From 2a392a9b207fcb6fb8a10f126b5e4436b0f01d5b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 09:22:05 +0000 Subject: [PATCH 1/2] chore(deps): update actions/checkout action to v7 --- .github/workflows/azure-backend-acc.yml | 2 +- .github/workflows/azure-backend-production.yml | 2 +- .github/workflows/azure-frontend-acc.yml | 2 +- .github/workflows/azure-frontend-production.yml | 2 +- .github/workflows/azure-ropa-site-acc.yml | 2 +- .github/workflows/azure-ropa-site-prod.yml | 2 +- .github/workflows/zizmor.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/azure-backend-acc.yml b/.github/workflows/azure-backend-acc.yml index f7d2e78..2d6234b 100644 --- a/.github/workflows/azure-backend-acc.yml +++ b/.github/workflows/azure-backend-acc.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/azure-backend-production.yml b/.github/workflows/azure-backend-production.yml index 8f97567..78524da 100644 --- a/.github/workflows/azure-backend-production.yml +++ b/.github/workflows/azure-backend-production.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/azure-frontend-acc.yml b/.github/workflows/azure-frontend-acc.yml index b43ae5a..13fdacb 100644 --- a/.github/workflows/azure-frontend-acc.yml +++ b/.github/workflows/azure-frontend-acc.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-frontend-production.yml b/.github/workflows/azure-frontend-production.yml index 0e1df7b..331fbc7 100644 --- a/.github/workflows/azure-frontend-production.yml +++ b/.github/workflows/azure-frontend-production.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-ropa-site-acc.yml b/.github/workflows/azure-ropa-site-acc.yml index a39dc06..f349016 100644 --- a/.github/workflows/azure-ropa-site-acc.yml +++ b/.github/workflows/azure-ropa-site-acc.yml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/azure-ropa-site-prod.yml b/.github/workflows/azure-ropa-site-prod.yml index 6b6a49f..adb3ca1 100644 --- a/.github/workflows/azure-ropa-site-prod.yml +++ b/.github/workflows/azure-ropa-site-prod.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest name: Build and Deploy Job steps: - - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 21d59f1..d7a65dc 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -46,7 +46,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Node 24 for the config validator From 283cc607962f7895067c224d43713a1745c120d7 Mon Sep 17 00:00:00 2001 From: Steven Gort Date: Tue, 8 Sep 2026 11:30:59 +0200 Subject: [PATCH 2/2] docs(security): move the register to checkout v7.0.1 alongside this bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate maintains workflow pins and their version comments together; it does not touch SECURITY-PIPELINE.md. So this branch left the register describing a policy the workflows no longer follow, and check-supply-chain said so on the audit run for this pull request: [register] actions/checkout: workflow pins 3d3c42e5aac5… (v7.0.1) but SECURITY-PIPELINE.md records only 11d5960a3267… (v4.4.0), a37ce9120846… (v3.7.0) Pin truth passed there — Renovate's digest and its rewritten comment agree with each other and with GitHub. The check was right and the register was stale, which is exactly the drift it exists to catch. This is the first exercise of the habit recorded in SECURITY-PIPELINE.md under "Keeping this register true": the register is updated ON the bump's branch, before merging, so the check is green on the pull request rather than only on acc afterwards. Fixing it after the merge would leave the check red for the whole life of every such pull request and make the step impossible to promote to blocking, since no bump could present a green result to merge on. ── Beyond the table row ── Three passages went stale with it, and a register accurate in its table while wrong in its prose is still misleading: "Version currency" claimed the four ropa-site references sit at v3.7.0, four majors behind. All seven now pin v7.0.1. Rewritten to record what the gap was and to keep the point it was making — pinned is not current, and a hash ages silently. The #66 evidence block in "Keeping this register true" is reframed as the record of a caught drift rather than a live failure, since this commit is what resolves it. The split-pin paragraph described checkout as presently holding two rows. It no longer does. Rewritten in the past tense, with an added warning not to collapse such rows to tidy the table: an action at two digests is two distinct things to verify, and keying by action alone is precisely the bug fixed upstream in sgort/ttl-editor#86 before this repository could adopt the check at all. ── Verification ── npm run check-supply-chain on this branch: check-supply-chain: 23 pinned reference(s) across 5 action(s) note: Azure/static-web-apps-deploy@v1 verified against the branch, per its recorded exception OK — digests, version comments and the register all agree. Both orphan-row notes are gone with the rows. --- SECURITY-PIPELINE.md | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/SECURITY-PIPELINE.md b/SECURITY-PIPELINE.md index 416f3a7..1387acb 100644 --- a/SECURITY-PIPELINE.md +++ b/SECURITY-PIPELINE.md @@ -29,8 +29,7 @@ two together. | Action | Pinned at | Version | | ------------------------------ | ------------------------------------------ | ---------------- | -| `actions/checkout` | `11d5960a326750d5838078e36cf38b85af677262` | v4.4.0 | -| `actions/checkout` | `a37ce9120846195fa4ece8f58b268e6043cb2f26` | v3.7.0 | +| `actions/checkout` | `3d3c42e5aac5ba805825da76410c181273ba90b1` | v7.0.1 | | `actions/setup-node` | `49933ea5288caeca8642d1e84afbd3f7d6820020` | v4.4.0 | | `Azure/static-web-apps-deploy` | `4d27395796ac319302594769cfe812bd207490b1` | v1 (branch head) | | `azure/webapps-deploy` | `02a81bead70021f5284939794bcec79c271ab383` | v3.0.8 | @@ -106,10 +105,15 @@ there is nothing for it to resolve. Worth stating precisely, because ## Version currency -The four `ropa-site` action references pin `actions/checkout` at **v3.7.0**, -four majors behind. Pinned is not the same as current: a hash freezes a version -in place, including an old one. Renovate now raises these as upgrades under the -14-day cooldown, which is the intended way for them to move — deliberately, in a +All seven `actions/checkout` references now pin **v7.0.1**, converged in +[#66](https://github.com/sgort/linked-data-explorer/pull/66). Until then four of +them — the `ropa-site` workflows — sat at v3.7.0, four majors behind, while the +other three were on v4.4.0. + +That gap is the point worth keeping: pinned is not the same as current. A hash +freezes a version in place, including an old one, and nothing about the pin +itself complains as it ages. Renovate raises these as upgrades under the 14-day +cooldown, which is the intended way for them to move — deliberately, in a reviewable pull request, rather than silently on the next run. ## How the pins stay current @@ -157,25 +161,35 @@ the entire life of every such pull request — and makes the step impossible to promote to blocking, because no Renovate bump could ever show a green result to merge on. -Verified rather than assumed: run against -[#66](https://github.com/sgort/linked-data-explorer/pull/66) -(`actions/checkout` → v7.0.1) the check reports +Verified rather than assumed, and this table is the proof. When +[#66](https://github.com/sgort/linked-data-explorer/pull/66) was raised +(`actions/checkout` → v7.0.1) the check reported ``` [register] actions/checkout: workflow pins 3d3c42e5aac5… (v7.0.1) but SECURITY-PIPELINE.md records only 11d5960a3267… (v4.4.0), a37ce9120846… (v3.7.0) ``` -while pin truth passes. The check is right; the register is stale. +while pin truth passed — Renovate's digest and its rewritten comment agreed with +each other and with GitHub. The check was right and the register was stale. The +row above was updated on that pull request's branch, which is the habit this +section describes, and the check went green before it merged. The step is `continue-on-error: true` until that habit is established. See issue [#73](https://github.com/sgort/linked-data-explorer/issues/73). -An action may legitimately hold **more than one row** — `actions/checkout` sits -at v4.4.0 in three workflows and v3.7.0 in four, mid-upgrade — and the check -matches rows by digest precisely so a split pin is expressible. When the -workflows converge, the surplus row goes with them; the check reports a leftover -row as a note rather than a finding, so it will say so without failing. +An action may legitimately hold **more than one row**. Until #66 this table +carried two for `actions/checkout` — v4.4.0 in three workflows, v3.7.0 in four, +mid-upgrade — and the check matches rows by digest precisely so a split pin +stays expressible. Do not collapse such rows to tidy the table: an action at two +digests is two distinct things to verify, and keying by action alone is the bug +that had to be fixed upstream in +[ttl-editor#86](https://github.com/sgort/ttl-editor/pull/86) before this +repository could adopt the check at all. + +When workflows converge, the surplus row goes with them, as it did here. A +leftover row is reported as a note rather than a finding, so the check says so +without failing. ## How the rule is enforced