diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7aa06d00a..9326d68b1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,7 +49,7 @@ jobs: # Depth 2 covers normal single-commit pushes and pull request merge # parents; the script fetches the base commit for larger push ranges. # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 2 persist-credentials: false @@ -131,13 +131,13 @@ jobs: needs.detect-changes.outputs.automation_lint == 'true' steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Go for actionlint # actions/setup-go v6.4.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: '1.25.x' cache: false @@ -186,7 +186,7 @@ jobs: needs.detect-changes.outputs.go_lint == 'true' steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -204,13 +204,13 @@ jobs: needs.detect-changes.outputs.js_lint == 'true' steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Node.js # actions/setup-node v6.4.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 with: node-version: '22' @@ -226,7 +226,7 @@ jobs: needs.detect-changes.outputs.lua_lint == 'true' steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -242,7 +242,7 @@ jobs: needs.detect-changes.outputs.go_tests == 'true' steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2abe50908..2242f68e9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,7 +37,7 @@ jobs: javascript_typescript: ${{ steps.detect.outputs.javascript_typescript }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: # Keep normal runs shallow; the detect step fetches older bases only # when a larger push range needs them. @@ -126,14 +126,14 @@ jobs: steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Initialize CodeQL # github/codeql-action v4.36.2 # yamllint disable-line rule:line-length - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 with: languages: go # Path filters live in CodeQL config, not workflow event filters. @@ -142,12 +142,12 @@ jobs: - name: Autobuild # github/codeql-action v4.36.2 # yamllint disable-line rule:line-length - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 - name: Perform CodeQL Analysis # github/codeql-action v4.36.2 # yamllint disable-line rule:line-length - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 with: # Keep separate code scanning result categories for each language. category: "/language:go" @@ -166,14 +166,14 @@ jobs: steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Initialize CodeQL # github/codeql-action v4.36.2 # yamllint disable-line rule:line-length - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 with: languages: javascript-typescript # Path filters live in CodeQL config, not workflow event filters. @@ -182,7 +182,7 @@ jobs: - name: Perform CodeQL Analysis # github/codeql-action v4.36.2 # yamllint disable-line rule:line-length - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 with: # Keep separate code scanning result categories for each language. category: "/language:javascript-typescript" diff --git a/.github/workflows/docker-package.yml b/.github/workflows/docker-package.yml index 48c1d0058..88062b461 100644 --- a/.github/workflows/docker-package.yml +++ b/.github/workflows/docker-package.yml @@ -32,7 +32,7 @@ jobs: id-token: write steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -56,11 +56,11 @@ jobs: - name: Set up Docker Buildx # docker/setup-buildx-action v4.1.0 # yamllint disable-line rule:line-length - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c - name: Log in to the Container registry ${{ env.REGISTRY }} # docker/login-action v4.2.0 - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -69,7 +69,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta # docker/metadata-action v6.1.0 - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -81,7 +81,7 @@ jobs: - name: Build and push Docker image id: push # docker/build-push-action v7.2.0 - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a with: context: . push: true @@ -96,7 +96,7 @@ jobs: - name: Generate artifact attestation # actions/attest-build-provenance v4.1.0 # yamllint disable-line rule:line-length - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml index 1f65f545f..b1855dbf6 100644 --- a/.github/workflows/prerelease.yml +++ b/.github/workflows/prerelease.yml @@ -31,7 +31,7 @@ jobs: binary_version: ${{ steps.meta.outputs.binary_version }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -58,7 +58,7 @@ jobs: contents: read steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -98,7 +98,7 @@ jobs: RELEASE_TARGET_ASSET: ${{ matrix.asset }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -134,7 +134,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -169,7 +169,7 @@ jobs: - name: Attest release assets # actions/attest-build-provenance v4.1.0 # yamllint disable-line rule:line-length - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 with: subject-path: ${{ steps.release-assets.outputs.attestation_paths }} diff --git a/.github/workflows/stable-release.yml b/.github/workflows/stable-release.yml index 7e6302af0..ebdeb5409 100644 --- a/.github/workflows/stable-release.yml +++ b/.github/workflows/stable-release.yml @@ -36,7 +36,7 @@ jobs: binary_version: ${{ steps.meta.outputs.binary_version }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -91,7 +91,7 @@ jobs: contents: read steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -131,7 +131,7 @@ jobs: RELEASE_TARGET_ASSET: ${{ matrix.asset }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -169,7 +169,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -225,7 +225,7 @@ jobs: - name: Attest release assets # actions/attest-build-provenance v4.1.0 # yamllint disable-line rule:line-length - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 with: subject-path: ${{ steps.release-assets.outputs.attestation_paths }} diff --git a/.github/workflows/update-go-toolchain.yml b/.github/workflows/update-go-toolchain.yml index 62b1ca12b..9db258d27 100644 --- a/.github/workflows/update-go-toolchain.yml +++ b/.github/workflows/update-go-toolchain.yml @@ -24,7 +24,7 @@ jobs: PR_BRANCH: automation/update-go-toolchain steps: # actions/checkout v6.0.3 - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false @@ -86,7 +86,7 @@ jobs: - name: Set up Go if: steps.detect.outputs.changed == 'true' # actions/setup-go v6.4.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: ${{ steps.detect.outputs.version }} cache: true