ci: Bump actions versions and pin them to SHAs

[yiannistri]

What changed?

Bumped the following:

• actions/checkout@v3 to v4.1.1
• actions/setup-go@v4 to v4.1.0
• docker/[email protected] to v3.0.0
• docker/[email protected] to v5.0.0
• docker/[email protected] to v5.0.0

Following best practices guidance from https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

• Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps.
• Has Tests included if any functionality added or changed.
• Has an Example if the change requires configuration to use.
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings).
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release.

For new Generators the above notes apply, with the following additional items:

• The Generator has been added to the Matrix generator's GitOpsSetNestedGenerator, this should be done by default unless there's some reason it doesn't work.
• The Generator has been added to the list of configurable Generators, if you do not, the generator cannot be enabled!
• If the Generator depends on Kubernetes resources, a Watch has been added to track changes to the resources in the controller.

Release Notes

NONE

[bigkevmcd]

Do we need to pin these to SHAs?

[yiannistri]

@bigkevmcd I went for the safer option for now but if you think this is overkill because certain creators can be trusted, I can change it to use tags.

[bigkevmcd]

@bigkevmcd I went for the safer option for now but if you think this is overkill because certain creators can be trusted, I can change it to use tags.

So, introducing SHAs adds a cost, because we need to bump the SHAs.

We haven't done a security audit of the versions we're running just now, and we're using the GitHub and Docker actions...which should be fairly safe?

[yiannistri]

Indeed, I've been looking at our (frequently updated) repos with the aim to create a list of the Actions we use and audit them. By audit, I mean that I have reviewed their code to ensure that they handle tokens/credentials safely. My primary concern was third-party actions by individual contributors but I've gone through all of them in https://www.notion.so/weaveworks/GitHub-Actions-audit-3acd71371d5642d4aa35c5db204b23d6 .

Regarding bumping the SHAs, what do you think about configuring dependabot to do that for us? Would that alleviate your concern?

[bigkevmcd]

Regarding bumping the SHAs, what do you think about configuring dependabot to do that for us? Would that alleviate your concern?

Yes! way better idea!

I just don't want us to pay to update all of them over and over.

I'm not entirely convinced that we need SHAs, but dependabot will do.

[bigkevmcd]

Thanks!