From f48a26db9376a4b79eba65d1e910c09345c2c839 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 03:51:06 +0000 Subject: [PATCH] deps(actions): bump the github-actions group with 10 updates Bumps the github-actions group with 10 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4.3.0` | `6.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.8` | `4.38.2` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.8` | `4.38.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.86.7` | `2.87.22` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.2.0` | `4.2.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.2` | `3.0.3` | Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11d5960a326750d5838078e36cf38b85af677262...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `pnpm/action-setup` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/b906affcce14559ad1aafd4ab0e942779e9f58b1...ea17c68df8912ef543352723c149a84f56e3d413) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `github/codeql-action/init` from 4.37.8 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) Updates `github/codeql-action/analyze` from 4.37.8 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2) Updates `taiki-e/install-action` from 2.86.7 to 2.87.22 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/b6ff580856c41316412a0b9b60540fbc6f8c82cc...83ac0ad63c0167e6f06796fab0fce28db1bf3db0) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `actions/attest-build-provenance` from 3.2.0 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/96278af6caaf10aea03fd8d33a09a777ca52d62f...4d101475d8b20a2381f78447822ac1eab6504dd8) Updates `softprops/action-gh-release` from 2.6.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/3bb12739c298aeb8a4eeaf626c5b8d85266b0e65...efb35369e0ad2afab669f228072c1b0d510eae64) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 16 +++---- .github/workflows/codeql.yml | 6 +-- .github/workflows/dependency-security.yml | 12 ++--- .github/workflows/ga.yml | 6 +-- .github/workflows/release.yml | 56 +++++++++++------------ .github/workflows/setup-acceptance.yml | 10 ++-- 6 files changed, 53 insertions(+), 53 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 64d175de..0305eed1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: name: Product version identity runs-on: windows-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify every remote GitHub Action is commit-pinned shell: pwsh run: ./scripts/Test-GitHubActionPins.ps1 @@ -98,7 +98,7 @@ jobs: runs-on: ${{ matrix.os }} timeout-minutes: 25 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@2eae45db285e407f22119950686d47e1101e071b # 1.88.0 - name: Assert exact MSRV toolchain shell: pwsh @@ -139,7 +139,7 @@ jobs: # to reach its own bounded-process diagnostic. timeout-minutes: 75 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - run: cargo fmt --all -- --check @@ -179,7 +179,7 @@ jobs: target: macos-aarch64 runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 - name: Provision OpenSSL 3 on macOS if: runner.os == 'macOS' @@ -268,12 +268,12 @@ jobs: # of canceling a healthy compiler process at the old 45-minute ceiling. timeout-minutes: 75 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 11.0.8 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.19.0 cache: pnpm @@ -361,7 +361,7 @@ jobs: Select-Object FullName,LastWriteTime,Length - name: Upload Windows controller/worker round-trip evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows-controller-worker-roundtrip path: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 956f4e7d..821a5e03 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,16 +32,16 @@ jobs: steps: - name: Check out source - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: languages: ${{ matrix.language }} build-mode: none queries: security-extended - name: Analyze - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 238665e3..f627f954 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -34,9 +34,9 @@ jobs: lockfile: apps/desktop/src-tauri/Cargo.lock steps: - name: Check out source - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install pinned cargo-audit - uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2 + uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2 with: tool: cargo-audit@0.22.2 - name: Reject known Rust vulnerabilities @@ -56,7 +56,7 @@ jobs: manifest: ./apps/desktop/src-tauri/Cargo.toml steps: - name: Check out source - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check advisories, licenses, bans, and sources uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 with: @@ -70,13 +70,13 @@ jobs: timeout-minutes: 15 steps: - name: Check out source - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up pnpm - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 11.0.8 - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.19.0 cache: pnpm diff --git a/.github/workflows/ga.yml b/.github/workflows/ga.yml index 79b2ce74..2f0882f0 100644 --- a/.github/workflows/ga.yml +++ b/.github/workflows/ga.yml @@ -66,7 +66,7 @@ jobs: # used only for that endpoint; an absent token intentionally fails closed. CYC_GA_GOVERNANCE_TOKEN: ${{ secrets.CYC_GA_GOVERNANCE_TOKEN }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_tag }} fetch-depth: 0 @@ -427,7 +427,7 @@ jobs: - name: Upload GA gate diagnostics if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-ga-readiness-${{ inputs.source_tag }} path: ${{ runner.temp }}/cyc-ga-readiness/* @@ -467,7 +467,7 @@ jobs: CYC_GA_GOVERNANCE_TOKEN: ${{ secrets.CYC_GA_GOVERNANCE_TOKEN }} GH_TOKEN: ${{ github.token }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_tag }} fetch-depth: 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cc491370..7322e65e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: source_tag: ${{ steps.identity.outputs.source_tag }} source_commit: ${{ steps.identity.outputs.source_commit }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Verify annotated release tag and checked-out source commit @@ -150,7 +150,7 @@ jobs: os: windows-latest runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@2eae45db285e407f22119950686d47e1101e071b # 1.88.0 - name: Assert exact MSRV toolchain shell: pwsh @@ -176,7 +176,7 @@ jobs: os: [windows-latest, ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify private signing-key file protection shell: pwsh run: ./scripts/Test-WorkerKitSigningKeyProtection.ps1 @@ -227,7 +227,7 @@ jobs: include_worker: "true" runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 with: targets: ${{ matrix.target }} @@ -304,7 +304,7 @@ jobs: if ($LASTEXITCODE -ne 0) { throw "Windows controller/worker round trip failed with exit code $LASTEXITCODE." } - name: Upload Windows controller/worker round-trip evidence if: runner.os == 'Windows' && always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows-controller-worker-roundtrip-${{ matrix.label }} path: | @@ -592,14 +592,14 @@ jobs: if (-not [string]::IsNullOrWhiteSpace([string]$env:CYC_WORKER_KIT_SIGNING_KEY_PATH)) { [IO.File]::Delete([string]$env:CYC_WORKER_KIT_SIGNING_KEY_PATH) } - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-${{ matrix.label }}-preview path: release-assets/* if-no-files-found: error - name: Upload managed worker kit for controller aggregation if: matrix.include_worker == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-worker-kit-${{ matrix.label }} path: release-stage/*/worker-kit/* @@ -618,7 +618,7 @@ jobs: CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 with: targets: aarch64-unknown-linux-gnu @@ -695,7 +695,7 @@ jobs: if (-not [string]::IsNullOrWhiteSpace([string]$env:CYC_WORKER_KIT_SIGNING_KEY_PATH)) { [IO.File]::Delete([string]$env:CYC_WORKER_KIT_SIGNING_KEY_PATH) } - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-worker-kit-linux-arm64 path: worker-kit-artifact/* @@ -709,15 +709,15 @@ jobs: CYC_PRODUCT_VERSION: ${{ needs.release-identity.outputs.product_version }} runs-on: windows-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: key: release-integration-preview - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 11.0.8 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.19.0 cache: pnpm @@ -936,7 +936,7 @@ jobs: $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $archive).Hash.ToLowerInvariant() "$hash $(Split-Path $archive -Leaf)" | Set-Content -NoNewline -Encoding ascii "$archive.sha256" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-integration-preview path: release-assets/* @@ -953,9 +953,9 @@ jobs: CYC_SOURCE_COMMIT: ${{ needs.release-identity.outputs.source_commit }} runs-on: windows-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download cross-platform managed worker kits - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: ClusterYourCodex-worker-kit-* path: ${{ runner.temp }}\cyc-downloaded-worker-kits @@ -1017,10 +1017,10 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: key: windows-self-contained-preview - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 11.0.8 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.19.0 cache: pnpm @@ -1420,7 +1420,7 @@ jobs: if ($LASTEXITCODE -ne 0) { throw 'fresh deployment lifecycle smoke failed' } - name: Upload fresh deployment diagnostics if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows-fresh-deployment-diagnostics path: ${{ runner.temp }}\ClusterYourCodex-fresh-deployment-smoke\** @@ -1452,12 +1452,12 @@ jobs: if ($LASTEXITCODE -ne 0) { throw 'silent Setup lifecycle smoke failed' } - name: Upload silent Setup diagnostics if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows-setup-silent-diagnostics path: ${{ runner.temp }}\ClusterYourCodex-setup-silent-smoke\** if-no-files-found: warn - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows-x64-self-contained-preview path: release-assets/* @@ -1480,9 +1480,9 @@ jobs: CYC_PRODUCT_VERSION: ${{ needs.release-identity.outputs.product_version }} CYC_DISPOSABLE_WINDOWS: "1" steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download the Windows x64 self-contained preview - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ClusterYourCodex-windows-x64-self-contained-preview path: ${{ runner.temp }}\cyc-windows11-acceptance-artifact @@ -1634,7 +1634,7 @@ jobs: if ($matrixExitCode -ne 0) { throw "Windows profile/path matrix failed with exit code $matrixExitCode." } - name: Upload Windows 11 ARM64 compatibility diagnostics if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-windows11-arm64-compatibility-diagnostics path: ${{ runner.temp }}\cyc-windows11-acceptance-diagnostics\** @@ -1653,7 +1653,7 @@ jobs: CYC_PRODUCT_VERSION: ${{ needs.release-identity.outputs.product_version }} runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: downloaded-artifacts - name: Verify sidecars and assemble indexed release assets @@ -1901,7 +1901,7 @@ jobs: - id: provenance name: Attest every tagged prerelease payload asset with GitHub build provenance if: github.ref_type == 'tag' && needs.release-identity.outputs.source_tag != '' - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: provenance-subjects/* - name: Verify tagged provenance evidence exists before publication @@ -1942,7 +1942,7 @@ jobs: $combined = @($index.artifacts | Sort-Object name | ForEach-Object { "$($_.sha256) $($_.name)" }) $combined += "$indexHash release-index.json" $combined | Set-Content -LiteralPath (Join-Path $PWD 'release-assets/SHA256SUMS') -Encoding ASCII - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ClusterYourCodex-release-index-preview path: release-assets/* @@ -1961,11 +1961,11 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ClusterYourCodex-release-index-preview path: release-assets - - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: draft: false prerelease: ${{ needs.release-identity.outputs.release_channel != 'stable' }} diff --git a/.github/workflows/setup-acceptance.yml b/.github/workflows/setup-acceptance.yml index 3c1d39de..06cdcb57 100644 --- a/.github/workflows/setup-acceptance.yml +++ b/.github/workflows/setup-acceptance.yml @@ -28,17 +28,17 @@ jobs: run: shell: pwsh steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0 # 1.98.0 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: workspaces: | . -> target apps/desktop/src-tauri -> target - - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 11.0.8 - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.19.0 cache: pnpm @@ -97,7 +97,7 @@ jobs: -OutputPath (Join-Path $env:RUNNER_TEMP 'ClusterYourCodex-Setup.exe') ` -MakeNsisPath $makeNsis - name: Retain the exact installer for clean-VM verification - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-setup-candidate path: | @@ -133,7 +133,7 @@ jobs: } - name: Retain lifecycle evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: windows-setup-acceptance path: setup-evidence/