authenticate to GCP
-        uses: google-github-actions/auth@v3.0.0
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
           credentials_json: ${{ secrets.GCP_SA_KEY }}
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Configure Docker auth for GCR
         run: |
           gcloud --quiet auth configure-docker us.gcr.io

.github/workflows/beam_PostCommit_Python_ValidatesContainer_Dataflow_With_RC.yml

@@ -82,12 +82,12 @@ jobs:
           java-version: default
           python-version: ${{ matrix.python_version }}
       - name: Authenticate to GCP
-        uses: google-github-actions/auth@v3.0.0
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
         with:
           service_account: ${{ secrets.GCP_SA_EMAIL }}
           credentials_json: ${{ secrets.GCP_SA_KEY }}
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Set PY_VER_CLEAN
         id: set_py_ver_clean
         run: |

.github/workflows/beam_PostCommit_Yaml_Xlang_Direct.yml

@@ -76,7 +76,7 @@ jobs:
           python-version: default
           java-version: '11'
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v3.0.1
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: run PostCommit Yaml Xlang Direct script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with: