From de83969f1c99bc33f9368c57d9da80fda05d9db6 Mon Sep 17 00:00:00 2001 From: theghost5800 Date: Fri, 23 Oct 2026 13:14:20 +0300 Subject: [PATCH 1/2] Upgrade GitHub Actions to latest versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump all GitHub Actions steps to their latest stable versions, pinned to exact commit SHAs with version comments for supply-chain security. Changes per workflow: - codeql.yml: checkout v3→v7.0.1, setup-java v3→v6.1.0, codeql-action/* v4→v4.39.1 - main.yml: checkout v4.2.2→v7.0.1, setup-java v4.7.0→v6.1.0 - pull-request-build.yml: checkout v4.2.2→v7.0.1, setup-java v4.7.0→v6.1.0, cache v4.2.3→v6.1.0 - sonar-scan.yml: checkout v4.2.2→v7.0.1, setup-java v4.7.0→v6.1.0 - check-commit-message.yml: github-script v7.0.1→v9.0.0 All SHAs verified against the upstream GitHub repositories. JIRA:LMCROSSITXSADEPLOY-3714 --- .github/workflows/check-commit-message.yml | 2 +- .github/workflows/codeql.yml | 10 +++++----- .github/workflows/main.yml | 4 ++-- .github/workflows/pull-request-build.yml | 6 +++--- .github/workflows/sonar-scan.yml | 4 ++-- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/check-commit-message.yml b/.github/workflows/check-commit-message.yml index c2bca464..cc5602ed 100644 --- a/.github/workflows/check-commit-message.yml +++ b/.github/workflows/check-commit-message.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Check Commit Message id: commits - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const prNumber = context.payload.pull_request.number; diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 79e125ae..25ad0c28 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,17 +46,17 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: 25 distribution: 'zulu' # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -70,7 +70,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 # ℹ️ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -83,6 +83,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6d29b384..a91835ad 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -11,9 +11,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 25 - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: '25' distribution: 'zulu' diff --git a/.github/workflows/pull-request-build.yml b/.github/workflows/pull-request-build.yml index ce2cf02c..aa603ff6 100644 --- a/.github/workflows/pull-request-build.yml +++ b/.github/workflows/pull-request-build.yml @@ -13,15 +13,15 @@ jobs: name: Build and analyze runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 25 - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: '25' distribution: 'zulu' - name: Cache Maven packages - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.m2 key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml index 03d91b79..865bc0f5 100644 --- a/.github/workflows/sonar-scan.yml +++ b/.github/workflows/sonar-scan.yml @@ -14,9 +14,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 25 - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: java-version: '25' distribution: 'zulu' From f10b0e9c9415cf0d7962296d697e75d1c2eef22e Mon Sep 17 00:00:00 2001 From: theghost5800 Date: Mon, 26 Oct 2026 16:00:03 +0200 Subject: [PATCH 2/2] Scan for new maven and github-action dependencies --- .github/dependabot.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..5bc3e8c9 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +version: 2 +updates: + - package-ecosystem: "maven" + directory: "/" + schedule: + interval: "cron" + # 1st and 3rd Wednesday of every month (biweekly approximation): + # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday + cronjob: "0 0 1-7,15-21 * 3" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "cron" + # 1st and 3rd Wednesday of every month (biweekly approximation): + # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday + cronjob: "0 0 1-7,15-21 * 3"