From b92e0164b2b0e2227bf3cee1de411a497ccfd047 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 24 Sep 2026 13:05:35 +0000 Subject: [PATCH] chore(deps): update github-actions --- .github/actions/ai-pr-review/action.yml | 4 ++-- .github/actions/cve-scan/action.yml | 2 +- .github/actions/govulncheck/action.yml | 2 +- .github/actions/prerelease-setup/action.yml | 4 ++-- .github/actions/promote-release/action.yml | 4 ++-- .github/actions/publish-helm-chart/action.yml | 2 +- .github/workflows/actionlint.yaml | 4 ++-- .github/workflows/ci.yaml | 2 +- .github/workflows/claude-code-review.yaml | 2 +- .github/workflows/claude.yaml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/detect-changes.yaml | 2 +- .github/workflows/validate-renovate.yaml | 2 +- 13 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/actions/ai-pr-review/action.yml b/.github/actions/ai-pr-review/action.yml index f68dbbc2..abbdc33c 100644 --- a/.github/actions/ai-pr-review/action.yml +++ b/.github/actions/ai-pr-review/action.yml @@ -95,7 +95,7 @@ runs: - name: Claude PR review if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic' - uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1.0.121 + uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1.0.233 with: anthropic_api_key: ${{ inputs.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret github_token: ${{ inputs.github-token }} @@ -144,7 +144,7 @@ runs: - name: Codex PR review id: codex if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai' - uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1 # v1.8 + uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.12 with: openai-api-key: ${{ inputs.openai-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret model: ${{ steps.cfg.outputs.model }} diff --git a/.github/actions/cve-scan/action.yml b/.github/actions/cve-scan/action.yml index f0041c35..e7fd59c3 100644 --- a/.github/actions/cve-scan/action.yml +++ b/.github/actions/cve-scan/action.yml @@ -119,7 +119,7 @@ runs: - name: Log in to the image registry if: inputs.registry-password != '' && !contains(fromJSON('["false","no","0","off"]'), inputs.enabled) - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 # A registry that can't be reached is inconclusive, not a finding, so this # must not fail the caller's job — run.sh classifies the pull failure that # follows. See README, "Three failure modes". diff --git a/.github/actions/govulncheck/action.yml b/.github/actions/govulncheck/action.yml index 5c8c5a0f..f005475b 100644 --- a/.github/actions/govulncheck/action.yml +++ b/.github/actions/govulncheck/action.yml @@ -88,7 +88,7 @@ runs: steps.govulncheck.conclusion == 'failure' && inputs.notify == 'true' && github.event_name == 'schedule' - uses: loft-sh/github-actions/.github/actions/ci-test-notify@85d7023c5749421d369f59430c7849f2d00ad694 # ci-test-notify/v1 + uses: loft-sh/github-actions/.github/actions/ci-test-notify@d462e847d4f8f4a139890264a35b68cc30472547 # ci-test-notify/v1 with: test-name: ${{ inputs.test-name }} status: failure diff --git a/.github/actions/prerelease-setup/action.yml b/.github/actions/prerelease-setup/action.yml index f42b231e..f585ca17 100644 --- a/.github/actions/prerelease-setup/action.yml +++ b/.github/actions/prerelease-setup/action.yml @@ -65,10 +65,10 @@ runs: uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0 - name: Setup helm - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 + uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 - name: AWS Login - uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: arn:aws:iam::084374023943:role/e2e-test-executor role-session-name: ${{ inputs.role-session-name }} diff --git a/.github/actions/promote-release/action.yml b/.github/actions/promote-release/action.yml index 2edc73ef..1cff8963 100644 --- a/.github/actions/promote-release/action.yml +++ b/.github/actions/promote-release/action.yml @@ -133,7 +133,7 @@ runs: # two modes get their own step. - name: Log in to GHCR if: inputs.dry-run != 'true' - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ inputs.docker-username }} @@ -146,7 +146,7 @@ runs: id: ghcr-login-rehearsal if: inputs.dry-run == 'true' continue-on-error: true - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ inputs.docker-username }} diff --git a/.github/actions/publish-helm-chart/action.yml b/.github/actions/publish-helm-chart/action.yml index 22a7dd8c..d7a47d0c 100644 --- a/.github/actions/publish-helm-chart/action.yml +++ b/.github/actions/publish-helm-chart/action.yml @@ -51,7 +51,7 @@ runs: using: "composite" steps: - name: Set up Helm - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 + uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: version: ${{ inputs.helm-version }} diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml index bc2cca63..5a73459a 100644 --- a/.github/workflows/actionlint.yaml +++ b/.github/workflows/actionlint.yaml @@ -26,7 +26,7 @@ jobs: - name: Get changed workflow files id: changed-files - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: filters: | workflows: @@ -35,7 +35,7 @@ jobs: - name: Run actionlint with reviewdog if: steps.changed-files.outputs.workflows == 'true' - uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0 + uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1.77.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} reporter: ${{ inputs.reporter }} diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f8f4def0..66b92f91 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -13,7 +13,7 @@ jobs: permissions: contents: read pull-requests: read - uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@53686d2452bc48398252887a37ad248c38a7f1eb # validate-renovate/v1 + uses: loft-sh/github-actions/.github/workflows/validate-renovate.yaml@de873f42f6bd67603325e0ec2acf5c0e4ff9678a # validate-renovate/v1 actionlint: runs-on: ubuntu-latest diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml index ba3a6632..4d36d772 100644 --- a/.github/workflows/claude-code-review.yaml +++ b/.github/workflows/claude-code-review.yaml @@ -54,7 +54,7 @@ jobs: git checkout -B "${PR_HEAD_REF}" "origin/${PR_HEAD_REF}" - name: Claude Code Review - uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1 + uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml index 593b9d41..05e65675 100644 --- a/.github/workflows/claude.yaml +++ b/.github/workflows/claude.yaml @@ -27,6 +27,6 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1 + uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index ad52b588..dd066809 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -33,7 +33,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@f4fb5c6cdccc1ee7af63692f5d08d56efaa64cc8 # v1 + uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env] -- OAuth token for Claude, no dedicated environment needed diff --git a/.github/workflows/detect-changes.yaml b/.github/workflows/detect-changes.yaml index ea608b0d..6ad7bd52 100644 --- a/.github/workflows/detect-changes.yaml +++ b/.github/workflows/detect-changes.yaml @@ -28,7 +28,7 @@ jobs: - name: Filter paths id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: base: ${{ github.event_name == 'push' && github.event.before || '' }} filters: | diff --git a/.github/workflows/validate-renovate.yaml b/.github/workflows/validate-renovate.yaml index f33bc337..d54871f8 100644 --- a/.github/workflows/validate-renovate.yaml +++ b/.github/workflows/validate-renovate.yaml @@ -18,7 +18,7 @@ jobs: - name: Get changed Renovate config files id: changed-files - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: filters: | renovate: