canonical · dependabot · Jul 6, 2026 · Jul 6, 2026
diff --git a/.github/workflows/_build-wheels.yaml b/.github/workflows/_build-wheels.yaml
@@ -16,7 +16,7 @@ jobs:
       artifact-name: ${{ steps.artifact-name.outputs.name }}
     steps:
       - name: Checkout the operator repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 

diff --git a/.github/workflows/charmcraft-pack.yaml b/.github/workflows/charmcraft-pack.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 

diff --git a/.github/workflows/db-charm-tests.yaml b/.github/workflows/db-charm-tests.yaml
@@ -31,7 +31,7 @@ jobs:
             commit: 0088c9583f63999ff37d982948e47b9e3e3fba2a  # 2026-01-20T15:48:23Z
     steps:
       - name: Checkout the ${{ matrix.charm-repo }} repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           repository: ${{ matrix.charm-repo }}
           persist-credentials: false

diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Dependency review

diff --git a/.github/workflows/docs-linkcheck.yaml b/.github/workflows/docs-linkcheck.yaml
@@ -15,7 +15,7 @@ jobs:
     name: Links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up uv

diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
@@ -15,7 +15,7 @@ jobs:
     name: Spelling
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up uv

diff --git a/.github/workflows/example-charm-charmcraft-test.yaml b/.github/workflows/example-charm-charmcraft-test.yaml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       jobs: ${{ steps.collect.outputs.jobs }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Collect spread jobs
@@ -39,7 +39,7 @@ jobs:
       matrix:
         include: ${{ fromJson(needs.collect-spread-jobs.outputs.jobs) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up LXD

diff --git a/.github/workflows/example-charm-integration-tests.yaml b/.github/workflows/example-charm-integration-tests.yaml
@@ -17,7 +17,7 @@ jobs:
         dir:
           - examples/machine-tinyproxy
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up uv
@@ -51,7 +51,7 @@ jobs:
           - examples/k8s-4-action
           - examples/k8s-5-observe
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up uv

diff --git a/.github/workflows/example-charm-tests.yaml b/.github/workflows/example-charm-tests.yaml
@@ -28,7 +28,7 @@ jobs:
           - examples/k8s-5-observe
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - name: Set up Python 3

diff --git a/.github/workflows/framework-tests.yaml b/.github/workflows/framework-tests.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -36,7 +36,7 @@ jobs:
         python-version: ["3.10", "3.12", "3.14"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -59,7 +59,7 @@ jobs:
         python-version: ["3.10", "3.12", "3.14"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -93,7 +93,7 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0

diff --git a/.github/workflows/hello-charm-tests.yaml b/.github/workflows/hello-charm-tests.yaml
@@ -32,7 +32,7 @@ jobs:
           python-version: '3.10'
 
       - name: Checkout the ${{ matrix.charm-repo }} repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           repository: ${{ matrix.charm-repo }}
           persist-credentials: false

diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
@@ -13,10 +13,10 @@ jobs:
     outputs:
       tests: ${{ steps.tests.outputs.result }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
       - name: Collect integration test files
         id: tests
         run: |
@@ -50,7 +50,7 @@ jobs:
             test: test/integration/test_tracing.py
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - run: sudo snap install --classic concierge

diff --git a/.github/workflows/observability-charm-tests.yaml b/.github/workflows/observability-charm-tests.yaml
@@ -30,7 +30,7 @@ jobs:
             commit: f3999254035d5f39eda07261af2b86a4454846d4  # 2026-05-20T14:52:38Z
     steps:
       - name: Checkout the ${{ matrix.charm-repo }} repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           repository: ${{ matrix.charm-repo }}
           persist-credentials: false

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
@@ -14,10 +14,11 @@ jobs:
     permissions:
       id-token: write
       attestations: write
+      artifact-metadata: write
       contents: read
     environment: publish-pypi
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -28,7 +29,7 @@ jobs:
         run: |
           set -xueo pipefail
           uvx --with "$(echo -n dist/ops-*.whl)[testing,tracing]" --with dist/ops_scenario-*.whl --with dist/ops_tracing-*.whl python -c 'import ops, scenario, ops_tracing; print("OK")'
-      - uses: actions/attest-build-provenance@v4.1.0
+      - uses: actions/attest@v4.1.1
         with:
           subject-path: 'dist/*'
       - uses: pypa/gh-action-pypi-publish@release/v1

diff --git a/.github/workflows/published-charms-tests.yaml b/.github/workflows/published-charms-tests.yaml
@@ -191,7 +191,7 @@ jobs:
 # END AUTOGENERATED CONTENT
     steps:
       - name: Checkout operator repository (for helper scripts)
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           path: operator-repo
           persist-credentials: false
@@ -203,7 +203,7 @@ jobs:
           rm -rf operator-repo
 
       - name: Checkout the ${{ matrix.charm-repo }} repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           repository: ${{ matrix.charm-repo }}
           path: charm-repo

diff --git a/.github/workflows/sbom-secscan.yaml b/.github/workflows/sbom-secscan.yaml
@@ -17,7 +17,7 @@ jobs:
         runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium]
         steps:
           - name: Checkout repository
-            uses: actions/checkout@v7
+            uses: actions/checkout@v7.0.0
             with:
               persist-credentials: false
           - name: Install dependencies
@@ -26,7 +26,7 @@ jobs:
               sudo apt-get install -y libapt-pkg-dev
               sudo apt install -y python3-apt
           - name: Checkout security scanner
-            uses: actions/checkout@v7
+            uses: actions/checkout@v7.0.0
             with:
               repository: canonical/sbomber
               path: scanner

diff --git a/.github/workflows/smoke.yaml b/.github/workflows/smoke.yaml
@@ -26,7 +26,7 @@ jobs:
           --charmcraft-channel=3.x/stable
           -p "${{ matrix.preset }}"
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 

diff --git a/.github/workflows/test-publish.yaml b/.github/workflows/test-publish.yaml
@@ -12,7 +12,7 @@ jobs:
     name: Build and publish to Test PYPI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0

diff --git a/.github/workflows/tiobe.yaml b/.github/workflows/tiobe.yaml
@@ -11,7 +11,7 @@ jobs:
   TICS:
     runs-on: [self-hosted, reactive, amd64, tiobe, noble]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
 

diff --git a/.github/workflows/update-best-practice-doc.yaml b/.github/workflows/update-best-practice-doc.yaml
@@ -11,13 +11,13 @@ jobs:
   update-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           token: ${{ secrets.UPDATE_DOCS_ACCESS_TOKEN }}
           path: operator
           persist-credentials: true
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           repository: canonical/charmcraft
           path: charmcraft

diff --git a/.github/workflows/update-charm-tests.yaml b/.github/workflows/update-charm-tests.yaml
@@ -13,7 +13,7 @@ jobs:
   update-pins:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           token: ${{ secrets.UPDATE_CHARM_PINS_ACCESS_TOKEN }}
           persist-credentials: true

diff --git a/.github/workflows/validate-pr-title.yaml b/.github/workflows/validate-pr-title.yaml
@@ -13,7 +13,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false
       - run: python3 .github/check-conventional-pr-title.py

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
@@ -16,7 +16,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         with:
           persist-credentials: false