From 22c86d738fb68c5f4b296b368cc018ebd93a5f83 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 10:46:06 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 5 updates Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0` | `5.6.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.6.0` | `8.3.2` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `astral-sh/setup-uv` from 7.6.0 to 8.3.2 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/37802adc94f370d6bfd71619e3f0bf239e1f3b78...11f9893b081a58869d3b5fccaea48c9e9e46f990) Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 8.3.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/_envelope.yml | 2 +- .github/workflows/_heavy.yml | 10 +++---- .github/workflows/_integration.yml | 28 ++++++++++---------- .github/workflows/agent-controls.yml | 2 +- .github/workflows/auto-merge-router.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/evals.yml | 4 +-- .github/workflows/frontend-perf.yml | 6 ++--- .github/workflows/gate-guard.yml | 2 +- .github/workflows/invariant-guard.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/promotion-ledger-guard.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/reviewer-agents.yml | 2 +- .github/workflows/security.yml | 16 +++++------ 16 files changed, 43 insertions(+), 43 deletions(-) diff --git a/.github/workflows/_envelope.yml b/.github/workflows/_envelope.yml index 457b808..81b17f5 100644 --- a/.github/workflows/_envelope.yml +++ b/.github/workflows/_envelope.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Download every evidence partial that was produced # No `name:` -> downloads all partials from this run into partials//. Tolerant diff --git a/.github/workflows/_heavy.yml b/.github/workflows/_heavy.yml index 530ce08..5f1ddbb 100644 --- a/.github/workflows/_heavy.yml +++ b/.github/workflows/_heavy.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Start Postgres + NATS (compose waits for both healthchecks) run: docker compose -f services/content/docker-compose.yaml up -d --wait @@ -83,7 +83,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Stryker on the critical modules run: pnpm stryker:critical @@ -105,9 +105,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5 + - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: distribution: temurin java-version: '17' @@ -144,7 +144,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 45 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - uses: ./.github/actions/cluster-up with: diff --git a/.github/workflows/_integration.yml b/.github/workflows/_integration.yml index 382a535..6097547 100644 --- a/.github/workflows/_integration.yml +++ b/.github/workflows/_integration.yml @@ -32,9 +32,9 @@ jobs: options: >- --health-cmd "pg_isready -U qaroom" --health-interval 5s --health-timeout 5s --health-retries 10 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: version: "0.8.15" - name: Aggregate the in-proc summary (the runners the claims' evidence resolves against) @@ -61,7 +61,7 @@ jobs: matrix: provider: [content, identity, donations, flags, webhooks] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Pact provider verification (${{ matrix.provider }}) run: pnpm pact:verify --provider ${{ matrix.provider }} @@ -73,7 +73,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Start Postgres + NATS run: docker compose -f services/content/docker-compose.yaml up -d --wait @@ -114,7 +114,7 @@ jobs: db: postgres://qaroom:qaroom@localhost:5436/qaroom_webhooks port: 8087 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Start ${{ matrix.service }} Postgres run: docker compose -f ${{ matrix.compose }} up -d --wait @@ -145,7 +145,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Install Chromium run: pnpm --filter @qaroom/web exec playwright install --with-deps chromium @@ -169,9 +169,9 @@ jobs: options: >- --health-cmd "pg_isready -U qaroom" --health-interval 5s --health-timeout 5s --health-retries 10 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: version: "0.8.15" - name: Lint (ruff) @@ -204,7 +204,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 with: version: v4.1.1 @@ -230,7 +230,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - uses: ./.github/actions/cluster-up with: @@ -256,7 +256,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - uses: ./.github/actions/cluster-up with: @@ -283,7 +283,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Install Chromium run: pnpm --filter @qaroom/web exec playwright install --with-deps chromium @@ -318,7 +318,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Visual-regression gate (pinned container) run: | docker build -f services/web/Dockerfile.visual -t qaroom/visual . @@ -330,7 +330,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Coverage floor gate run: pnpm coverage diff --git a/.github/workflows/agent-controls.yml b/.github/workflows/agent-controls.yml index 45b0924..17cacad 100644 --- a/.github/workflows/agent-controls.yml +++ b/.github/workflows/agent-controls.yml @@ -34,7 +34,7 @@ jobs: flag: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: Flag test-file (oracle) edits — read-only-tests posture diff --git a/.github/workflows/auto-merge-router.yml b/.github/workflows/auto-merge-router.yml index 2cfabab..1c4ed2e 100644 --- a/.github/workflows/auto-merge-router.yml +++ b/.github/workflows/auto-merge-router.yml @@ -31,7 +31,7 @@ jobs: # don't claim a scope the YAML doesn't enforce. AUTO_MERGE_ENABLED: 'false' steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - uses: ./.github/actions/setup-workspace diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 465e91a..2cd0b38 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 # Lint the workflow YAML itself (expressions, needs/if/matrix graph, runner labels, and — via # the runner's preinstalled shellcheck — the `run:` shell blocks). Cheap, and now load-bearing: diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml index 4b090d7..ff43f1f 100644 --- a/.github/workflows/evals.yml +++ b/.github/workflows/evals.yml @@ -27,9 +27,9 @@ jobs: env: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 + - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: version: "0.8.15" - name: Pre-flight cost guard (estimate vs MODERATOR_EVAL_BUDGET_TOKENS) diff --git a/.github/workflows/frontend-perf.yml b/.github/workflows/frontend-perf.yml index b9e6237..eec9345 100644 --- a/.github/workflows/frontend-perf.yml +++ b/.github/workflows/frontend-perf.yml @@ -39,7 +39,7 @@ jobs: lighthouse: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Build the web app (tsc + vite build) run: pnpm --filter @qaroom/web build @@ -59,7 +59,7 @@ jobs: bundle-budget: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Build the web app (tsc + vite build) run: pnpm --filter @qaroom/web build @@ -72,7 +72,7 @@ jobs: k6-soak-stress: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: ./.github/actions/setup-workspace - name: Start Postgres + NATS (compose waits for both healthchecks) run: docker compose -f services/content/docker-compose.yaml up -d --wait diff --git a/.github/workflows/gate-guard.yml b/.github/workflows/gate-guard.yml index 98d7572..1b625b1 100644 --- a/.github/workflows/gate-guard.yml +++ b/.github/workflows/gate-guard.yml @@ -30,7 +30,7 @@ jobs: flag: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: Flag gate-self-weakening diff --git a/.github/workflows/invariant-guard.yml b/.github/workflows/invariant-guard.yml index 76bca85..b1ab2eb 100644 --- a/.github/workflows/invariant-guard.yml +++ b/.github/workflows/invariant-guard.yml @@ -45,7 +45,7 @@ jobs: flag: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: Flag invariant-source changes diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index d9c503a..59e17ec 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -36,7 +36,7 @@ jobs: integration: ${{ steps.decide.outputs.integration }} heavy: ${{ steps.decide.outputs.heavy }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: Decide which tiers to run diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 604fccf..d2d7620 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -33,7 +33,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 with: enablement: true diff --git a/.github/workflows/promotion-ledger-guard.yml b/.github/workflows/promotion-ledger-guard.yml index 4f54bc0..9321910 100644 --- a/.github/workflows/promotion-ledger-guard.yml +++ b/.github/workflows/promotion-ledger-guard.yml @@ -33,7 +33,7 @@ jobs: flag: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - name: Measure the measure diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9175f9e..43fb254 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,7 @@ jobs: matrix: service: [content, identity, gateway, donations, flags, webhooks, moderator-agent, web] steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Build ${{ matrix.service }} image (compile only — not pushed) run: docker build -f services/${{ matrix.service }}/Dockerfile -t qaroom/${{ matrix.service }}:${{ github.sha }} . diff --git a/.github/workflows/reviewer-agents.yml b/.github/workflows/reviewer-agents.yml index 5ce757f..317bbe6 100644 --- a/.github/workflows/reviewer-agents.yml +++ b/.github/workflows/reviewer-agents.yml @@ -31,7 +31,7 @@ jobs: if: ${{ !github.event.pull_request.draft && github.actor != 'dependabot[bot]' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - uses: ./.github/actions/setup-workspace diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 0acf0ed..3698b81 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -104,8 +104,8 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' - name: Install Semgrep (pinned — bump deliberately) @@ -116,7 +116,7 @@ jobs: run: semgrep scan --config=p/ci --sarif --output=semgrep.sarif --metrics=off - name: Upload SARIF to the code-scanning Security tab (best-effort) continue-on-error: true - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: sarif_file: semgrep.sarif category: semgrep @@ -138,7 +138,7 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install osv-scanner (pinned — bump deliberately; mirrors the kubeconform install) run: | curl -sSL https://github.com/google/osv-scanner/releases/download/v2.4.0/osv-scanner_linux_amd64 \ @@ -150,7 +150,7 @@ jobs: run: '"$RUNNER_TEMP/osv-scanner" scan --recursive --format sarif ./ > osv-scanner.sarif' - name: Upload SARIF to the code-scanning Security tab (best-effort) continue-on-error: true - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: sarif_file: osv-scanner.sarif category: osv-scanner @@ -172,7 +172,7 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 with: version: v4.1.1 @@ -195,7 +195,7 @@ jobs: soft_fail: true - name: Upload SARIF to the code-scanning Security tab (best-effort) continue-on-error: true - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: sarif_file: results.sarif category: checkov @@ -216,7 +216,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Generate an SPDX SBOM with Syft (anchore/sbom-action) uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 with: