diff --git a/.github/workflows/branch-preview.yaml b/.github/workflows/branch-preview.yaml index f874cae6..766a4645 100644 --- a/.github/workflows/branch-preview.yaml +++ b/.github/workflows/branch-preview.yaml @@ -148,7 +148,7 @@ jobs: echo "cicd-bot-telegram-token=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-token)" >> $GITHUB_OUTPUT echo "cicd-bot-telegram-chat-id=$(./bin/sc stack secret-get -s dist cicd-bot-telegram-chat-id)" >> $GITHUB_OUTPUT - name: upload bin directory artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bin-tools path: bin @@ -282,7 +282,7 @@ jobs: run: | cp "$BUNDLE_PATH" ".sc/stacks/dist/bundle/sc-${GOOS}-${GOARCH}-v${VERSION}.tar.gz.sigstore.json" - name: upload build artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sc-${{ matrix.os }}-${{ matrix.arch }} path: | @@ -441,7 +441,7 @@ jobs: EOF sc secrets reveal - name: Setup Docker Buildx with advanced caching - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: # Persistent builder so `RUN --mount=type=cache` download mounts # (pulumi-dl, gcloud-dl in github-actions.Dockerfile) survive @@ -537,7 +537,7 @@ jobs: sc stack secret-get -s dist dockerhub-cicd-token | docker login --username simplecontainer --password-stdin - name: Build and push preview ${{ matrix.image }} image id: build_and_push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: ${{ matrix.dockerfile }} @@ -625,7 +625,7 @@ jobs: printf '%s@%s\n' "$IMAGE_REPO" "$DIGEST" > "digests/${{ matrix.image }}.txt" - name: Upload digest artifact for ${{ matrix.image }} if: steps.build_and_push.outcome == 'success' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: image-digest-${{ matrix.image }} path: digests/${{ matrix.image }}.txt @@ -666,12 +666,12 @@ jobs: with: persist-credentials: false - name: download all sc platform artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts pattern: sc-* - name: download bin tools artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bin-tools path: bin diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 06782d32..4a7e69c3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -86,7 +86,7 @@ jobs: cache: false - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 with: languages: ${{ matrix.language }} # security-extended adds queries beyond the default "security @@ -96,9 +96,9 @@ jobs: queries: security-extended - name: Autobuild - uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 - name: Perform analysis - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 0fdff58c..fd9ae583 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -123,7 +123,7 @@ jobs: - name: Upload baseline artifact if: github.event_name == 'push' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: coverage-baseline path: dist/coverage-baseline.txt diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 308c7ac3..85dba1c8 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -126,7 +126,7 @@ jobs: # re-fuzzing. - name: Upload crash corpus if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: fuzz-crash-corpus-${{ github.run_id }} path: pkg/security/testdata/fuzz/ diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index 415b12e1..8d7a1eb1 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -194,7 +194,7 @@ jobs: path: docs/schemas key: schemas-${{ github.run_id }} - name: upload bin directory artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bin-tools path: bin @@ -426,7 +426,7 @@ jobs: echo "::error title=Attestation incomplete::${detail}. A release must not publish a tarball without an SBOM, a signature and provenance. Re-run the job; if the transparency log is down, set ATTESTATION_SOFT_FAIL to an ISO-8601 UTC expiry date to ship without them." exit 1 - name: upload build artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sc-${{ matrix.os }}-${{ matrix.arch }} # Match both versioned (sc-os-arch-vX.Y.Z.tar.gz) AND unversioned (sc-os-arch.tar.gz). @@ -524,7 +524,7 @@ jobs: # / arm64 / arm/v5 / arm/v7 / 386 / ppc64le / riscv64 / s390x. docker run --rm -v $PWD/docs:/docs -w /docs python@sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36 sh -c "pip install --require-hashes -r requirements.txt && PATH=\$PATH:~/.local/bin mkdocs build" - name: upload docs artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: docs-site path: docs/site @@ -747,7 +747,7 @@ jobs: EOF sc secrets reveal - name: Setup Docker Buildx with advanced caching - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: # A STABLE builder name + no teardown, so `RUN --mount=type=cache` # mounts survive between jobs. Without these three inputs the action @@ -976,7 +976,7 @@ jobs: sc stack secret-get -s dist dockerhub-cicd-token | docker login --username simplecontainer --password-stdin - name: Build and push ${{ matrix.image }} image id: build_and_push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: ${{ matrix.dockerfile }} @@ -1157,7 +1157,7 @@ jobs: printf '%s@%s\n' "$IMAGE_REPO" "$DIGEST" > "digests/${{ matrix.image }}.txt" - name: Upload digest artifact for ${{ matrix.image }} if: steps.build_and_push.outcome == 'success' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: image-digest-${{ matrix.image }} path: digests/${{ matrix.image }}.txt @@ -1399,7 +1399,7 @@ jobs: EOF sc secrets reveal - name: download sc tarball artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: # Filter to sc-* artifacts only — without a pattern, this step # also pulls the build-push-action's internal `*.dockerbuild` @@ -1413,14 +1413,14 @@ jobs: pattern: sc-* path: artifacts - name: download bin tools artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: bin-tools path: bin - name: fix bin tools permissions run: chmod +x bin/* - name: download docs artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: docs-site path: docs/site diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 47d57b1c..dc990e83 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -46,7 +46,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif @@ -55,13 +55,13 @@ jobs: publish_results: true - name: Upload SARIF - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 with: sarif_file: results.sarif category: scorecard - name: Upload artifact (debugging) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: scorecard-results path: results.sarif diff --git a/.github/workflows/verify-attestations.yml b/.github/workflows/verify-attestations.yml index 19880258..880b7945 100644 --- a/.github/workflows/verify-attestations.yml +++ b/.github/workflows/verify-attestations.yml @@ -122,7 +122,7 @@ jobs: id: download_digests if: github.event_name == 'workflow_run' continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: image-digest-* path: image-digests