From a5eac5c245e1b719775ea5a5e6c406f4ab2d9438 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Aug 2026 10:41:33 +0000 Subject: [PATCH 1/2] ci: bump the github-actions group across 1 directory with 4 updates Bumps the github-actions group with 4 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [actions/setup-python](https://github.com/actions/setup-python) and [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `astral-sh/setup-uv` from 94527f2e458b27549849d47d273a16bec83a01e9 to 37802adc94f370d6bfd71619e3f0bf239e1f3b78 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/94527f2e458b27549849d47d273a16bec83a01e9...37802adc94f370d6bfd71619e3f0bf239e1f3b78) Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `actions/setup-node` from 6.5.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/249970729cb0ef3589644e2896645e5dc5ba9c38...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 37802adc94f370d6bfd71619e3f0bf239e1f3b78 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/docker-publish.yml | 2 +- .github/workflows/graph-pages.yml | 2 +- .github/workflows/security.yml | 2 +- .github/workflows/tests.yml | 16 ++++++++-------- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 6cf1db3..ad6d8f3 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -90,7 +90,7 @@ jobs: - name: Upload immutable image identity if: github.event_name != 'pull_request' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: image-release-${{ github.sha }} path: image-release.json diff --git a/.github/workflows/graph-pages.yml b/.github/workflows/graph-pages.yml index 590a01e..819fd82 100644 --- a/.github/workflows/graph-pages.yml +++ b/.github/workflows/graph-pages.yml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7 + - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: '0.12.0' diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 076d578..ccee69c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -84,7 +84,7 @@ jobs: - name: Upload Trivy result if: ${{ always() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: trivy-${{ github.sha }} path: trivy-results-*.json diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 75a7e76..2b81d5a 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -22,12 +22,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.11' - name: Set up uv - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: '0.10.9' @@ -57,7 +57,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: # Mirror the runtime version shipped in the Docker image. python-version: '3.11' @@ -104,7 +104,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.11' cache: pip @@ -129,7 +129,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: # Mirror the runtime version shipped in the Docker image. python-version: '3.11' @@ -155,7 +155,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.11' cache: pip @@ -168,7 +168,7 @@ jobs: python -m pip install --require-hashes -r requirements-test.txt - name: Set up Node.js - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '22' cache: npm @@ -190,7 +190,7 @@ jobs: - name: Upload browser failure evidence if: failure() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: browser-e2e-failure path: test-results/ From cb384b1032bbcfd415abbc45625fe925591f5430 Mon Sep 17 00:00:00 2001 From: bifrost0x Date: Sun, 2 Aug 2026 14:44:21 +0200 Subject: [PATCH 2/2] ci: approve updated action pins --- tests/test_supply_chain_policy.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/test_supply_chain_policy.py b/tests/test_supply_chain_policy.py index aa67a39..cec9a14 100644 --- a/tests/test_supply_chain_policy.py +++ b/tests/test_supply_chain_policy.py @@ -20,16 +20,16 @@ 'v5', ), 'actions/setup-node': ( - '249970729cb0ef3589644e2896645e5dc5ba9c38', - 'v6', + '820762786026740c76f36085b0efc47a31fe5020', + 'v7.0.0', ), 'actions/setup-python': ( - 'ece7cb06caefa5fff74198d8649806c4678c61a1', - 'v6', + '5fda3b95a4ea91299a34e894583c3862153e4b97', + 'v7.0.0', ), 'actions/upload-artifact': ( - 'ea165f8d65b6e75b540449e92b4886f43607fa02', - 'v4', + '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', + 'v7.0.1', ), 'actions/upload-pages-artifact': ( 'fc324d3547104276b827a68afc52ff2a11cc49c9', @@ -44,7 +44,7 @@ 'v0.36.0', ), 'astral-sh/setup-uv': ( - '94527f2e458b27549849d47d273a16bec83a01e9', + '37802adc94f370d6bfd71619e3f0bf239e1f3b78', 'v7', ), 'docker/build-push-action': (