From f529bd264a8bb31d27242295c555f2078ab9846a Mon Sep 17 00:00:00 2001 From: qubeena07 Date: Fri, 17 Jul 2026 18:08:00 -0500 Subject: [PATCH] fix(ci): bump pinned actions and stop dependabot editing generated workflow yaml Dependabot kept bumping actions/checkout, actions/setup-python and actions/setup-dotnet directly inside the workflow yaml files, which put them out of sync with the pins recorded in .github/ci/actions.toml and made the Check generated workflows job fail. This updates actions.toml to checkout 7.0.0, setup-python 6.3.0 and setup-dotnet 5.4.0, regenerates policy-engine-ci.yml from that source, and applies the same pins across every other workflow file that references those actions so everything matches again. It also adds an ignore list to the github actions block in dependabot.yml so those five actions can only be bumped by updating actions.toml and regenerating, which is what actually caused this failure in the first place. --- .github/ci/actions.toml | 12 ++--- .github/dependabot.yml | 11 ++++ .github/workflows/ai-contributor-guide.yml | 4 +- .github/workflows/ai-owasp-compliance.yml | 2 +- .github/workflows/ai-pr-review.yml | 2 +- .github/workflows/ai-release-notes.yml | 2 +- .github/workflows/ai-repo-health.yml | 2 +- .github/workflows/ai-security-scan.yml | 2 +- .github/workflows/ai-spec-drafter.yml | 2 +- .github/workflows/benchmarks.yml | 4 +- .github/workflows/cflite.yml | 4 +- .github/workflows/ci-generation-check.yml | 4 +- .github/workflows/ci.yml | 54 +++++++++---------- .github/workflows/codeql.yml | 2 +- .github/workflows/contributor-check.yml | 2 +- .github/workflows/dco.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/docs-quality.yml | 12 ++--- .github/workflows/docs.yml | 4 +- .github/workflows/license-check.yml | 2 +- .github/workflows/license-headers.yml | 4 +- .github/workflows/policy-engine-ci.yml | 12 ++--- .github/workflows/policy-validation.yml | 10 ++-- .github/workflows/publish-containers.yml | 2 +- .github/workflows/publish.yml | 12 ++--- .github/workflows/quality-gates.yml | 10 ++-- .github/workflows/sbom-diff-comment.yml | 4 +- .github/workflows/sbom-diff.yml | 4 +- .github/workflows/sbom.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanning.yml | 2 +- .github/workflows/spell-check.yml | 2 +- .github/workflows/supply-chain-check.yml | 26 ++++----- .../workflows/sync-atr-community-rules.yml | 4 +- .github/workflows/v4-removal-ratchet.yml | 4 +- .github/workflows/weekly-security-audit.yml | 22 ++++---- .github/workflows/workflow-lint.yml | 8 +-- 37 files changed, 136 insertions(+), 125 deletions(-) diff --git a/.github/ci/actions.toml b/.github/ci/actions.toml index 66fcc78d3..37c6e74e1 100644 --- a/.github/ci/actions.toml +++ b/.github/ci/actions.toml @@ -7,20 +7,20 @@ # when an entry is not pinned to a 40 character SHA. [checkout] -uses = "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" -comment = "v6.0.3" +uses = "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" +comment = "v7.0.0" [setup-python] -uses = "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405" -comment = "v6.2.0" +uses = "actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1" +comment = "v6.3.0" [setup-node] uses = "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" comment = "v6.4.0" [setup-dotnet] -uses = "actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2" -comment = "v5.3.0" +uses = "actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1" +comment = "v5.4.0" [rust-toolchain] uses = "dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8" diff --git a/.github/dependabot.yml b/.github/dependabot.yml index af8cab451..7f67b136b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -131,6 +131,11 @@ updates: - "dependencies" # GitHub Actions + # Actions pinned via .github/ci/actions.toml are excluded below: Dependabot + # bumping these directly in workflow YAML diverges from that source of + # truth and breaks the "Check generated workflows" CI job (see #3357). + # Bump these by updating .github/ci/actions.toml and re-running + # scripts/ci/generate_workflows.py --write instead. - package-ecosystem: "github-actions" directory: "/" schedule: @@ -138,3 +143,9 @@ updates: open-pull-requests-limit: 5 labels: - "dependencies" + ignore: + - dependency-name: "actions/checkout" + - dependency-name: "actions/setup-python" + - dependency-name: "actions/setup-node" + - dependency-name: "actions/setup-dotnet" + - dependency-name: "dtolnay/rust-toolchain" diff --git a/.github/workflows/ai-contributor-guide.yml b/.github/workflows/ai-contributor-guide.yml index 66792088b..40e2e4ef4 100644 --- a/.github/workflows/ai-contributor-guide.yml +++ b/.github/workflows/ai-contributor-guide.yml @@ -38,7 +38,7 @@ jobs: # It only checks out the base branch for the composite action, and context # is fetched via GitHub API. Permissions are scoped to minimum needed. steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # SECURITY: pull_request_target defaults to base branch checkout (safe). # SECURITY: base-only checkout required for pull_request_target context. @@ -88,7 +88,7 @@ jobs: if: github.event.pull_request.head.repo.full_name != github.repository run: echo "::notice::Running on fork PR — composite action resolved from base branch (safe)" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # SECURITY: pull_request_target defaults to base branch checkout (safe). # SECURITY: base-only checkout required for pull_request_target context. diff --git a/.github/workflows/ai-owasp-compliance.yml b/.github/workflows/ai-owasp-compliance.yml index a4e13a288..c72b21b05 100644 --- a/.github/workflows/ai-owasp-compliance.yml +++ b/.github/workflows/ai-owasp-compliance.yml @@ -23,7 +23,7 @@ jobs: name: OWASP Agentic Top 10 Audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/ai-pr-review.yml b/.github/workflows/ai-pr-review.yml index 5f0371a11..522baf736 100644 --- a/.github/workflows/ai-pr-review.yml +++ b/.github/workflows/ai-pr-review.yml @@ -173,7 +173,7 @@ jobs: if: github.event.pull_request.head.repo.full_name != github.repository run: echo "::notice::Running on fork PR -- composite action resolved from base branch (safe)" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # SECURITY: pull_request_target defaults to base branch checkout (safe). persist-credentials: false diff --git a/.github/workflows/ai-release-notes.yml b/.github/workflows/ai-release-notes.yml index 0b8dd3edd..505dce4a7 100644 --- a/.github/workflows/ai-release-notes.yml +++ b/.github/workflows/ai-release-notes.yml @@ -24,7 +24,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/ai-repo-health.yml b/.github/workflows/ai-repo-health.yml index 8bebb68ca..88217f37f 100644 --- a/.github/workflows/ai-repo-health.yml +++ b/.github/workflows/ai-repo-health.yml @@ -20,7 +20,7 @@ jobs: name: Generate Health Report runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Collect repository metrics id: metrics diff --git a/.github/workflows/ai-security-scan.yml b/.github/workflows/ai-security-scan.yml index 2c5831d22..72b871bba 100644 --- a/.github/workflows/ai-security-scan.yml +++ b/.github/workflows/ai-security-scan.yml @@ -20,7 +20,7 @@ jobs: name: Weekly Full Security Audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # SECURITY: schedule/workflow_dispatch defaults to the correct ref (safe). # SECURITY: base-only checkout required for pull_request_target context. diff --git a/.github/workflows/ai-spec-drafter.yml b/.github/workflows/ai-spec-drafter.yml index 5649995a4..03e3cd71f 100644 --- a/.github/workflows/ai-spec-drafter.yml +++ b/.github/workflows/ai-spec-drafter.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write issues: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index d317a3260..ba98ede48 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -12,8 +12,8 @@ jobs: benchmark: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" diff --git a/.github/workflows/cflite.yml b/.github/workflows/cflite.yml index c329543c5..135152ca1 100644 --- a/.github/workflows/cflite.yml +++ b/.github/workflows/cflite.yml @@ -38,7 +38,7 @@ jobs: matrix: sanitizer: [address] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Build Fuzzers id: build uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 @@ -63,7 +63,7 @@ jobs: matrix: sanitizer: [address] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Build Fuzzers id: build uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 diff --git a/.github/workflows/ci-generation-check.yml b/.github/workflows/ci-generation-check.yml index 8bee69e00..240991832 100644 --- a/.github/workflows/ci-generation-check.yml +++ b/.github/workflows/ci-generation-check.yml @@ -30,9 +30,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Verify generated workflows are up to date diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9ae08f5f1..5dbb60a4d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: changed-py-pkgs: ${{ steps.py-pkgs.outputs.list }} changed-ts-pkgs: ${{ steps.ts-pkgs.outputs.list }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 id: filter with: @@ -244,9 +244,9 @@ jobs: echo "::notice::Package $PKG unchanged on this PR — skipping lint." fi - if: steps.gate.outputs.run == 'true' - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - if: steps.gate.outputs.run == 'true' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - if: steps.gate.outputs.run == 'true' @@ -338,9 +338,9 @@ jobs: - name: Skip (unchanged package) if: steps.gate.outputs.run != 'true' run: echo "Package ${{ matrix.package }} unchanged — skipping tests" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: steps.gate.outputs.run == 'true' - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 if: steps.gate.outputs.run == 'true' with: python-version: ${{ matrix.python-version }} @@ -486,9 +486,9 @@ jobs: - name: Skip (unchanged package) if: steps.gate.outputs.run != 'true' run: echo "Package ${{ matrix.package }} unchanged — skipping wheel build" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: steps.gate.outputs.run == 'true' - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 if: steps.gate.outputs.run == 'true' with: python-version: "3.11" @@ -518,8 +518,8 @@ jobs: if: needs.changes.outputs.python == 'true' || github.event_name == 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Install safety @@ -590,8 +590,8 @@ jobs: if: needs.changes.outputs.dotnet == 'true' || github.event_name == 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: "8.0.x" - name: Build .NET SDK @@ -705,8 +705,8 @@ jobs: - package: pydantic-ai-governance import-module: pydantic_ai_governance steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Install ${{ matrix.package }} @@ -814,8 +814,8 @@ jobs: version-sync-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Check version drift @@ -825,8 +825,8 @@ jobs: dep-confusion-scan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Dependency confusion scan @@ -836,8 +836,8 @@ jobs: notebook-pip-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Notebook pip-install audit @@ -897,7 +897,7 @@ jobs: if: github.event_name == 'schedule' || needs.changes.outputs['docs-only'] == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Markdown link check @@ -917,7 +917,7 @@ jobs: if: needs.changes.outputs.workflows == 'true' || github.event_name == 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Audit pull_request_target workflows run: | echo "=== Checking pull_request_target safety ===" @@ -943,7 +943,7 @@ jobs: 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "20" @@ -1024,7 +1024,7 @@ jobs: - name: Skip (unchanged package) if: steps.gate.outputs.run != 'true' run: echo "Package ${{ matrix.name }} unchanged — skipping npm build" - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: steps.gate.outputs.run == 'true' - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 if: steps.gate.outputs.run == 'true' @@ -1070,7 +1070,7 @@ jobs: if: needs.changes.outputs.rust == 'true' || github.event_name == 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Build working-directory: agent-governance-rust @@ -1085,7 +1085,7 @@ jobs: if: needs.changes.outputs.go == 'true' || github.event_name == 'schedule' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.22" @@ -1115,7 +1115,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Diagnostic — Docker / Compose / Buildx versions run: | @@ -1201,7 +1201,7 @@ jobs: ] runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check job results env: NEEDS: ${{ toJSON(needs) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 322f31148..683c186cc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,7 +31,7 @@ jobs: matrix: language: [python, javascript-typescript] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 with: diff --git a/.github/workflows/contributor-check.yml b/.github/workflows/contributor-check.yml index ef35bf133..a1bfe50f7 100644 --- a/.github/workflows/contributor-check.yml +++ b/.github/workflows/contributor-check.yml @@ -78,7 +78,7 @@ jobs: pull-requests: write # Used by contributor-check action to post comments / labels on PRs steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false sparse-checkout: | diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index 85225d4c9..46861a667 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -12,7 +12,7 @@ jobs: name: Developer Certificate of Origin runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index bea93d69c..047c47d85 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -19,7 +19,7 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: fail-on-severity: moderate diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 9d073586a..49d92fddf 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -33,8 +33,8 @@ jobs: name: Validate relative links runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Run link checker @@ -44,8 +44,8 @@ jobs: name: Validate docs frontmatter (warn) runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Run frontmatter checker (warn-only) @@ -55,8 +55,8 @@ jobs: name: Unit tests for docs tooling runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Install pytest diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 6d6c1da76..422a503ae 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -36,9 +36,9 @@ jobs: id-token: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml index c1e78220d..f2b944e05 100644 --- a/.github/workflows/license-check.yml +++ b/.github/workflows/license-check.yml @@ -23,7 +23,7 @@ jobs: name: Check license headers on source files runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml index b54516071..694518ec6 100644 --- a/.github/workflows/license-headers.yml +++ b/.github/workflows/license-headers.yml @@ -19,10 +19,10 @@ jobs: name: Check license headers (changed files) runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Check license headers on changed files diff --git a/.github/workflows/policy-engine-ci.yml b/.github/workflows/policy-engine-ci.yml index 6a2d815cf..5d0c31f58 100644 --- a/.github/workflows/policy-engine-ci.yml +++ b/.github/workflows/policy-engine-ci.yml @@ -31,7 +31,7 @@ jobs: run: working-directory: policy-engine steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable with: @@ -65,9 +65,9 @@ jobs: run: working-directory: policy-engine steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Install Rust toolchain @@ -107,7 +107,7 @@ jobs: run: working-directory: policy-engine/sdk/node steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -139,9 +139,9 @@ jobs: run: working-directory: policy-engine/sdk/dotnet steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up .NET - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: '8.0.x' - name: Install OPA diff --git a/.github/workflows/policy-validation.yml b/.github/workflows/policy-validation.yml index 52dec83e6..32d894e5a 100644 --- a/.github/workflows/policy-validation.yml +++ b/.github/workflows/policy-validation.yml @@ -15,7 +15,7 @@ jobs: outputs: policies: ${{ steps.filter.outputs.policies }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 id: filter with: @@ -30,9 +30,9 @@ jobs: needs: changes if: needs.changes.outputs.policies == 'true' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -78,10 +78,10 @@ jobs: needs: [changes, validate-policies] if: always() && needs.validate-policies.result != 'failure' steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: needs.changes.outputs.policies == 'true' - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 if: needs.changes.outputs.policies == 'true' with: python-version: "3.11" diff --git a/.github/workflows/publish-containers.yml b/.github/workflows/publish-containers.yml index cce5e2b76..b359a7f22 100644 --- a/.github/workflows/publish-containers.yml +++ b/.github/workflows/publish-containers.yml @@ -90,7 +90,7 @@ jobs: echo "Skipping $CURRENT (selected: $SELECTED)" fi - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: steps.check.outputs.skip != 'true' - name: Set image tag diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3f93765ef..02acb63af 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -26,7 +26,7 @@ jobs: release-manifest: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Generate release manifest env: EVENT_NAME: ${{ github.event_name }} @@ -151,9 +151,9 @@ jobs: fail-fast: false matrix: ${{ fromJson(needs.resolve-python-matrix.outputs.matrix) }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -301,7 +301,7 @@ jobs: fail-fast: false matrix: ${{ fromJSON(needs.resolve-npm-matrix.outputs.matrix) }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: @@ -363,9 +363,9 @@ jobs: attestations: write environment: nuget steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 + - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: "8.0.x" diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index d8fc55310..3efd5a5b3 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -12,7 +12,7 @@ jobs: name: No Stubs/TODOs runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - env: @@ -25,7 +25,7 @@ jobs: name: No Unauthorized Crypto runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - env: @@ -38,7 +38,7 @@ jobs: name: Security Audit Required runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - env: @@ -51,7 +51,7 @@ jobs: name: No Unauthenticated Registration runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - env: @@ -67,7 +67,7 @@ jobs: contents: read pull-requests: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # Routine Dependabot patch/minor bumps cannot author an audit doc, so diff --git a/.github/workflows/sbom-diff-comment.yml b/.github/workflows/sbom-diff-comment.yml index 3bab19be5..07040716a 100644 --- a/.github/workflows/sbom-diff-comment.yml +++ b/.github/workflows/sbom-diff-comment.yml @@ -52,7 +52,7 @@ jobs: pull-requests: write steps: - name: Check out trusted tooling (default branch) - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false # Only the diff helper is needed. Sparse checkout narrows the trust @@ -74,7 +74,7 @@ jobs: - name: Set up Python if: steps.verify.outputs.skip != 'true' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" diff --git a/.github/workflows/sbom-diff.yml b/.github/workflows/sbom-diff.yml index a2b4861ef..a1d667d43 100644 --- a/.github/workflows/sbom-diff.yml +++ b/.github/workflows/sbom-diff.yml @@ -51,14 +51,14 @@ jobs: # current latest-stable release; downgrading to v4 here would diverge # from the rest of the tree without a security or compatibility reason. - name: Check out PR head - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: head ref: ${{ github.event.pull_request.head.sha }} persist-credentials: false - name: Check out PR base - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: base ref: ${{ github.event.pull_request.base.sha }} diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index af86e513b..6404037f8 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -20,7 +20,7 @@ jobs: attestations: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Generate SBOM uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 69fd5df46..6673ac4d1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,7 +18,7 @@ jobs: security-events: write id-token: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/secret-scanning.yml b/.github/workflows/secret-scanning.yml index 98d10c565..609de2934 100644 --- a/.github/workflows/secret-scanning.yml +++ b/.github/workflows/secret-scanning.yml @@ -27,7 +27,7 @@ jobs: gitleaks: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index b71f5d4b4..fbe8e3a63 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -32,7 +32,7 @@ jobs: name: Spell-check changed files runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/supply-chain-check.yml b/.github/workflows/supply-chain-check.yml index 0c26ab640..fd9a47b83 100644 --- a/.github/workflows/supply-chain-check.yml +++ b/.github/workflows/supply-chain-check.yml @@ -51,7 +51,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false @@ -87,10 +87,10 @@ jobs: timeout-minutes: 5 needs: scanner-trip-wire steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Check for unpinned npm versions @@ -152,11 +152,11 @@ jobs: timeout-minutes: 10 needs: scanner-trip-wire steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Check newly-pinned versions against 7-day rule @@ -174,11 +174,11 @@ jobs: timeout-minutes: 10 needs: scanner-trip-wire steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Audit added npm deps for install scripts @@ -196,11 +196,11 @@ jobs: timeout-minutes: 5 needs: scanner-trip-wire steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Flag setup.py and build.rs additions @@ -216,10 +216,10 @@ jobs: name: Verify lockfile hashes match upstream registries runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Resolve base ref @@ -252,14 +252,14 @@ jobs: timeout-minutes: 10 needs: scanner-trip-wire steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # Scorecard "Token-Permissions" hardening: don't leave # GITHUB_TOKEN authenticated in the worktree git config after # checkout. The job only needs read-only access to history. persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Run dependency Scorecard check diff --git a/.github/workflows/sync-atr-community-rules.yml b/.github/workflows/sync-atr-community-rules.yml index 7716ccae6..7e9b3693b 100644 --- a/.github/workflows/sync-atr-community-rules.yml +++ b/.github/workflows/sync-atr-community-rules.yml @@ -42,9 +42,9 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" diff --git a/.github/workflows/v4-removal-ratchet.yml b/.github/workflows/v4-removal-ratchet.yml index da3cc38ec..f3f93d8de 100644 --- a/.github/workflows/v4-removal-ratchet.yml +++ b/.github/workflows/v4-removal-ratchet.yml @@ -15,8 +15,8 @@ jobs: name: v4 policy-language ratchet runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Install pinned lint and test tooling diff --git a/.github/workflows/weekly-security-audit.yml b/.github/workflows/weekly-security-audit.yml index 43d08c059..b89f52da8 100644 --- a/.github/workflows/weekly-security-audit.yml +++ b/.github/workflows/weekly-security-audit.yml @@ -14,9 +14,9 @@ jobs: name: Dependency Confusion Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -55,9 +55,9 @@ jobs: name: Security Skills Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -93,7 +93,7 @@ jobs: name: Weak Cryptography Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check for MD5/SHA1 in non-test code run: | @@ -133,7 +133,7 @@ jobs: name: Workflow Security Regression Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check pull_request_target safety run: | @@ -176,7 +176,7 @@ jobs: name: Expression Injection Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check for unsafe expression interpolation run: | @@ -220,7 +220,7 @@ jobs: name: Docker & Infrastructure Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check Dockerfiles for root user run: | @@ -295,7 +295,7 @@ jobs: name: XSS & Unsafe DOM Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check for innerHTML without escaping run: | @@ -366,7 +366,7 @@ jobs: name: Action SHA Pinning Check runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check all actions are SHA-pinned run: | @@ -392,7 +392,7 @@ jobs: name: Version Pinning Compliance runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check pyproject.toml upper bounds run: | diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml index 9727d8182..96697adea 100644 --- a/.github/workflows/workflow-lint.yml +++ b/.github/workflows/workflow-lint.yml @@ -18,7 +18,7 @@ jobs: actionlint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install actionlint run: | set -euo pipefail @@ -41,7 +41,7 @@ jobs: shellcheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Run shellcheck on workflow shell env: SHELLCHECKRC: ${{ github.workspace }}/.shellcheckrc @@ -54,8 +54,8 @@ jobs: inline-script-tests: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' - name: Install pytest