diff --git a/.github/workflows/azure-backend-acc.yml b/.github/workflows/azure-backend-acc.yml index f7d2e78..2d6234b 100644 --- a/.github/workflows/azure-backend-acc.yml +++ b/.github/workflows/azure-backend-acc.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/azure-backend-production.yml b/.github/workflows/azure-backend-production.yml index 8f97567..78524da 100644 --- a/.github/workflows/azure-backend-production.yml +++ b/.github/workflows/azure-backend-production.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/azure-frontend-acc.yml b/.github/workflows/azure-frontend-acc.yml index b43ae5a..13fdacb 100644 --- a/.github/workflows/azure-frontend-acc.yml +++ b/.github/workflows/azure-frontend-acc.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-frontend-production.yml b/.github/workflows/azure-frontend-production.yml index 0e1df7b..331fbc7 100644 --- a/.github/workflows/azure-frontend-production.yml +++ b/.github/workflows/azure-frontend-production.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-ropa-site-acc.yml b/.github/workflows/azure-ropa-site-acc.yml index a39dc06..f349016 100644 --- a/.github/workflows/azure-ropa-site-acc.yml +++ b/.github/workflows/azure-ropa-site-acc.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-ropa-site-prod.yml b/.github/workflows/azure-ropa-site-prod.yml index 6b6a49f..adb3ca1 100644 --- a/.github/workflows/azure-ropa-site-prod.yml +++ b/.github/workflows/azure-ropa-site-prod.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 21d59f1..d7a65dc 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -46,7 +46,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Node 24 for the config validator diff --git a/SECURITY-PIPELINE.md b/SECURITY-PIPELINE.md index 416f3a7..1387acb 100644 --- a/SECURITY-PIPELINE.md +++ b/SECURITY-PIPELINE.md @@ -29,8 +29,7 @@ two together. | Action | Pinned at | Version | | ------------------------------ | ------------------------------------------ | ---------------- | -| `actions/checkout` | `11d5960a326750d5838078e36cf38b85af677262` | v4.4.0 | -| `actions/checkout` | `a37ce9120846195fa4ece8f58b268e6043cb2f26` | v3.7.0 | +| `actions/checkout` | `3d3c42e5aac5ba805825da76410c181273ba90b1` | v7.0.1 | | `actions/setup-node` | `49933ea5288caeca8642d1e84afbd3f7d6820020` | v4.4.0 | | `Azure/static-web-apps-deploy` | `4d27395796ac319302594769cfe812bd207490b1` | v1 (branch head) | | `azure/webapps-deploy` | `02a81bead70021f5284939794bcec79c271ab383` | v3.0.8 | @@ -106,10 +105,15 @@ there is nothing for it to resolve. Worth stating precisely, because ## Version currency -The four `ropa-site` action references pin `actions/checkout` at **v3.7.0**, -four majors behind. Pinned is not the same as current: a hash freezes a version -in place, including an old one. Renovate now raises these as upgrades under the -14-day cooldown, which is the intended way for them to move — deliberately, in a +All seven `actions/checkout` references now pin **v7.0.1**, converged in +[#66](https://github.com/sgort/linked-data-explorer/pull/66). Until then four of +them — the `ropa-site` workflows — sat at v3.7.0, four majors behind, while the +other three were on v4.4.0. + +That gap is the point worth keeping: pinned is not the same as current. A hash +freezes a version in place, including an old one, and nothing about the pin +itself complains as it ages. Renovate raises these as upgrades under the 14-day +cooldown, which is the intended way for them to move — deliberately, in a reviewable pull request, rather than silently on the next run. ## How the pins stay current @@ -157,25 +161,35 @@ the entire life of every such pull request — and makes the step impossible to promote to blocking, because no Renovate bump could ever show a green result to merge on. -Verified rather than assumed: run against -[#66](https://github.com/sgort/linked-data-explorer/pull/66) -(`actions/checkout` → v7.0.1) the check reports +Verified rather than assumed, and this table is the proof. When +[#66](https://github.com/sgort/linked-data-explorer/pull/66) was raised +(`actions/checkout` → v7.0.1) the check reported ``` [register] actions/checkout: workflow pins 3d3c42e5aac5… (v7.0.1) but SECURITY-PIPELINE.md records only 11d5960a3267… (v4.4.0), a37ce9120846… (v3.7.0) ``` -while pin truth passes. The check is right; the register is stale. +while pin truth passed — Renovate's digest and its rewritten comment agreed with +each other and with GitHub. The check was right and the register was stale. The +row above was updated on that pull request's branch, which is the habit this +section describes, and the check went green before it merged. The step is `continue-on-error: true` until that habit is established. See issue [#73](https://github.com/sgort/linked-data-explorer/issues/73). -An action may legitimately hold **more than one row** — `actions/checkout` sits -at v4.4.0 in three workflows and v3.7.0 in four, mid-upgrade — and the check -matches rows by digest precisely so a split pin is expressible. When the -workflows converge, the surplus row goes with them; the check reports a leftover -row as a note rather than a finding, so it will say so without failing. +An action may legitimately hold **more than one row**. Until #66 this table +carried two for `actions/checkout` — v4.4.0 in three workflows, v3.7.0 in four, +mid-upgrade — and the check matches rows by digest precisely so a split pin +stays expressible. Do not collapse such rows to tidy the table: an action at two +digests is two distinct things to verify, and keying by action alone is the bug +that had to be fixed upstream in +[ttl-editor#86](https://github.com/sgort/ttl-editor/pull/86) before this +repository could adopt the check at all. + +When workflows converge, the surplus row goes with them, as it did here. A +leftover row is reported as a note rather than a finding, so the check says so +without failing. ## How the rule is enforced