From c3a4fae6067aec51a69d2336a2a0ed5e4d12b850 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 24 Oct 2026 01:46:02 +0000 Subject: [PATCH] chore(deps): update github-actions --- .github/actions/ai-pr-review/action.yml | 4 ++-- .github/actions/comment-triggered-check/action.yml | 2 +- .github/actions/cve-scan/action.yml | 2 +- .github/actions/govulncheck/action.yml | 2 +- .github/actions/prerelease-setup/action.yml | 2 +- .github/actions/promote-release/action.yml | 4 ++-- .github/actions/secret-broker-request/action.yml | 2 +- .github/workflows/actionlint.yaml | 2 +- .github/workflows/claude-code-review.yaml | 2 +- .github/workflows/claude.yaml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/test-linear-cve-summary.yaml | 2 +- .github/workflows/test-release-notification.yaml | 2 +- .github/workflows/test-release-summary.yaml | 2 +- .github/workflows/test-secret-broker-request.yaml | 2 +- .github/workflows/test-secret-broker-response.yaml | 2 +- 16 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/actions/ai-pr-review/action.yml b/.github/actions/ai-pr-review/action.yml index abbdc33c..83e1fa92 100644 --- a/.github/actions/ai-pr-review/action.yml +++ b/.github/actions/ai-pr-review/action.yml @@ -95,7 +95,7 @@ runs: - name: Claude PR review if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic' - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1.0.233 + uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1.0.261 with: anthropic_api_key: ${{ inputs.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret github_token: ${{ inputs.github-token }} @@ -144,7 +144,7 @@ runs: - name: Codex PR review id: codex if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai' - uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.12 + uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13 with: openai-api-key: ${{ inputs.openai-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret model: ${{ steps.cfg.outputs.model }} diff --git a/.github/actions/comment-triggered-check/action.yml b/.github/actions/comment-triggered-check/action.yml index c13af0a8..e80f1d7e 100644 --- a/.github/actions/comment-triggered-check/action.yml +++ b/.github/actions/comment-triggered-check/action.yml @@ -190,7 +190,7 @@ runs: id: app-token if: inputs.app-client-id != '' && inputs.app-private-key != '' continue-on-error: true - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ inputs.app-client-id }} private-key: ${{ inputs.app-private-key }} diff --git a/.github/actions/cve-scan/action.yml b/.github/actions/cve-scan/action.yml index 1d200d8a..36b45dbc 100644 --- a/.github/actions/cve-scan/action.yml +++ b/.github/actions/cve-scan/action.yml @@ -118,7 +118,7 @@ runs: - name: Log in to the image registry if: inputs.registry-password != '' && !contains(fromJSON('["false","no","0","off"]'), inputs.enabled) - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 # A registry that can't be reached is inconclusive, not a finding, so this # must not fail the caller's job — run.sh classifies the pull failure that # follows. See README, "Three failure modes". diff --git a/.github/actions/govulncheck/action.yml b/.github/actions/govulncheck/action.yml index 20d8be03..80543f1b 100644 --- a/.github/actions/govulncheck/action.yml +++ b/.github/actions/govulncheck/action.yml @@ -85,7 +85,7 @@ runs: steps.govulncheck.conclusion == 'failure' && inputs.notify == 'true' && github.event_name == 'schedule' - uses: loft-sh/github-actions/.github/actions/ci-test-notify@c6a76f19cc302d63d1631853496bce5bf76a4e0a # ci-test-notify/v1 + uses: loft-sh/github-actions/.github/actions/ci-test-notify@d15a1df8ea70c58cf70343f7c3687a6014ed63f8 # ci-test-notify/v1 with: test-name: ${{ inputs.test-name }} status: failure diff --git a/.github/actions/prerelease-setup/action.yml b/.github/actions/prerelease-setup/action.yml index f585ca17..b5cda3a9 100644 --- a/.github/actions/prerelease-setup/action.yml +++ b/.github/actions/prerelease-setup/action.yml @@ -62,7 +62,7 @@ runs: cache: true - name: Setup kubectl - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0 + uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0 - name: Setup helm uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 diff --git a/.github/actions/promote-release/action.yml b/.github/actions/promote-release/action.yml index 2c429814..7923532f 100644 --- a/.github/actions/promote-release/action.yml +++ b/.github/actions/promote-release/action.yml @@ -138,7 +138,7 @@ runs: # two modes get their own step. - name: Log in to GHCR if: inputs.dry-run != 'true' - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ inputs.docker-username }} @@ -151,7 +151,7 @@ runs: id: ghcr-login-rehearsal if: inputs.dry-run == 'true' continue-on-error: true - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ inputs.docker-username }} diff --git a/.github/actions/secret-broker-request/action.yml b/.github/actions/secret-broker-request/action.yml index 70a481ea..06c2ca37 100644 --- a/.github/actions/secret-broker-request/action.yml +++ b/.github/actions/secret-broker-request/action.yml @@ -29,7 +29,7 @@ runs: - name: Create organization membership token id: app-token if: ${{ inputs.authorization == '' }} - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ inputs.app-client-id }} private-key: ${{ inputs.app-private-key }} diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml index 5a73459a..7f3ff305 100644 --- a/.github/workflows/actionlint.yaml +++ b/.github/workflows/actionlint.yaml @@ -35,7 +35,7 @@ jobs: - name: Run actionlint with reviewdog if: steps.changed-files.outputs.workflows == 'true' - uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1.77.0 + uses: reviewdog/action-actionlint@48e36f54d8da326b83ab061aee2cc5e01b5ca46f # v1.80.6 with: github_token: ${{ secrets.GITHUB_TOKEN }} reporter: ${{ inputs.reporter }} diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml index 4d36d772..ff72ed2d 100644 --- a/.github/workflows/claude-code-review.yaml +++ b/.github/workflows/claude-code-review.yaml @@ -54,7 +54,7 @@ jobs: git checkout -B "${PR_HEAD_REF}" "origin/${PR_HEAD_REF}" - name: Claude Code Review - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml index 05e65675..d822e6c9 100644 --- a/.github/workflows/claude.yaml +++ b/.github/workflows/claude.yaml @@ -27,6 +27,6 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index dd066809..dae373e7 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -33,7 +33,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env] -- OAuth token for Claude, no dedicated environment needed diff --git a/.github/workflows/test-linear-cve-summary.yaml b/.github/workflows/test-linear-cve-summary.yaml index 8add01d5..92192fa6 100644 --- a/.github/workflows/test-linear-cve-summary.yaml +++ b/.github/workflows/test-linear-cve-summary.yaml @@ -18,7 +18,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Run Linear CVE summary tests run: uv run --with pytest==8.3.3 pytest .github/actions/linear-cve-summary/test/ -q - name: Start fake Linear server diff --git a/.github/workflows/test-release-notification.yaml b/.github/workflows/test-release-notification.yaml index eba08d0b..83cac7f8 100644 --- a/.github/workflows/test-release-notification.yaml +++ b/.github/workflows/test-release-notification.yaml @@ -26,7 +26,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Run release-notification pytest run: uv run --with pytest==8.3.3 pytest .github/actions/release-notification/test/ -q diff --git a/.github/workflows/test-release-summary.yaml b/.github/workflows/test-release-summary.yaml index 362356e4..83d97bab 100644 --- a/.github/workflows/test-release-summary.yaml +++ b/.github/workflows/test-release-summary.yaml @@ -22,7 +22,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Run release-summary pytest run: uv run --with pytest==8.3.3 pytest .github/actions/release-summary/test/ -q diff --git a/.github/workflows/test-secret-broker-request.yaml b/.github/workflows/test-secret-broker-request.yaml index 438a1da2..ddd84379 100644 --- a/.github/workflows/test-secret-broker-request.yaml +++ b/.github/workflows/test-secret-broker-request.yaml @@ -18,6 +18,6 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Run secret broker request tests run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-request/test/ -q diff --git a/.github/workflows/test-secret-broker-response.yaml b/.github/workflows/test-secret-broker-response.yaml index 72952f96..0c630693 100644 --- a/.github/workflows/test-secret-broker-response.yaml +++ b/.github/workflows/test-secret-broker-response.yaml @@ -18,6 +18,6 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 - name: Run secret broker response tests run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-response/test/ -q