From 80d3273bac672bf672423d2df14e7f1f456bb81a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 06:54:50 +0000 Subject: [PATCH] ci: bump the actions group across 1 directory with 15 updates Bumps the actions group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.4` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.4` | `4.39.1` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.2.0` | `4.4.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.1` | `4.2.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.3` | | [actions/attest](https://github.com/actions/attest) | `4.2.1` | `4.2.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.4` | `4.39.1` | Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `github/codeql-action/init` from 4.37.4 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.37.4 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `actions/deploy-pages` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346) Updates `docker/setup-qemu-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/96fe6ef7f33517b61c61be40b68a1882f3264fb8...99012661954931238ded8c8b007157a8430204e1) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `anchore/sbom-action` from 0.24.0 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `actions/attest` from 4.2.1 to 4.2.2 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/508db95dd578ae2727ebd6217d5ba78e4fbda05d...1e69f48acb82d1966a394da916b4c1698aa569d6) Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/attest dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/arm64-build-smoke.yml | 2 +- .../workflows/bpfcompat-example-hosted.yml | 2 +- .github/workflows/bpfcompat-example.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 4 +- .../compatibility-matrix-publish.yml | 4 +- .github/workflows/consumer-canary.yml | 6 +-- .../workflows/external-consumer-canary.yml | 6 +-- .github/workflows/ghcr-image.yml | 8 ++-- .github/workflows/kernel-freshness.yml | 2 +- .../workflows/latest-kernel-compatibility.yml | 4 +- .github/workflows/maintenance-evidence.yml | 22 +++++----- .github/workflows/multiarch-compatibility.yml | 2 +- .github/workflows/preprint-v1.yml | 2 +- .../workflows/profile-catalog-maintenance.yml | 2 +- .github/workflows/promote-release.yml | 4 +- .github/workflows/release-artifacts.yml | 42 +++++++++---------- .../workflows/release-candidate-canary.yml | 16 +++---- .github/workflows/research-archive-v1.yml | 2 +- .github/workflows/research-materialize-v1.yml | 2 +- .../workflows/research-paper-assets-v1.yml | 2 +- .github/workflows/research-pilot-v1.yml | 2 +- .github/workflows/research-repeat-v1.yml | 2 +- .github/workflows/rollback-drill.yml | 6 +-- .github/workflows/scholarly-release-v1.yml | 2 +- .github/workflows/scorecard.yml | 6 +-- .github/workflows/stability-gate.yml | 2 +- .../upstream-kernel-compatibility.yml | 2 +- 28 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.github/workflows/arm64-build-smoke.yml b/.github/workflows/arm64-build-smoke.yml index f23aed6f..47f7daca 100644 --- a/.github/workflows/arm64-build-smoke.yml +++ b/.github/workflows/arm64-build-smoke.yml @@ -60,7 +60,7 @@ jobs: run: go test -tags hostload ./pkg/bpfcompat/... - name: Upload arm64 validator (for multi-arch embed / release) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-validator-arm64 path: pkg/bpfcompat/validators/bpfcompat-validator-arm64 diff --git a/.github/workflows/bpfcompat-example-hosted.yml b/.github/workflows/bpfcompat-example-hosted.yml index 88715e87..76b7e0e3 100644 --- a/.github/workflows/bpfcompat-example-hosted.yml +++ b/.github/workflows/bpfcompat-example-hosted.yml @@ -121,7 +121,7 @@ jobs: - name: Upload reports if: always() && steps.changes.outputs.required == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-reports-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/bpfcompat-example.yml b/.github/workflows/bpfcompat-example.yml index 5817cc73..a2bc4c9c 100644 --- a/.github/workflows/bpfcompat-example.yml +++ b/.github/workflows/bpfcompat-example.yml @@ -55,7 +55,7 @@ jobs: - name: Upload reports if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-reports-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3d642825..b1fad798 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -195,7 +195,7 @@ jobs: - name: Enforce coverage floor run: bash scripts/check-coverage.sh coverage.out 50.0 - name: Upload coverage artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: coverage-${{ github.run_id }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a431ed65..b53f37e9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -43,7 +43,7 @@ jobs: cache: true - name: Initialize CodeQL - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: go # Go does not support build-mode: none; autobuild runs `go build`, @@ -53,7 +53,7 @@ jobs: queries: security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:go" diff --git a/.github/workflows/compatibility-matrix-publish.yml b/.github/workflows/compatibility-matrix-publish.yml index e7d45228..b54cc33f 100644 --- a/.github/workflows/compatibility-matrix-publish.yml +++ b/.github/workflows/compatibility-matrix-publish.yml @@ -178,7 +178,7 @@ jobs: - name: Upload compatibility evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-compatibility-matrix-${{ github.run_id }} if-no-files-found: warn @@ -237,4 +237,4 @@ jobs: - name: Deploy Pages if: always() && steps.evidence.outputs.publishable == 'true' && (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.deploy_pages == 'true')) - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5 diff --git a/.github/workflows/consumer-canary.yml b/.github/workflows/consumer-canary.yml index 31ba3393..3fc8b706 100644 --- a/.github/workflows/consumer-canary.yml +++ b/.github/workflows/consumer-canary.yml @@ -135,7 +135,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-stable-${{ github.run_id }} if-no-files-found: warn @@ -211,7 +211,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-prebuilt-${{ github.run_id }} if-no-files-found: warn @@ -279,7 +279,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-source-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/external-consumer-canary.yml b/.github/workflows/external-consumer-canary.yml index dca90b4d..2bc7b2b0 100644 --- a/.github/workflows/external-consumer-canary.yml +++ b/.github/workflows/external-consumer-canary.yml @@ -62,7 +62,7 @@ jobs: concurrency: "2" - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-inspektor-gadget-${{ github.run_id }} path: reports/ @@ -129,7 +129,7 @@ jobs: concurrency: "2" - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-kubearmor-${{ github.run_id }} path: reports/ @@ -189,7 +189,7 @@ jobs: test "$actual" = "$expected" - name: Upload report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: canary-falco-${{ github.run_id }} path: reports/ diff --git a/.github/workflows/ghcr-image.yml b/.github/workflows/ghcr-image.yml index 343f24e0..cd5167e0 100644 --- a/.github/workflows/ghcr-image.yml +++ b/.github/workflows/ghcr-image.yml @@ -44,10 +44,10 @@ jobs: echo "date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" } >> "$GITHUB_OUTPUT" - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -63,7 +63,7 @@ jobs: - name: Build and push id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . platforms: linux/amd64,linux/arm64 diff --git a/.github/workflows/kernel-freshness.yml b/.github/workflows/kernel-freshness.yml index edd7ec63..7af75c2a 100644 --- a/.github/workflows/kernel-freshness.yml +++ b/.github/workflows/kernel-freshness.yml @@ -95,7 +95,7 @@ jobs: - name: Upload freshness report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: kernel-freshness-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/latest-kernel-compatibility.yml b/.github/workflows/latest-kernel-compatibility.yml index 3a8efaad..ef7b9826 100644 --- a/.github/workflows/latest-kernel-compatibility.yml +++ b/.github/workflows/latest-kernel-compatibility.yml @@ -246,7 +246,7 @@ jobs: }' >reports/production-campaign.json - name: Attest campaign evidence - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: reports/production-campaign.json @@ -260,7 +260,7 @@ jobs: - name: Upload latest-kernel evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-latest-kernel-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/maintenance-evidence.yml b/.github/workflows/maintenance-evidence.yml index 9ea83aa8..5a0be26e 100644 --- a/.github/workflows/maintenance-evidence.yml +++ b/.github/workflows/maintenance-evidence.yml @@ -101,7 +101,7 @@ jobs: .checksums_sha256 == $checksums ' "$evidence" >/dev/null || { echo "::error::candidate evidence does not match the dispatch"; exit 1; } cp "$RUNNER_TEMP/maintenance-scope.json" "$candidate/" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/candidate/ @@ -114,7 +114,7 @@ jobs: timeout-minutes: 90 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: dist @@ -136,7 +136,7 @@ jobs: mkdir -p reports cp "$work"/reports/release-positive.json "$work"/reports/release-negative.json \ "$work"/reports/release-artifact-identity.json reports/ - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-vm-${{ github.run_id }}-${{ github.run_attempt }} path: reports/ @@ -152,7 +152,7 @@ jobs: - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 with: cosign-release: "v2.6.3" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/candidate @@ -175,7 +175,7 @@ jobs: cmp "$root/libexec/bpfcompat-validator" "$RUNNER_TEMP/candidate/bpfcompat-validator-static-linux-amd64" jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" \ '{check: "clean-install", status: "pass", version: $tag, commit: $commit}' >canary/clean-install.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-canary-clean-install-${{ github.run_id }}-${{ github.run_attempt }} path: canary/clean-install.json @@ -188,7 +188,7 @@ jobs: timeout-minutes: 45 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: maintenance-candidate-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/candidate @@ -228,7 +228,7 @@ jobs: mkdir -p canary jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" \ '{check: "candidate-action", status: "pass", version: $tag, commit: $commit}' >canary/candidate-action.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-canary-candidate-action-${{ github.run_id }}-${{ github.run_attempt }} path: | @@ -265,7 +265,7 @@ jobs: mkdir -p canary jq -n --arg tag "$TAG" --arg commit "$GITHUB_SHA" --arg digest "$DIGEST" \ '{check: "container", status: "pass", version: $tag, commit: $commit, digest: $digest}' >canary/container.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-canary-container-${{ github.run_id }}-${{ github.run_attempt }} path: canary/container.json @@ -282,7 +282,7 @@ jobs: attestations: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: maintenance-*-${{ github.run_id }}-${{ github.run_attempt }} path: in @@ -324,14 +324,14 @@ jobs: evidence/maintenance-evidence-input.json evidence/maintenance-evidence.json cp "$v"/release-positive.json "$v"/release-negative.json "$c/maintenance-scope.json" evidence/ - name: Attest maintenance evidence - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | evidence/maintenance-evidence.json evidence/release-positive.json evidence/release-negative.json evidence/maintenance-scope.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: maintenance-evidence-${{ inputs.milestone }}-${{ needs.bind.outputs.tag }} path: evidence/ diff --git a/.github/workflows/multiarch-compatibility.yml b/.github/workflows/multiarch-compatibility.yml index 4cba1d0c..26b2d20f 100644 --- a/.github/workflows/multiarch-compatibility.yml +++ b/.github/workflows/multiarch-compatibility.yml @@ -79,7 +79,7 @@ jobs: - name: Upload multiarch evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-${{ matrix.arch }}-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/preprint-v1.yml b/.github/workflows/preprint-v1.yml index 0f654b3d..0a18c83b 100644 --- a/.github/workflows/preprint-v1.yml +++ b/.github/workflows/preprint-v1.yml @@ -39,7 +39,7 @@ jobs: test "$pages" -ge 1 - name: Upload preprint artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-preprint-v1-${{ github.run_id }} path: | diff --git a/.github/workflows/profile-catalog-maintenance.yml b/.github/workflows/profile-catalog-maintenance.yml index 3399b021..22bb8580 100644 --- a/.github/workflows/profile-catalog-maintenance.yml +++ b/.github/workflows/profile-catalog-maintenance.yml @@ -40,7 +40,7 @@ jobs: - name: Upload catalog evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-profile-catalog-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml index d2a0f36e..599e5278 100644 --- a/.github/workflows/promote-release.yml +++ b/.github/workflows/promote-release.yml @@ -201,8 +201,8 @@ jobs: .isPrerelease == ($channel == "prerelease") ' <<<"$release_json" >/dev/null - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml index 35638f9e..d90aa457 100644 --- a/.github/workflows/release-artifacts.yml +++ b/.github/workflows/release-artifacts.yml @@ -246,7 +246,7 @@ jobs: fi sha256sum "${assets[@]}" > SHA256SUMS - name: Generate SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: path: . format: cyclonedx-json @@ -257,7 +257,7 @@ jobs: # kit, shipped as a release asset listed in SHA256SUMS. The glob also # covers the optional link-inputs and native-sources assets. if: startsWith(github.ref, 'refs/tags/v') - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | dist/bpfcompat-linux-amd64 @@ -268,14 +268,14 @@ jobs: dist/bpfcompat-validator-*.tar* - name: Attest production readiness evidence if: startsWith(github.ref, 'refs/tags/v') && steps.meta.outputs.channel == 'stable' - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | dist/production-readiness.json dist/production-readiness.md - name: Attest candidate SBOM if: startsWith(github.ref, 'refs/tags/v') - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: dist/bpfcompat-linux-amd64 sbom-path: dist/bpfcompat.sbom.cdx.json @@ -295,13 +295,13 @@ jobs: --output-signature dist/bpfcompat.sbom.cdx.sig \ --output-certificate dist/bpfcompat.sbom.cdx.crt - name: Upload candidate - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-release-${{ steps.meta.outputs.version }} path: dist/ if-no-files-found: error - name: Upload production technical evidence - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: production-tech-evidence-${{ steps.meta.outputs.version }} path: evidence/production-tech/ @@ -322,7 +322,7 @@ jobs: with: go-version: ${{ env.GO_VERSION }} cache: true - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bpfcompat-release-${{ needs.build-and-sign.outputs.version }} path: dist @@ -396,7 +396,7 @@ jobs: 757908b2fd6d5b1431bb45070fc1f56cbf017d4025568d292ece37d9cc75e812 - name: Upload release-gate evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: release-gate-evidence-${{ github.run_id }} path: | @@ -420,7 +420,7 @@ jobs: attestations: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bpfcompat-release-${{ needs.build-and-sign.outputs.version }} path: dist @@ -457,16 +457,16 @@ jobs: digest: ${{ steps.build.outputs.digest }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build candidate image id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . platforms: linux/amd64,linux/arm64 @@ -495,7 +495,7 @@ jobs: DIGEST: ${{ steps.build.outputs.digest }} run: cosign sign --yes "${IMAGE}@${DIGEST}" - name: Attest candidate image provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.IMAGE }} subject-digest: ${{ steps.build.outputs.digest }} @@ -516,11 +516,11 @@ jobs: id-token: write attestations: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bpfcompat-release-${{ needs.build-and-sign.outputs.version }} path: candidate/dist - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-gate-evidence-${{ github.run_id }} path: candidate/vm @@ -573,10 +573,10 @@ jobs: generated_at: $generated_at }' >candidate/evidence/release-candidate-evidence.json - name: Attest candidate promotion evidence - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: candidate/evidence/release-candidate-evidence.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: bpfcompat-candidate-evidence-${{ needs.build-and-sign.outputs.version }} path: candidate/evidence/release-candidate-evidence.json @@ -590,15 +590,15 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bpfcompat-release-${{ needs.build-and-sign.outputs.version }} path: dist - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bpfcompat-candidate-evidence-${{ needs.build-and-sign.outputs.version }} path: dist - - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3 + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: draft: true prerelease: ${{ needs.build-and-sign.outputs.channel == 'prerelease' }} diff --git a/.github/workflows/release-candidate-canary.yml b/.github/workflows/release-candidate-canary.yml index ffc4208f..b646b336 100644 --- a/.github/workflows/release-candidate-canary.yml +++ b/.github/workflows/release-candidate-canary.yml @@ -122,7 +122,7 @@ jobs: validator_installed: true }' >evidence/clean-install.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rc4-canary-component-clean-install-${{ github.run_id }} path: evidence/clean-install.json @@ -182,7 +182,7 @@ jobs: examples_built: true }' >evidence/source-build.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rc4-canary-component-source-build-${{ github.run_id }} path: evidence/source-build.json @@ -244,7 +244,7 @@ jobs: report_sha256: $report_sha256 }' >evidence/published-action.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rc4-canary-component-published-action-${{ github.run_id }} if-no-files-found: error @@ -260,7 +260,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 with: @@ -307,7 +307,7 @@ jobs: platforms: ["linux/amd64", "linux/arm64"] }' >evidence/container.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rc4-canary-component-container-${{ github.run_id }} path: evidence/container.json @@ -379,7 +379,7 @@ jobs: consumers: ["Inspektor Gadget", "KubeArmor", "Falco"] }' >evidence/external-consumers.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rc4-canary-component-external-consumers-${{ github.run_id }} path: evidence/external-consumers.json @@ -397,7 +397,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: rc4-canary-component-*-${{ github.run_id }} path: evidence/components @@ -454,7 +454,7 @@ jobs: }' >evidence/release-candidate-canary.json jq . evidence/release-candidate-canary.json >>"$GITHUB_STEP_SUMMARY" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: release-candidate-canary-${{ needs.plan.outputs.milestone }}-${{ github.run_id }} path: evidence/** diff --git a/.github/workflows/research-archive-v1.yml b/.github/workflows/research-archive-v1.yml index c9c0d767..54b0c6c9 100644 --- a/.github/workflows/research-archive-v1.yml +++ b/.github/workflows/research-archive-v1.yml @@ -75,7 +75,7 @@ jobs: - name: Upload release-shaped archive if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: research-archive-v1-${{ github.run_id }} retention-days: 14 diff --git a/.github/workflows/research-materialize-v1.yml b/.github/workflows/research-materialize-v1.yml index 5df872d4..eb115243 100644 --- a/.github/workflows/research-materialize-v1.yml +++ b/.github/workflows/research-materialize-v1.yml @@ -98,7 +98,7 @@ jobs: fi - name: Upload immutable materialization bundle - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: research-corpus-v1-materialization-${{ github.run_id }} path: dist/research-corpus-v1-a/ diff --git a/.github/workflows/research-paper-assets-v1.yml b/.github/workflows/research-paper-assets-v1.yml index 089bab51..fc729669 100644 --- a/.github/workflows/research-paper-assets-v1.yml +++ b/.github/workflows/research-paper-assets-v1.yml @@ -41,7 +41,7 @@ jobs: - name: Upload generated paper assets if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: research-paper-assets-v1-${{ github.run_id }} retention-days: 14 diff --git a/.github/workflows/research-pilot-v1.yml b/.github/workflows/research-pilot-v1.yml index 5e166ca1..03bd6599 100644 --- a/.github/workflows/research-pilot-v1.yml +++ b/.github/workflows/research-pilot-v1.yml @@ -150,7 +150,7 @@ jobs: - name: Upload research reports and normalized dataset if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: research-pilot-v1-${{ github.run_id }} if-no-files-found: warn diff --git a/.github/workflows/research-repeat-v1.yml b/.github/workflows/research-repeat-v1.yml index b0c75719..dcc11eb3 100644 --- a/.github/workflows/research-repeat-v1.yml +++ b/.github/workflows/research-repeat-v1.yml @@ -176,7 +176,7 @@ jobs: - name: Upload repeat evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: research-repeat-v1-${{ github.run_id }} retention-days: 90 diff --git a/.github/workflows/rollback-drill.yml b/.github/workflows/rollback-drill.yml index 153f4990..10056abe 100644 --- a/.github/workflows/rollback-drill.yml +++ b/.github/workflows/rollback-drill.yml @@ -88,9 +88,9 @@ jobs: [[ "$CANDIDATE_IDENTITY" == "${identity_prefix}"*"@refs/tags/v"* ]] test "$CONFIRMATION" = "rollback drill ${DRILL_ALIAS}" - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -259,7 +259,7 @@ jobs: cat "$evidence_dir/evidence.md" >>"$GITHUB_STEP_SUMMARY" - name: Upload rollback evidence - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rollback-drill-${{ github.run_id }} if-no-files-found: error diff --git a/.github/workflows/scholarly-release-v1.yml b/.github/workflows/scholarly-release-v1.yml index cee9651e..bdb0fb55 100644 --- a/.github/workflows/scholarly-release-v1.yml +++ b/.github/workflows/scholarly-release-v1.yml @@ -137,7 +137,7 @@ jobs: cp /tmp/archive-v1/RELEASE-CHECKSUMS.txt dist/research-v1/ - name: Attest scholarly archive provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | dist/research-v1/archive-manifest.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4ca6e9e2..a3bcb6d4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,7 +39,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif @@ -49,13 +49,13 @@ jobs: publish_results: true - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: scorecard-results path: results.sarif retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/.github/workflows/stability-gate.yml b/.github/workflows/stability-gate.yml index 05a1d674..4f49603a 100644 --- a/.github/workflows/stability-gate.yml +++ b/.github/workflows/stability-gate.yml @@ -90,7 +90,7 @@ jobs: echo "report=${report}" >> "$GITHUB_OUTPUT" - name: Upload stability report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: stability-report path: stability/ diff --git a/.github/workflows/upstream-kernel-compatibility.yml b/.github/workflows/upstream-kernel-compatibility.yml index 57eec02c..7130abca 100644 --- a/.github/workflows/upstream-kernel-compatibility.yml +++ b/.github/workflows/upstream-kernel-compatibility.yml @@ -52,7 +52,7 @@ jobs: --concurrency "${VM_CONCURRENCY}" - name: Upload upstream-kernel evidence - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: upstream-kernel-compatibility