Skip to content

build(deps): Bump the actions group across 1 directory with 7 updates #2004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): Bump the actions group across 1 directory with 7 updates #2004

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 33 additions & 33 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ jobs:
run: products/identifiers/scripts/generate.py --check-references

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -272,7 +272,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install pinned coverage tool
uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
with:
tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}

Expand All @@ -298,7 +298,7 @@ jobs:

- name: Stage platform coverage for trusted upload
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: platform-coverage
path: target/platform-coverage/platform.lcov
Expand All @@ -319,7 +319,7 @@ jobs:
id-token: write
steps:
- name: Download platform coverage
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the coverage gate's download-action pin

The release-tool job runs release/scripts/check-gates-inventory.py, whose platform_coverage_upload_violations() still requires the previous actions/download-artifact SHA at release/scripts/check-gates-inventory.py:1609. With this new pin, that gate reports Platform coverage OIDC permission isolation and exits unsuccessfully; update the gate's expected SHA alongside the workflow.

Useful? React with 馃憤聽/ 馃憥.

with:
name: platform-coverage
path: target/platform-coverage
Expand Down Expand Up @@ -405,7 +405,7 @@ jobs:
workspaces: products/platform/fuzz -> target

- name: Install pinned cargo-fuzz
uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -417,7 +417,7 @@ jobs:

- name: Upload fuzz failures
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: platform-fuzz-${{ matrix.group }}
path: |
Expand Down Expand Up @@ -463,7 +463,7 @@ jobs:
workspaces: products/evidence/fuzz -> target

- name: Install pinned cargo-fuzz
uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -475,7 +475,7 @@ jobs:

- name: Upload fuzz failures
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: evidence-fuzz-${{ matrix.group }}
path: |
Expand Down Expand Up @@ -504,13 +504,13 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install cargo-deny
uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2.87.27
with:
tool: cargo-deny@0.19.8

- name: Install uv
if: needs.changes.outputs.release_tool != 'true'
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -677,7 +677,7 @@ jobs:
run: products/evidence/scripts/check-verifier-portability.sh

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand All @@ -701,7 +701,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the Discovery workflow pin assertion

The always-run CI classifier suite also has test_discovery_contracts_pins_node_for_the_tutorial_runner, which still requires the previous setup-node SHA at .github/scripts/test_ci_changes.py:2415. Changing this line without updating that assertion causes the suite, and consequently the changes job, to fail.

Useful? React with 馃憤聽/ 馃憥.

with:
node-version: 24.11.0
cache: npm
Expand All @@ -715,7 +715,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -939,7 +939,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -982,7 +982,7 @@ jobs:
cache-targets: false
save-if: ${{ github.ref == 'refs/heads/main' }}
- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1070,7 +1070,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1116,7 +1116,7 @@ jobs:
cache-targets: false
save-if: ${{ github.ref == 'refs/heads/main' }}
- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1253,7 +1253,7 @@ jobs:

- name: Install uv
if: matrix.lane != 'immediate-actions'
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the BReg workflow pin assertion

The always-run Test CI classifier step executes .github/scripts/test_ci_changes.py, but test_breg_contracts_pin_postgresql_and_use_the_product_entry_points still asserts that this BReg job contains the old setup-uv SHA at line 2390. This bump therefore makes the classifier suite fail until that assertion is updated.

Useful? React with 馃憤聽/ 馃憥.

with:
version: "0.11.16"

Expand Down Expand Up @@ -1483,7 +1483,7 @@ jobs:
run: cargo test --locked -p registry-breg-mcp -p registry-breg-review --features registry-breg-mcp/schema,registry-breg-review/schema --lib schema::tests

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1603,7 +1603,7 @@ jobs:
submodules: false

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1786,7 +1786,7 @@ jobs:
submodules: false

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -1844,7 +1844,7 @@ jobs:
[[ "$(uname -m)" == "x86_64" ]]

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -1972,7 +1972,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand All @@ -1986,7 +1986,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -2088,7 +2088,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -2180,7 +2180,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -2251,7 +2251,7 @@ jobs:
save-if: ${{ github.ref == 'refs/heads/main' }}

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -2290,7 +2290,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0

Expand All @@ -2311,7 +2311,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -2405,7 +2405,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -2461,7 +2461,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -2504,7 +2504,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
# The napi-rs CLI's toolchain dependencies require Node 24.12 or
# later. Candidate package smoke tests separately retain the Node
Expand Down Expand Up @@ -2598,7 +2598,7 @@ jobs:
cache: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
with:
node-version: 24.21.0
cache: npm
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,13 +38,13 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Initialize CodeQL
uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
queries: security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
with:
category: "/language:${{ matrix.language }}"
4 changes: 2 additions & 2 deletions .github/workflows/docs-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ jobs:
} >> "${GITHUB_OUTPUT}"

- name: Install uv
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
with:
version: "0.11.16"

Expand Down Expand Up @@ -193,7 +193,7 @@ jobs:
"https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@refs/heads/main"

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24.11.0
cache: npm
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/evidence-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,7 +197,7 @@ jobs:
done

- name: Upload native Evidence development binaries
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: evidence-dev-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
path: development-platform
Expand Down Expand Up @@ -258,7 +258,7 @@ jobs:
cache: false

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 24.11.0
cache: npm
Expand Down Expand Up @@ -511,7 +511,7 @@ jobs:
node smoke.js

- name: Upload Evidence development client packages
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: evidence-dev-clients-${{ matrix.asset }}-${{ github.run_id }}-${{ github.run_attempt }}
path: development-clients
Expand Down Expand Up @@ -539,7 +539,7 @@ jobs:
submodules: false

- name: Download exact native binaries and client packages
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
pattern: evidence-dev-*-${{ github.run_id }}-${{ github.run_attempt }}
path: development-inputs
Expand Down Expand Up @@ -606,7 +606,7 @@ jobs:
done

- name: Upload exact Evidence development assets
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }}
path: development-assets
Expand All @@ -625,7 +625,7 @@ jobs:
contents: write
steps:
- name: Download exact assembled development assets
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: evidence-dev-assets-${{ github.run_id }}-${{ github.run_attempt }}
path: development-assets
Expand Down
Loading
Loading