From 13dd18c0b84cad5f6793285fe0129ebf9da11c28 Mon Sep 17 00:00:00 2001 From: "lf-releng-code-monkey-bot[bot]" <332050256+lf-releng-code-monkey-bot[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 10:32:17 +0000 Subject: [PATCH] CI: Bump every action pin to its latest release Move the eight coordinates that lag their latest release, and the two stale pins in the design brief, to commit SHAs of current tags: - checkout-gerrit-change-action v1.1.2 -> v1.2.1 - gerrit-review-action v1.1.3 -> v1.2.0 - generic-workflows release/clear-action-cache v0.5.0 -> v0.6.1 - security-workflows openssf-scorecard v0.9.5 -> v0.9.7 - astral-sh/setup-uv v10.3.2 -> v10.3.3 - lfreleng-actions/.github allow-list v0.17.2 -> v0.19.0 - brief snippet: harden-runner-block-action v0.2.1 -> v0.14.0 and allow-list v0.1.1 -> v0.19.0, with the file's line count (796) Each SHA is the dereferenced commit of its tag. The harden-runner v2.22.3 and harden-runner-block-action v0.14.0 workflow pins stay. No caller inputs change. Issue: #74 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: lf-releng-code-monkey-bot[bot] <332050256+lf-releng-code-monkey-bot[bot]@users.noreply.github.com> --- .github/workflows/clear-action-cache.yaml | 2 +- .github/workflows/docs-audit.yaml | 4 ++-- .github/workflows/docs-build.yaml | 10 +++++----- .github/workflows/openssf-scorecard.yaml | 2 +- .github/workflows/release-drafter.yaml | 2 +- .github/workflows/release.yaml | 2 +- docs/DOCS_WORKFLOWS_BRIEF.md | 6 +++--- examples/docs-build/gerrit-merge.yaml | 4 ++-- examples/docs-build/gerrit.yaml | 4 ++-- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/clear-action-cache.yaml b/.github/workflows/clear-action-cache.yaml index a410ed1..8b3ea9b 100644 --- a/.github/workflows/clear-action-cache.yaml +++ b/.github/workflows/clear-action-cache.yaml @@ -51,7 +51,7 @@ jobs: permissions: actions: write # list and delete repository Actions caches # yamllint disable-line rule:line-length - uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@9d4a5d5b7e30bcd26a0abffb5bf263fd11c13852 # v0.5.0 + uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@04672a980550ff9bd89d24bacd39fb03e25b0b0b # v0.6.1 with: key_pattern: ${{ inputs.key_pattern }} ref_filter: ${{ inputs.ref_filter }} diff --git a/.github/workflows/docs-audit.yaml b/.github/workflows/docs-audit.yaml index dc2d99e..b9064f5 100644 --- a/.github/workflows/docs-audit.yaml +++ b/.github/workflows/docs-audit.yaml @@ -119,7 +119,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@084d6861688632b2edb6bde3c180145bebf9cc7a' # v0.17.2 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d' # v0.19.0 outputs: passed: @@ -167,7 +167,7 @@ jobs: - name: 'Checkout Gerrit change' if: inputs.gerrit_refspec != '' # yamllint disable-line rule:line-length - uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093 # v1.1.2 + uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a # v1.2.1 with: gerrit-refspec: ${{ inputs.gerrit_refspec }} gerrit-project: ${{ inputs.gerrit_project }} diff --git a/.github/workflows/docs-build.yaml b/.github/workflows/docs-build.yaml index 668d948..943a603 100644 --- a/.github/workflows/docs-build.yaml +++ b/.github/workflows/docs-build.yaml @@ -213,7 +213,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@084d6861688632b2edb6bde3c180145bebf9cc7a' # v0.17.2 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d' # v0.19.0 # --- Timeouts --- docs_timeout_minutes: @@ -413,7 +413,7 @@ jobs: - name: 'Checkout Gerrit change' if: inputs.gerrit_refspec != '' # yamllint disable-line rule:line-length - uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093 # v1.1.2 + uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a # v1.2.1 with: gerrit-refspec: ${{ inputs.gerrit_refspec }} gerrit-project: ${{ inputs.gerrit_project }} @@ -533,7 +533,7 @@ jobs: - name: 'Checkout Gerrit change' if: inputs.gerrit_refspec != '' # yamllint disable-line rule:line-length - uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093 # v1.1.2 + uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a # v1.2.1 with: gerrit-refspec: ${{ inputs.gerrit_refspec }} gerrit-project: ${{ inputs.gerrit_project }} @@ -607,7 +607,7 @@ jobs: - name: 'Checkout Gerrit change' if: inputs.gerrit_refspec != '' # yamllint disable-line rule:line-length - uses: lfreleng-actions/checkout-gerrit-change-action@35e98c8043ec411611e464e296bcfb441a5c5093 # v1.1.2 + uses: lfreleng-actions/checkout-gerrit-change-action@f0dd3d4dd4fceff1f56348152ecf0e040594f16a # v1.2.1 with: gerrit-refspec: ${{ inputs.gerrit_refspec }} gerrit-project: ${{ inputs.gerrit_project }} @@ -725,7 +725,7 @@ jobs: - name: 'Install uv' # yamllint disable-line rule:line-length - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: # This job drives the ReadTheDocs API and never checks the # repository out. With an empty working directory there are no diff --git a/.github/workflows/openssf-scorecard.yaml b/.github/workflows/openssf-scorecard.yaml index 541ce5c..5d11a41 100644 --- a/.github/workflows/openssf-scorecard.yaml +++ b/.github/workflows/openssf-scorecard.yaml @@ -28,7 +28,7 @@ jobs: openssf-scorecard: name: "OpenSSF Scorecard" # yamllint disable-line rule:line-length - uses: lfreleng-actions/security-workflows/.github/workflows/openssf-scorecard.yaml@ef6c0d9930feedb274067703b50eeebe5ab859b3 # v0.9.5 + uses: lfreleng-actions/security-workflows/.github/workflows/openssf-scorecard.yaml@378fcc19ebdf37f17fde4888d4b71c83b21d6cf3 # v0.9.7 permissions: contents: read # checkout security-events: write # upload results to the code scanning dashboard diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml index c78401c..e378b77 100644 --- a/.github/workflows/release-drafter.yaml +++ b/.github/workflows/release-drafter.yaml @@ -30,7 +30,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@e5e8179f45aa893b23cc8b5d2e25466355d9c4f8 # v0.14.0 with: - config: '@084d6861688632b2edb6bde3c180145bebf9cc7a' # v0.17.2 + config: '@6d4a65c5601afd6c2fbe52bda4b0024b132f265d' # v0.19.0 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)' diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b4483aa..fc1c03c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -42,4 +42,4 @@ jobs: permissions: contents: write # Promote (publish) the draft release for the tag # yamllint disable-line rule:line-length - uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@9d4a5d5b7e30bcd26a0abffb5bf263fd11c13852 # v0.5.0 + uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@04672a980550ff9bd89d24bacd39fb03e25b0b0b # v0.6.1 diff --git a/docs/DOCS_WORKFLOWS_BRIEF.md b/docs/DOCS_WORKFLOWS_BRIEF.md index aa39cd5..cba7234 100644 --- a/docs/DOCS_WORKFLOWS_BRIEF.md +++ b/docs/DOCS_WORKFLOWS_BRIEF.md @@ -718,7 +718,7 @@ The harden-runner pattern from `python-workflows` gives the target shape: ```yaml - name: 'Load harden-runner allow-list' - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 + uses: lfreleng-actions/harden-runner-block-action@e5e8179f45aa893b23cc8b5d2e25466355d9c4f8 # v0.14.0 with: config: ${{ inputs.harden_runner_allowlist }} - name: 'Harden runner' @@ -742,10 +742,10 @@ The allow-list default points at a pinned path in the organisation `.github` repository: ```text -lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@18d9c4446bea555d0783e850f6d295f844fe8f67 +lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@6d4a65c5601afd6c2fbe52bda4b0024b132f265d ``` -That file holds 514 lines. A documentation pipeline reaches +That file holds 796 lines. A documentation pipeline reaches `readthedocs.org`, PyPI and every host a project links to during `docs-linkcheck`, so the allow-list needs review before block mode goes live. Link checking against arbitrary hosts and egress blocking pull in diff --git a/examples/docs-build/gerrit-merge.yaml b/examples/docs-build/gerrit-merge.yaml index 3016615..a152d25 100644 --- a/examples/docs-build/gerrit-merge.yaml +++ b/examples/docs-build/gerrit-merge.yaml @@ -84,7 +84,7 @@ jobs: egress-policy: audit - name: 'Notify job start' # yamllint disable-line rule:line-length - uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 + uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e # v1.2.0 with: host: ${{ vars.GERRIT_SERVER }} username: ${{ vars.GERRIT_SSH_USER }} @@ -137,7 +137,7 @@ jobs: uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526 # v3.0.0 - name: 'Report workflow conclusion' # yamllint disable-line rule:line-length - uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 + uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e # v1.2.0 with: host: ${{ vars.GERRIT_SERVER }} username: ${{ vars.GERRIT_SSH_USER }} diff --git a/examples/docs-build/gerrit.yaml b/examples/docs-build/gerrit.yaml index 81eb0fc..e8288ba 100644 --- a/examples/docs-build/gerrit.yaml +++ b/examples/docs-build/gerrit.yaml @@ -104,7 +104,7 @@ jobs: egress-policy: audit - name: 'Clear votes' # yamllint disable-line rule:line-length - uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 + uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e # v1.2.0 with: host: ${{ vars.GERRIT_SERVER }} username: ${{ vars.GERRIT_SSH_USER }} @@ -168,7 +168,7 @@ jobs: uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526 # v3.0.0 - name: 'Set vote' # yamllint disable-line rule:line-length - uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 + uses: lfreleng-actions/gerrit-review-action@d56b0b5c81402f8cb435aaca513bebdea3be951e # v1.2.0 with: host: ${{ vars.GERRIT_SERVER }} username: ${{ vars.GERRIT_SSH_USER }}