diff --git a/.github/workflows/reusable-ci-container.yml b/.github/workflows/reusable-ci-container.yml index ca42856..cca424c 100644 --- a/.github/workflows/reusable-ci-container.yml +++ b/.github/workflows/reusable-ci-container.yml @@ -106,14 +106,14 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: Set up QEMU - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to GHCR if: inputs.push - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -121,7 +121,7 @@ jobs: - name: Extract image metadata id: meta - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ inputs.image-name }} tags: | @@ -134,7 +134,7 @@ jobs: # Step A: always build linux/amd64 and load it locally for Trivy. - name: Build (linux/amd64, local load for scan) id: build-local - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} file: ${{ inputs.dockerfile }} @@ -161,7 +161,7 @@ jobs: - name: Upload Trivy SARIF to GitHub Security tab if: inputs.scan-severity != '' && always() - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: sarif_file: trivy-results.sarif category: trivy-container @@ -170,7 +170,7 @@ jobs: - name: Build & push (multi-platform) id: push if: inputs.push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} file: ${{ inputs.dockerfile }} @@ -204,7 +204,7 @@ jobs: uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Log in to GHCR - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/reusable-ci-docker.yml b/.github/workflows/reusable-ci-docker.yml index 9e88977..00f20c9 100644 --- a/.github/workflows/reusable-ci-docker.yml +++ b/.github/workflows/reusable-ci-docker.yml @@ -73,7 +73,7 @@ jobs: with: fetch-depth: 0 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | docker: @@ -181,7 +181,7 @@ jobs: "${IMAGE_NAME}:ci" - name: Upload Trivy SARIF to GitHub Security tab - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: sarif_file: trivy-results.sarif category: trivy-docker diff --git a/.github/workflows/reusable-ci-opentofu.yml b/.github/workflows/reusable-ci-opentofu.yml index ffacb10..a526d05 100644 --- a/.github/workflows/reusable-ci-opentofu.yml +++ b/.github/workflows/reusable-ci-opentofu.yml @@ -88,7 +88,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: Setup OpenTofu - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2.0.1 + uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 with: tofu_version: ${{ inputs.tofu-version }} @@ -132,7 +132,7 @@ jobs: - name: Upload Trivy IaC SARIF to GitHub Security tab if: always() - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: sarif_file: trivy-iac.sarif category: trivy-iac @@ -152,7 +152,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: Setup OpenTofu - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2.0.1 + uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 with: tofu_version: ${{ inputs.tofu-version }} tofu_wrapper: true # captures stdout/stderr for the plan comment diff --git a/.github/workflows/reusable-ci-python-monorepo.yml b/.github/workflows/reusable-ci-python-monorepo.yml index 74758c1..6328ad9 100644 --- a/.github/workflows/reusable-ci-python-monorepo.yml +++ b/.github/workflows/reusable-ci-python-monorepo.yml @@ -37,7 +37,7 @@ jobs: fetch-depth: 0 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | any_python: @@ -90,7 +90,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 with: enable-cache: true - run: uv sync --all-packages --frozen @@ -103,7 +103,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 with: enable-cache: true - run: uv sync --all-packages --frozen @@ -116,7 +116,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 with: enable-cache: true - run: uv sync --all-packages --frozen @@ -129,7 +129,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 with: enable-cache: true - run: uv sync --all-packages --frozen @@ -151,7 +151,7 @@ jobs: package: ${{ fromJSON(needs.changes.outputs.packages) }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0 with: enable-cache: true - run: uv sync --all-packages --frozen diff --git a/.github/workflows/reusable-ci-rust-monorepo.yml b/.github/workflows/reusable-ci-rust-monorepo.yml index 19688d3..84ce5e4 100644 --- a/.github/workflows/reusable-ci-rust-monorepo.yml +++ b/.github/workflows/reusable-ci-rust-monorepo.yml @@ -41,7 +41,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | rust: diff --git a/.github/workflows/reusable-ci-solidity.yml b/.github/workflows/reusable-ci-solidity.yml index 89fe889..00fe993 100644 --- a/.github/workflows/reusable-ci-solidity.yml +++ b/.github/workflows/reusable-ci-solidity.yml @@ -45,7 +45,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | solidity: diff --git a/.github/workflows/reusable-ci-terraform.yml b/.github/workflows/reusable-ci-terraform.yml index eafd6f2..c448b3c 100644 --- a/.github/workflows/reusable-ci-terraform.yml +++ b/.github/workflows/reusable-ci-terraform.yml @@ -61,7 +61,7 @@ jobs: with: fetch-depth: 0 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | terraform: @@ -129,7 +129,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2 + - uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0 with: tflint_version: ${{ inputs.tflint-version }} - name: tflint --init diff --git a/.github/workflows/reusable-ci-typescript-lib.yml b/.github/workflows/reusable-ci-typescript-lib.yml index 384428c..ef0953b 100644 --- a/.github/workflows/reusable-ci-typescript-lib.yml +++ b/.github/workflows/reusable-ci-typescript-lib.yml @@ -60,7 +60,7 @@ jobs: with: fetch-depth: 0 - id: filter - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 + uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 with: filters: | typescript: diff --git a/.github/workflows/reusable-codeql.yml b/.github/workflows/reusable-codeql.yml index 0acb74d..6f1afbb 100644 --- a/.github/workflows/reusable-codeql.yml +++ b/.github/workflows/reusable-codeql.yml @@ -49,13 +49,13 @@ jobs: include: ${{ fromJSON(inputs.languages) }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} queries: ${{ inputs.queries }} - if: matrix.build-mode == 'autobuild' - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 - - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 + - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/reusable-lint.yml b/.github/workflows/reusable-lint.yml index a440a58..9f9db58 100644 --- a/.github/workflows/reusable-lint.yml +++ b/.github/workflows/reusable-lint.yml @@ -142,7 +142,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0 + - uses: DavidAnson/markdownlint-cli2-action@8de2aa07cae85fd17c0b35642db70cf5495f1d25 # v24.0.0 with: globs: ${{ inputs.markdownlint-globs }} diff --git a/.github/workflows/reusable-openssf-scorecard.yml b/.github/workflows/reusable-openssf-scorecard.yml index 5f438df..1719585 100644 --- a/.github/workflows/reusable-openssf-scorecard.yml +++ b/.github/workflows/reusable-openssf-scorecard.yml @@ -82,7 +82,7 @@ jobs: retention-days: 5 - name: Upload SARIF to GitHub Security tab - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: sarif_file: scorecard-results.sarif category: ossf-scorecard