From 15fce4d786ee03da4d53b55f8c2c1b2c25666e8b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 04:15:15 +0000 Subject: [PATCH] chore(ci): bump the github-actions group with 5 updates Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.24` | `2.87.27` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `taiki-e/install-action` from 2.87.24 to 2.87.27 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/e407f7bafb71fd004bc5c2da3032e5470cbb6ef0...ab6895351a88b908e96a4697860d4ffea5e57dbe) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/apidocs-drift.yml | 2 +- .github/workflows/ci.yml | 8 +++--- .github/workflows/coreutils-args-drift.yml | 4 +-- .github/workflows/coverage.yml | 18 ++++++------- .github/workflows/debian-oracle.yml | 2 +- .github/workflows/fuzz.yml | 2 +- .github/workflows/js.yml | 6 ++--- .github/workflows/nightly.yml | 6 ++--- .github/workflows/publish-js.yml | 30 +++++++++++----------- .github/workflows/publish-python.yml | 16 ++++++------ .github/workflows/publish-wasm.yml | 6 ++--- .github/workflows/python.yml | 10 ++++---- .github/workflows/site.yml | 4 +-- 13 files changed, 57 insertions(+), 57 deletions(-) diff --git a/.github/workflows/apidocs-drift.yml b/.github/workflows/apidocs-drift.yml index ebe8ae7ad..28bbe3950 100644 --- a/.github/workflows/apidocs-drift.yml +++ b/.github/workflows/apidocs-drift.yml @@ -90,7 +90,7 @@ jobs: with: version: 10.33.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" cache: pnpm diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d117cc5d0..0b031c7c0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -185,7 +185,7 @@ jobs: # override even for `cargo install`), which broke this job. A prebuilt # binary is immune to future tool-dependency MSRV bumps. - name: Install cargo-audit - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: cargo-audit @@ -199,7 +199,7 @@ jobs: version: 10.33.0 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" @@ -218,7 +218,7 @@ jobs: command: check licenses sources - name: Install cargo-vet - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: # 0.10.2+ parses trusted-publisher entries in imports.lock (wasmtime # crates publish via GitHub trusted publishing); 0.10.0 rejects them. @@ -262,7 +262,7 @@ jobs: - name: Install uutils coreutils multicall for differential tests id: install_uutils continue-on-error: true - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: coreutils - name: Verify uutils on PATH diff --git a/.github/workflows/coreutils-args-drift.yml b/.github/workflows/coreutils-args-drift.yml index 7baf9ebee..0d5c822aa 100644 --- a/.github/workflows/coreutils-args-drift.yml +++ b/.github/workflows/coreutils-args-drift.yml @@ -227,7 +227,7 @@ jobs: - name: Upload drift patch if: steps.diff.outputs.drifted == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: coreutils-drift-patch path: ${{ runner.temp }}/coreutils-drift.patch @@ -251,7 +251,7 @@ jobs: persist-credentials: false - name: Download drift patch - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: coreutils-drift-patch path: ${{ runner.temp }}/coreutils-drift diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 92fb2997a..53a179663 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -39,7 +39,7 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - name: Install cargo-tarpaulin - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: cargo-tarpaulin @@ -69,7 +69,7 @@ jobs: --engine llvm - name: Upload coverage artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: rust-coverage-report path: coverage/ @@ -94,7 +94,7 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: cargo-llvm-cov @@ -102,7 +102,7 @@ jobs: with: python-version: "3.12" - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Generate Python-driven Rust coverage run: | @@ -122,7 +122,7 @@ jobs: --ignore-filename-regex "$LLVM_COV_IGNORE_FILENAME_REGEX" - name: Upload Python coverage artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: python-rust-coverage-report path: coverage/python-rust-coverage.json @@ -145,7 +145,7 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: cargo-llvm-cov @@ -155,7 +155,7 @@ jobs: version: 10.33.0 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" cache: pnpm @@ -183,7 +183,7 @@ jobs: --ignore-filename-regex "$LLVM_COV_IGNORE_FILENAME_REGEX" - name: Upload Node coverage artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: node-rust-coverage-report path: coverage/node-rust-coverage.json @@ -198,7 +198,7 @@ jobs: contents: read actions: read steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: "*-coverage-report" merge-multiple: true diff --git a/.github/workflows/debian-oracle.yml b/.github/workflows/debian-oracle.yml index 73e73a381..ffe6f8b82 100644 --- a/.github/workflows/debian-oracle.yml +++ b/.github/workflows/debian-oracle.yml @@ -53,7 +53,7 @@ jobs: - name: Upload failing cases if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: debian-oracle-fails path: | diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 21bb2baf9..93e91342b 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -68,7 +68,7 @@ jobs: - name: Upload crash artifacts if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: fuzz-crashes-${{ matrix.target }} path: | diff --git a/.github/workflows/js.yml b/.github/workflows/js.yml index 87f8b3731..6086e1af8 100644 --- a/.github/workflows/js.yml +++ b/.github/workflows/js.yml @@ -52,7 +52,7 @@ jobs: version: 10.33.0 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" cache: pnpm @@ -122,7 +122,7 @@ jobs: - name: Setup Node.js if: matrix.runtime == 'node' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: ${{ matrix.version }} cache: pnpm @@ -132,7 +132,7 @@ jobs: - name: Setup Node.js (for napi build) if: matrix.runtime != 'node' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" cache: pnpm diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6fbf5e549..d6312e570 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -62,7 +62,7 @@ jobs: # dependencies resolve unlocked, and an MSRV bump in one of them past our # pinned toolchain broke this step once already in CI. - name: Install cargo-audit - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2 + uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2 with: tool: cargo-audit @@ -74,7 +74,7 @@ jobs: version: 10.33.0 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" @@ -107,7 +107,7 @@ jobs: continue-on-error: true - name: Upload geiger report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: geiger-report path: geiger-report.txt diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml index b2ed9b0f2..38057dfe7 100644 --- a/.github/workflows/publish-js.yml +++ b/.github/workflows/publish-js.yml @@ -91,7 +91,7 @@ jobs: version: 10.33.0 - name: Setup node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: 24 cache: pnpm @@ -124,7 +124,7 @@ jobs: working-directory: crates/bashkit-js - name: Upload native binding - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: js-bindings-${{ matrix.settings.target }} path: | @@ -135,7 +135,7 @@ jobs: # Upload generated JS stubs from one build (they're identical across targets) - if: ${{ matrix.settings.target == 'x86_64-unknown-linux-gnu' }} name: Upload JS stubs - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: js-stubs path: | @@ -195,7 +195,7 @@ jobs: version: 10.33.0 - name: Setup node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: ${{ matrix.node }} cache: pnpm @@ -207,13 +207,13 @@ jobs: working-directory: crates/bashkit-js - name: Download native binding - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: js-bindings-${{ matrix.settings.target }} path: crates/bashkit-js - name: Download JS stubs - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: js-stubs path: crates/bashkit-js @@ -318,7 +318,7 @@ jobs: version: 10.33.0 - name: Setup node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: ${{ matrix.node }} cache: pnpm @@ -347,13 +347,13 @@ jobs: working-directory: crates/bashkit-js - name: Download native binding - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: js-bindings-${{ matrix.target }} path: crates/bashkit-js - name: Download JS stubs - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: js-stubs path: crates/bashkit-js @@ -443,7 +443,7 @@ jobs: # with: # version: 10.33.0 # - name: Setup node - # uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + # uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 # with: # node-version: 24 # cache: pnpm @@ -452,12 +452,12 @@ jobs: # run: pnpm install --frozen-lockfile --cpu wasm32 # working-directory: crates/bashkit-js # - name: Download native binding - # uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + # uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 # with: # name: js-bindings-wasm32-wasip1-threads # path: crates/bashkit-js # - name: Download JS stubs - # uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + # uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 # with: # name: js-stubs # path: crates/bashkit-js @@ -502,7 +502,7 @@ jobs: version: 10.33.0 - name: Setup node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: 24 cache: pnpm @@ -514,14 +514,14 @@ jobs: working-directory: crates/bashkit-js - name: Download all native bindings - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: js-bindings-* merge-multiple: true path: crates/bashkit-js - name: Download JS stubs - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: js-stubs path: crates/bashkit-js diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml index 9a43fa46b..2dbe6a5ce 100644 --- a/.github/workflows/publish-python.yml +++ b/.github/workflows/publish-python.yml @@ -45,7 +45,7 @@ jobs: rust-toolchain: stable working-directory: crates/bashkit-python - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: pypi_files-sdist path: crates/bashkit-python/dist @@ -115,7 +115,7 @@ jobs: docker-options: -e CI working-directory: crates/bashkit-python - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: pypi_files-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'manylinux' }} path: crates/bashkit-python/dist @@ -168,7 +168,7 @@ jobs: RUSTUP_TOOLCHAIN: ${{ env.RUST_NIGHTLY }} run: pyodide build --outdir dist - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: pypi_files-emscripten path: crates/bashkit-python/dist @@ -211,7 +211,7 @@ jobs: fi echo "Publish source verified: $SOURCE_SHA at v$TAG_VERSION" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: pypi_files-* merge-multiple: true @@ -223,7 +223,7 @@ jobs: echo "---" echo "Total files: $(ls -1 dist/ | wc -l)" - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - run: uvx twine check dist/* # Smoke-test the single cp39-abi3 wheel on every targeted Python version. @@ -252,7 +252,7 @@ jobs: with: python-version: ${{ matrix.python-version }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: pypi_files-${{ matrix.os }}-* merge-multiple: true @@ -278,7 +278,7 @@ jobs: id-token: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: pattern: pypi_files-* merge-multiple: true @@ -287,7 +287,7 @@ jobs: - name: List dist files run: ls -lhR dist/ - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Publish to PyPI run: uv publish --trusted-publishing always dist/* diff --git a/.github/workflows/publish-wasm.yml b/.github/workflows/publish-wasm.yml index 2c700e5b5..a178a4945 100644 --- a/.github/workflows/publish-wasm.yml +++ b/.github/workflows/publish-wasm.yml @@ -73,7 +73,7 @@ jobs: run: node --test "crates/bashkit-wasm/__test__/*.test.mjs" - name: Upload pkg - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: web-pkg path: crates/bashkit-wasm/pkg @@ -101,13 +101,13 @@ jobs: fi - name: Setup node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: 24 registry-url: "https://registry.npmjs.org" - name: Download pkg - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: web-pkg path: pkg diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index f6ee3a301..7f93145bc 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -44,7 +44,7 @@ jobs: with: persist-credentials: false - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Ruff check run: uvx ruff check crates/bashkit-python @@ -85,7 +85,7 @@ jobs: # The single abi3 wheel produced once by build-wheel; install it on each # version to prove one wheel runs across the whole 3.9–3.14 range. - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: python-wheel path: crates/bashkit-python/dist @@ -132,7 +132,7 @@ jobs: with: python-version: "3.12" - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0 @@ -198,7 +198,7 @@ jobs: pip install twine twine check crates/bashkit-python/dist/* - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: python-wheel path: crates/bashkit-python/dist @@ -285,7 +285,7 @@ jobs: print('wasm smoke test OK') " - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: python-wheel-emscripten path: crates/bashkit-python/dist diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index aa64512de..891c6a704 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -42,7 +42,7 @@ jobs: with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" - name: Verify docs route metadata @@ -64,7 +64,7 @@ jobs: with: version: 10.11.1 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 with: node-version: "22" cache: pnpm