From 9845a4fbf04f718822a595a8182c4cee03c80159 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 03:28:01 +0000 Subject: [PATCH] build(deps): Bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.22` | `2.87.27` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `taiki-e/install-action` from 2.87.22 to 2.87.27 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/83ac0ad63c0167e6f06796fab0fce28db1bf3db0...ab6895351a88b908e96a4697860d4ffea5e57dbe) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.87.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 66 +++++++++---------- .github/workflows/codeql.yml | 4 +- .github/workflows/docs-pages.yml | 4 +- .github/workflows/evidence-dev.yml | 12 ++-- .github/workflows/macos-contributor.yml | 4 +- .github/workflows/nightly-release.yml | 26 ++++---- .github/workflows/nightly-rust-coverage.yml | 4 +- .github/workflows/nightly-security.yml | 12 ++-- .github/workflows/release-canary.yml | 4 +- .../workflows/release-candidate-cleanup.yml | 2 +- .github/workflows/release-candidate.yml | 36 +++++----- .../workflows/release-native-benchmark.yml | 14 ++-- .github/workflows/release-rehearsal.yml | 22 +++---- .github/workflows/release-repeatability.yml | 4 +- .../workflows/release-upgrade-rehearsal.yml | 2 +- .github/workflows/release.yml | 26 ++++---- 16 files changed, 121 insertions(+), 121 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2244e31a80..e1d7c0d5e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -107,7 +107,7 @@ jobs: run: products/identifiers/scripts/generate.py --check-references - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -272,7 +272,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install pinned coverage tool - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }} @@ -298,7 +298,7 @@ jobs: - name: Stage platform coverage for trusted upload if: github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: platform-coverage path: target/platform-coverage/platform.lcov @@ -319,7 +319,7 @@ jobs: id-token: write steps: - name: Download platform coverage - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: platform-coverage path: target/platform-coverage @@ -405,7 +405,7 @@ jobs: workspaces: products/platform/fuzz -> target - name: Install pinned cargo-fuzz - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -417,7 +417,7 @@ jobs: - name: Upload fuzz failures if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: platform-fuzz-${{ matrix.group }} path: | @@ -463,7 +463,7 @@ jobs: workspaces: products/evidence/fuzz -> target - name: Install pinned cargo-fuzz - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -475,7 +475,7 @@ jobs: - name: Upload fuzz failures if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: evidence-fuzz-${{ matrix.group }} path: | @@ -504,13 +504,13 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install cargo-deny - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-deny@0.19.8 - name: Install uv if: needs.changes.outputs.release_tool != 'true' - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -677,7 +677,7 @@ jobs: run: products/evidence/scripts/check-verifier-portability.sh - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -701,7 +701,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -715,7 +715,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -939,7 +939,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -982,7 +982,7 @@ jobs: cache-targets: false save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1070,7 +1070,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1116,7 +1116,7 @@ jobs: cache-targets: false save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1253,7 +1253,7 @@ jobs: - name: Install uv if: matrix.lane != 'immediate-actions' - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1483,7 +1483,7 @@ jobs: run: cargo test --locked -p registry-breg-mcp -p registry-breg-review --features registry-breg-mcp/schema,registry-breg-review/schema --lib schema::tests - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1603,7 +1603,7 @@ jobs: submodules: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1786,7 +1786,7 @@ jobs: submodules: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -1844,7 +1844,7 @@ jobs: [[ "$(uname -m)" == "x86_64" ]] - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -1972,7 +1972,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -1986,7 +1986,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -2088,7 +2088,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -2180,7 +2180,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -2251,7 +2251,7 @@ jobs: save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -2290,7 +2290,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 @@ -2311,7 +2311,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -2405,7 +2405,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -2461,7 +2461,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.11.0 cache: npm @@ -2504,7 +2504,7 @@ jobs: submodules: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: # The napi-rs CLI's toolchain dependencies require Node 24.12 or # later. Candidate package smoke tests separately retain the Node @@ -2598,7 +2598,7 @@ jobs: cache: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 with: node-version: 24.21.0 cache: npm diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b6bec72da4..840f59f52e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,13 +38,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} queries: security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml index ea76e75ee9..a5219b81f5 100644 --- a/.github/workflows/docs-pages.yml +++ b/.github/workflows/docs-pages.yml @@ -105,7 +105,7 @@ jobs: } >> "${GITHUB_OUTPUT}" - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -193,7 +193,7 @@ jobs: "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/heads/main" - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 cache: npm diff --git a/.github/workflows/evidence-dev.yml b/.github/workflows/evidence-dev.yml index b8db487696..6c740b6f49 100644 --- a/.github/workflows/evidence-dev.yml +++ b/.github/workflows/evidence-dev.yml @@ -197,7 +197,7 @@ jobs: done - name: Upload native Evidence development binaries - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: evidence-dev-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }} path: development-platform @@ -258,7 +258,7 @@ jobs: cache: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 cache: npm @@ -511,7 +511,7 @@ jobs: node smoke.js - name: Upload Evidence development client packages - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: evidence-dev-clients-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }} path: development-clients @@ -539,7 +539,7 @@ jobs: submodules: false - name: Download exact native binaries and client packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: evidence-dev-*-${{ github.run_id }}-${{ github.run_attempt }} path: development-inputs @@ -606,7 +606,7 @@ jobs: done - name: Upload exact Evidence development assets - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }} path: development-assets @@ -625,7 +625,7 @@ jobs: contents: write steps: - name: Download exact assembled development assets - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }} path: development-assets diff --git a/.github/workflows/macos-contributor.yml b/.github/workflows/macos-contributor.yml index 5da5d3b7e6..96b72ec8f1 100644 --- a/.github/workflows/macos-contributor.yml +++ b/.github/workflows/macos-contributor.yml @@ -33,7 +33,7 @@ jobs: cache: false - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: # The napi-rs CLI's toolchain dependencies require Node 24.12 or # later, above the Node 24.11 floor the client packages declare. @@ -44,7 +44,7 @@ jobs: docs/site/package-lock.json - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" diff --git a/.github/workflows/nightly-release.yml b/.github/workflows/nightly-release.yml index d1b775f120..c6f95e37a4 100644 --- a/.github/workflows/nightly-release.yml +++ b/.github/workflows/nightly-release.yml @@ -52,7 +52,7 @@ jobs: run: python3 release/scripts/nightly_release.py plan --output nightly-plan.json - name: Retain exact nightly plan if: steps.plan.outputs.skip != 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-plan-${{ github.run_id }}-${{ github.run_attempt }} path: nightly-plan.json @@ -119,7 +119,7 @@ jobs: cp -R dist/bin shard/bin cp dist/RELEASE_BINARY_SHARD dist/RELEASE_BUILDER_IMAGE shard/ - name: Retain exact Linux shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-linux-${{ matrix.group }}-${{ github.run_id }}-${{ github.run_attempt }} path: shard @@ -169,7 +169,7 @@ jobs: --group "${BUILD_GROUP}" --purpose review_only --source-sha "${SOURCE_SHA}" \ --version "${BASE_VERSION}" --nightly-tag "${NIGHTLY_TAG}" --output shard - name: Retain exact macOS shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-macos-${{ matrix.group }}-${{ github.run_id }}-${{ github.run_attempt }} path: shard @@ -210,7 +210,7 @@ jobs: NIGHTLY_TAG: ${{ needs.select.outputs.tag }} run: bash release/scripts/build-nightly-linux-arm64.sh "${BASE_VERSION}" "${NIGHTLY_TAG}" "${SOURCE_SHA}" - name: Retain exact arm64 binaries - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-arm64-${{ github.run_id }}-${{ github.run_attempt }} path: platform @@ -232,7 +232,7 @@ jobs: persist-credentials: false submodules: false - name: Download exact Linux shards - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: pattern: nightly-linux-*-${{ github.run_id }}-${{ github.run_attempt }} path: shards @@ -271,7 +271,7 @@ jobs: printf 'ghcr.io/registrystack/%s-candidate@%s\n' "${name}" "${digest}" > "dist/images/${name}.digest" done - name: Retain canonical binaries and layouts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-canonical-${{ github.run_id }}-${{ github.run_attempt }} path: dist @@ -294,7 +294,7 @@ jobs: persist-credentials: false submodules: false - name: Download canonical images - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: nightly-canonical-${{ github.run_id }}-${{ github.run_attempt }} path: dist @@ -340,7 +340,7 @@ jobs: done - name: Retain available scan evidence, including failures if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-scans-${{ github.run_id }}-${{ github.run_attempt }} path: reports @@ -362,7 +362,7 @@ jobs: persist-credentials: false submodules: false - name: Download exact nightly inputs - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: pattern: nightly-*-${{ github.run_id }}-${{ github.run_attempt }} path: inputs @@ -387,7 +387,7 @@ jobs: --images "inputs/nightly-scans-${suffix}" --output public python3 release/scripts/nightly_release.py smoke public - name: Retain exact public payload - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: nightly-public-${{ github.run_id }}-${{ github.run_attempt }} path: public @@ -407,7 +407,7 @@ jobs: id-token: write steps: - name: Download exact public payload - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: ${{ needs.prepare.outputs.public_artifact }} path: public @@ -433,12 +433,12 @@ jobs: persist-credentials: false submodules: false - name: Download exact public payload - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: ${{ needs.attest.outputs.public_artifact }} path: public - name: Download canonical layouts for exact promotion - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: ${{ needs.images.outputs.canonical_artifact }} path: canonical diff --git a/.github/workflows/nightly-rust-coverage.yml b/.github/workflows/nightly-rust-coverage.yml index 3c7211a951..baf17e45ba 100644 --- a/.github/workflows/nightly-rust-coverage.yml +++ b/.github/workflows/nightly-rust-coverage.yml @@ -88,7 +88,7 @@ jobs: save-if: false - name: Install pinned coverage tool - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }} @@ -139,7 +139,7 @@ jobs: --output-path "${coverage_dir}/${{ matrix.name }}.lcov" - name: Upload shard coverage artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-rust-${{ matrix.name }}-coverage path: target/nightly-rust-coverage/coverage/${{ matrix.name }}.lcov diff --git a/.github/workflows/nightly-security.yml b/.github/workflows/nightly-security.yml index f3af1b60b6..48a6193ea6 100644 --- a/.github/workflows/nightly-security.yml +++ b/.github/workflows/nightly-security.yml @@ -78,7 +78,7 @@ jobs: uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 - name: Install cargo-fuzz - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -104,7 +104,7 @@ jobs: - name: Upload platform fuzz artifacts if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-platform-fuzz-artifacts path: products/platform/fuzz/artifacts @@ -130,7 +130,7 @@ jobs: uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 - name: Install cargo-fuzz - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -152,7 +152,7 @@ jobs: - name: Upload manifest fuzz artifacts if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-manifest-fuzz-artifacts path: products/manifest/fuzz/artifacts @@ -178,7 +178,7 @@ jobs: uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 - name: Install cargo-fuzz - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27 with: tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }} @@ -202,7 +202,7 @@ jobs: - name: Upload evidence fuzz artifacts if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nightly-evidence-fuzz-artifacts path: products/evidence/fuzz/artifacts diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml index 25c1285e37..ba6dc0fe7d 100644 --- a/.github/workflows/release-canary.yml +++ b/.github/workflows/release-canary.yml @@ -303,7 +303,7 @@ jobs: test -s canary/provenance-subjects.sha256 - name: Upload canary candidate - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-canary-${{ github.run_id }}-${{ github.run_attempt }} path: | @@ -320,7 +320,7 @@ jobs: canary/registry-stack-v1.2.3-candidate.tar.gz - name: Download and authenticate canary candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-canary-${{ github.run_id }}-${{ github.run_attempt }} path: canary/downloaded diff --git a/.github/workflows/release-candidate-cleanup.yml b/.github/workflows/release-candidate-cleanup.yml index d3579eb79e..ce8a0fc122 100644 --- a/.github/workflows/release-candidate-cleanup.yml +++ b/.github/workflows/release-candidate-cleanup.yml @@ -71,7 +71,7 @@ jobs: - name: Upload cleanup receipt if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-candidate-cleanup-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/release-candidate-cleanup.json diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml index e7780aa672..b553c78a16 100644 --- a/.github/workflows/release-candidate.yml +++ b/.github/workflows/release-candidate.yml @@ -55,7 +55,7 @@ jobs: submodules: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -297,7 +297,7 @@ jobs: cp dist/RELEASE_BINARY_SHARD dist/RELEASE_BUILDER_IMAGE binary-shard/ - name: Upload canonical Linux binary shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: canonical-linux-binaries-${{ matrix.group }}-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shard @@ -327,31 +327,31 @@ jobs: submodules: false - name: Download canonical Linux core binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: canonical-linux-binaries-core-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/core - name: Download canonical Linux breg binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: canonical-linux-binaries-breg-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/breg - name: Download canonical Linux Casework binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: canonical-linux-binaries-casework-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/casework - name: Download canonical Linux Scheduling binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: canonical-linux-binaries-scheduling-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/scheduling - name: Download canonical Linux Messaging binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: canonical-linux-binaries-messaging-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/messaging @@ -497,7 +497,7 @@ jobs: cp -R dist/images candidate-canonical/dist/images - name: Upload canonical build products - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: candidate-canonical-${{ github.run_id }}-${{ github.run_attempt }} path: candidate-canonical @@ -521,7 +521,7 @@ jobs: submodules: false - name: Setup Node for exact release docs archive - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 cache: npm @@ -542,7 +542,7 @@ jobs: --verify-lock - name: Upload exact release docs archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: candidate-docs-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/registry-docs-${{ needs.validate.outputs.tag }}.tar.gz @@ -696,7 +696,7 @@ jobs: release/scripts/check-glibc-floor.sh candidate-platform/platform/* - name: Upload native platform payload - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: candidate-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }} path: candidate-platform @@ -766,7 +766,7 @@ jobs: fi - name: Upload native macOS release shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: candidate-native-macos-arm64-${{ needs.validate.outputs.version }}-${{ matrix.group }}-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: candidate-native-shard @@ -826,7 +826,7 @@ jobs: cache: false - name: Setup minimum Node runtime - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 package-manager-cache: false @@ -840,7 +840,7 @@ jobs: printf 'MINIMUM_NODE_BIN=%s\n' "${minimum_node_bin}" >> "${GITHUB_ENV}" - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: # The napi-rs CLI's toolchain dependencies require Node 24.12 or # later. Package smokes independently exercise the retained minimum @@ -1334,7 +1334,7 @@ jobs: done - name: Upload native client packages - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: candidate-clients-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }} path: candidate-client-package @@ -1369,7 +1369,7 @@ jobs: submodules: false - name: Download exact build products - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: candidate-*-${{ github.run_id }}-${{ github.run_attempt }} path: inputs @@ -2076,7 +2076,7 @@ jobs: --output candidate/release-candidate-manifest.json - name: Upload one candidate manifest and bundle - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: registry-stack-release-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: | @@ -2108,7 +2108,7 @@ jobs: submodules: false - name: Download compact candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: registry-stack-release-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: candidate diff --git a/.github/workflows/release-native-benchmark.yml b/.github/workflows/release-native-benchmark.yml index eb9480227c..fb3b3d9e09 100644 --- a/.github/workflows/release-native-benchmark.yml +++ b/.github/workflows/release-native-benchmark.yml @@ -105,7 +105,7 @@ jobs: --output native-shard - name: Upload review-only native macOS shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-${{ matrix.group }}-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shard @@ -132,31 +132,31 @@ jobs: submodules: false - name: Download review-only core shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-core-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shards/core - name: Download review-only BReg shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-breg-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shards/breg - name: Download review-only bregctl shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-bregctl-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shards/bregctl - name: Download review-only Casework shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-casework-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shards/casework - name: Download review-only Scheduling shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-scheduling-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-shards/scheduling @@ -192,7 +192,7 @@ jobs: PY - name: Upload merged review-only native benchmark - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-native-benchmark-${{ needs.validate.outputs.version }}-merged-${{ needs.validate.outputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: native-benchmark diff --git a/.github/workflows/release-rehearsal.yml b/.github/workflows/release-rehearsal.yml index 7cd01fddd9..9eaca006cb 100644 --- a/.github/workflows/release-rehearsal.yml +++ b/.github/workflows/release-rehearsal.yml @@ -95,7 +95,7 @@ jobs: --root . - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 cache: npm @@ -106,7 +106,7 @@ jobs: run: npm ci - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -173,7 +173,7 @@ jobs: cp dist/RELEASE_BINARY_SHARD dist/RELEASE_BUILDER_IMAGE binary-shard/ - name: Upload canonical Linux binary shard - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-rehearsal-binaries-${{ matrix.group }}-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shard @@ -213,31 +213,31 @@ jobs: submodules: false - name: Download canonical Linux core binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-rehearsal-binaries-core-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/core - name: Download canonical Linux breg binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-rehearsal-binaries-breg-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/breg - name: Download canonical Linux Casework binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-rehearsal-binaries-casework-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/casework - name: Download canonical Linux Scheduling binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-rehearsal-binaries-scheduling-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/scheduling - name: Download canonical Linux Messaging binary shard - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-rehearsal-binaries-messaging-${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }} path: binary-shards/messaging @@ -417,7 +417,7 @@ jobs: - name: Upload advisory review evidence if: ${{ inputs.advisory_evidence }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-advisory-evidence-${{ inputs.version }}-${{ inputs.request_id }} path: ${{ runner.temp }}/release-advisory-evidence @@ -460,7 +460,7 @@ jobs: cache: false - name: Setup minimum Node runtime - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.11.0 package-manager-cache: false @@ -474,7 +474,7 @@ jobs: printf 'MINIMUM_NODE_BIN=%s\n' "${minimum_node_bin}" >> "${GITHUB_ENV}" - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.21.0 cache: npm diff --git a/.github/workflows/release-repeatability.yml b/.github/workflows/release-repeatability.yml index a69eb46424..a8e7cdbcdf 100644 --- a/.github/workflows/release-repeatability.yml +++ b/.github/workflows/release-repeatability.yml @@ -145,7 +145,7 @@ jobs: source/release/scripts/build-release-binaries.sh "${VERSION}" - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" @@ -326,7 +326,7 @@ jobs: }' > proof/release-repeatability-result.json - name: Upload 30-day repeatability evidence - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-repeatability-${{ steps.release.outputs.tag }}-${{ github.run_id }}-${{ github.run_attempt }} path: | diff --git a/.github/workflows/release-upgrade-rehearsal.yml b/.github/workflows/release-upgrade-rehearsal.yml index 76ac40e4f2..3c50a79621 100644 --- a/.github/workflows/release-upgrade-rehearsal.yml +++ b/.github/workflows/release-upgrade-rehearsal.yml @@ -59,7 +59,7 @@ jobs: cosign-release: v3.0.6 - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: "0.11.16" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f524a887a2..52c4aa5c1e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -354,7 +354,7 @@ jobs: echo "state=${state}" >> "${GITHUB_OUTPUT}" - name: Upload verified promotion input - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion/candidate @@ -390,7 +390,7 @@ jobs: submodules: false - name: Download verified promotion input - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion @@ -573,7 +573,7 @@ jobs: cp "${RUNNER_TEMP}/staged-draft.json" contract/draft-release.json - name: Upload draft reconciliation contract - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-draft-contract-${{ github.run_id }} path: contract @@ -602,13 +602,13 @@ jobs: submodules: false - name: Download verified candidate and draft contract - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion - name: Download exact draft contract - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-draft-contract-${{ github.run_id }} path: contract @@ -765,13 +765,13 @@ jobs: submodules: false - name: Download exact candidate and staged draft contract - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion - name: Download exact staged draft contract - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-draft-contract-${{ github.run_id }} path: contract @@ -968,7 +968,7 @@ jobs: | jq -s 'sort_by(.name)' > contract/final-assets.json - name: Upload final reconciliation contract - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-final-contract-${{ github.run_id }} path: contract @@ -1002,13 +1002,13 @@ jobs: contents: write steps: - name: Download exact candidate manifest - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion - name: Download exact final contract - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-final-contract-${{ github.run_id }} path: contract @@ -1289,7 +1289,7 @@ jobs: submodules: false - name: Download exact verified candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion @@ -1308,7 +1308,7 @@ jobs: fi - name: Setup trusted npm publisher runtime - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24.21.0 registry-url: https://registry.npmjs.org @@ -1455,7 +1455,7 @@ jobs: submodules: false - name: Download exact verified candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-promotion-input-${{ github.run_id }} path: promotion