From b391c4a8f809b5a8f022e2b704a2d87444414192 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:40:28 +0000 Subject: [PATCH 1/2] ci(deps): bump the github-actions group across 1 directory with 8 updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [jdx/mise-action](https://github.com/jdx/mise-action) | `4.3.0` | `5.1.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.38.3` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.1` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.1` | `4.38.3` | | [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3125.0` | `12.3131.0` | Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `jdx/mise-action` from 4.3.0 to 5.1.1 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/c2a87611a18de5b3828c5652fe268e992400cb5c...2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca) Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `anchore/sbom-action` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `github/codeql-action/init` from 4.38.1 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.1 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `bridgecrewio/checkov-action` from 12.3125.0 to 12.3131.0 - [Release notes](https://github.com/bridgecrewio/checkov-action/releases) - [Commits](https://github.com/bridgecrewio/checkov-action/compare/444c9db6fa75e2d9c19ebf1fde7322089be9009e...c13aafd679d3814a25067d10fcaf98c4f7594931) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jdx/mise-action dependency-version: 5.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: bridgecrewio/checkov-action dependency-version: 12.3131.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 4 ++-- .github/workflows/docker-build.yml | 4 ++-- .github/workflows/publish.yml | 6 +++--- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/security.yml | 26 +++++++++++++------------- .github/workflows/triage-deps.yml | 2 +- .github/workflows/windows.yml | 4 ++-- 7 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b078787..ab9bd659 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,13 +18,13 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" - name: Provision pinned standards tools - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 - name: Install dependencies run: npm ci diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 6aca61ff..0128580e 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -131,7 +131,7 @@ jobs: # must not turn a failed vulnerability gate into a successful publish. if: ${{ !cancelled() && github.event_name != 'pull_request' }} continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: trivy-results.sarif @@ -186,7 +186,7 @@ jobs: # SBOM per image — attached to the registry alongside the signature. - name: Generate SBOM for CLI image if: github.event_name != 'pull_request' && steps.docker-creds.outputs.present == 'true' && steps.push-cli.outputs.digest != '' - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push-cli.outputs.digest }} format: cyclonedx-json diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bd233a7d..f377e8a3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -41,7 +41,7 @@ jobs: fetch-depth: 0 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" registry-url: "https://registry.npmjs.org" @@ -441,7 +441,7 @@ jobs: - name: Generate SBOM (CycloneDX) # Scan the extracted npm package, which contains what the consumer gets. # Scanning the checkout would include dev tools absent from the tarball. - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: path: .release-package/package config: .syft.yaml # names the root component (see the step above) @@ -451,7 +451,7 @@ jobs: - name: Generate SBOM (SPDX) # Some consumers (e.g. RHEL, federal) require SPDX format. - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: path: .release-package/package config: .syft.yaml # names the root component (see the step above) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a8900b55..43ae65d1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,7 +38,7 @@ jobs: - name: Upload artifact if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: scorecard-results path: scorecard-results.sarif @@ -48,6 +48,6 @@ jobs: # Lands in repo's Security → Code scanning tab. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 3d8eeb39..88654607 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -27,7 +27,7 @@ jobs: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -54,7 +54,7 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -85,7 +85,7 @@ jobs: timeout-minutes: 65 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -121,7 +121,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -159,12 +159,12 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: javascript-typescript queries: security-extended - name: Analyze JavaScript and TypeScript - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:javascript-typescript" @@ -212,7 +212,7 @@ jobs: # Don't fail the job if Code Scanning is off — scan result is the gate. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: trivy-results.sarif @@ -230,7 +230,7 @@ jobs: - name: Checkov (terraform + kubernetes) # Baseline of pre-existing findings in .checkov.yaml skip-check. # Gating on net-new findings only — see .checkov.yaml header for context. - uses: bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e # v12.3125.0 + uses: bridgecrewio/checkov-action@c13aafd679d3814a25067d10fcaf98c4f7594931 # v12.3131.0 with: directory: . config_file: .checkov.yaml @@ -248,7 +248,7 @@ jobs: # SARIF upload requires Code Scanning enabled in repo settings. if: always() continue-on-error: true # kit-self-audit: allow-continue-on-error - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: checkov.sarif @@ -325,7 +325,7 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -343,7 +343,7 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" @@ -377,12 +377,12 @@ jobs: timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" cache: "npm" - run: npm ci && npm run build - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 # Triage verifies each tool's upstream repo through the GitHub API. Anonymous calls share # a 60/hour limit per runner IP, and triage correctly fails closed when it cannot verify. - name: Provision declared tools via kit install (triage-gated) diff --git a/.github/workflows/triage-deps.yml b/.github/workflows/triage-deps.yml index 3a4761a3..67407ae8 100644 --- a/.github/workflows/triage-deps.yml +++ b/.github/workflows/triage-deps.yml @@ -24,7 +24,7 @@ jobs: with: python-version: "3.12" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 68119494..0fd22304 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -28,7 +28,7 @@ jobs: timeout-minutes: 90 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 - name: Install @@ -62,7 +62,7 @@ jobs: npm test 2>&1 | tee win-tests.log - name: Upload Windows test log (full output — gh logs truncate) if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-test-log path: win-tests.log From e935666182d60d3ada3eae3866dffcf90c47023c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Sandstr=C3=B6m?= Date: Wed, 14 Oct 2026 16:05:15 +0200 Subject: [PATCH 2/2] test: follow the bumped CodeQL (v4.38.3) and mise-action (v5.1.1) pins Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RSop9MyLof8XxLTkFnF4KG --- src/github-codeql-workflow.test.ts | 4 ++-- src/github-workflow-hardening.test.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/github-codeql-workflow.test.ts b/src/github-codeql-workflow.test.ts index 17bc7d2d..13cf9a60 100644 --- a/src/github-codeql-workflow.test.ts +++ b/src/github-codeql-workflow.test.ts @@ -5,7 +5,7 @@ import { dirname, resolve } from "node:path"; import { fileURLToPath } from "node:url"; const root = resolve(dirname(fileURLToPath(import.meta.url)), ".."); -const CODEQL_ACTION_SHA = "1c5b675653bb5c22dbe9b12b556ec555138e09fd"; +const CODEQL_ACTION_SHA = "24c54180a607b1449ed407dd24f251e4e9147c8d"; describe("CodeQL workflow action", () => { it("uses one supported v4 action commit for every CodeQL step", () => { @@ -20,7 +20,7 @@ describe("CodeQL workflow action", () => { assert.ok(references.length > 0, "expected at least one CodeQL action step"); for (const reference of references) { assert.equal(reference.sha, CODEQL_ACTION_SHA, `${reference.name} has a stale CodeQL pin`); - assert.equal(reference.version, "v4.38.1", `${reference.name} must identify supported major`); + assert.equal(reference.version, "v4.38.3", `${reference.name} must identify supported major`); } }); }); diff --git a/src/github-workflow-hardening.test.ts b/src/github-workflow-hardening.test.ts index d79fb6a8..6f31c2ee 100644 --- a/src/github-workflow-hardening.test.ts +++ b/src/github-workflow-hardening.test.ts @@ -103,7 +103,7 @@ describe("informational CI jobs can still fail", () => { describe("GitHub workflow standards gate", () => { it("provisions the pinned standards tools and runs the full standards gate in CI", () => { const ci = workflow("ci.yml"); - assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v4\.3\.0/); + assert.match(ci, /uses:\s*jdx\/mise-action@[a-f0-9]{40}\s*#\s*v5\.1\.1/); assert.match(ci, /run:\s*node dist\/cli\.js standards --enforce/); assert.doesNotMatch( ci,