diff --git a/.github/workflows/action-pins.yml b/.github/workflows/action-pins.yml index 1a5fd3fb..4fe876db 100644 --- a/.github/workflows/action-pins.yml +++ b/.github/workflows/action-pins.yml @@ -38,7 +38,7 @@ jobs: # that itself depended on several would be one bad pin away from the # silence it exists to prevent; the checker is stdlib-only Python, and # runners ship python3, so nothing else is needed. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Every action reference resolves, and its version comment is true env: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 157b79b8..9f685ad4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -73,8 +73,8 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@v7.0.1 + - uses: actions/setup-python@v7.0.0 with: python-version: "3.14" # The lockfile's ruff, not whatever released today. This job gates @@ -95,9 +95,9 @@ jobs: if: inputs.build_ui runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -127,9 +127,9 @@ jobs: if: inputs.build_worker runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 - - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/catalog-check.yml b/.github/workflows/catalog-check.yml index 71507452..1f0e70c2 100644 --- a/.github/workflows/catalog-check.yml +++ b/.github/workflows/catalog-check.yml @@ -29,9 +29,9 @@ jobs: # a fork PR cannot reach the self-hosted fleet from here. runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/.github/workflows/catalog-liveness.yml b/.github/workflows/catalog-liveness.yml index 0901a6b7..e1320037 100644 --- a/.github/workflows/catalog-liveness.yml +++ b/.github/workflows/catalog-liveness.yml @@ -23,9 +23,9 @@ jobs: # Public repo -> GitHub-hosted runners are free and ephemeral. runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@v7.0.0 with: python-version: "3.14" diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index b11516c4..204eb5a1 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -38,7 +38,7 @@ jobs: # Full history AND tags: git-cliff walks the tag graph, and a shallow # clone silently produces a changelog containing only the newest release # rather than failing. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fe7cd0a0..1d558b01 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,19 +18,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@v7.0.0 with: python-version: "3.12" - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.3 + uses: github/codeql-action/init@v4.37.8 with: languages: python - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.3 + uses: github/codeql-action/analyze@v4.37.8 with: category: "/language:python" diff --git a/.github/workflows/collector-live-check.yml b/.github/workflows/collector-live-check.yml index 4acec63c..22c23b2f 100644 --- a/.github/workflows/collector-live-check.yml +++ b/.github/workflows/collector-live-check.yml @@ -28,9 +28,9 @@ jobs: # which also keeps provider credentials off the self-hosted fleet. runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml index d2d6d85b..5e66b669 100644 --- a/.github/workflows/dockerhub-description.yml +++ b/.github/workflows/dockerhub-description.yml @@ -10,7 +10,7 @@ jobs: update-description: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Sync UI Docker Hub description uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9be9c0bf..d6133575 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -24,9 +24,9 @@ jobs: name: build (strict) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@v7.0.0 with: python-version: '3.12' @@ -47,9 +47,9 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6e1e49ef..8aa37e74 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@v7.0.0 with: python-version: "3.14" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 504fb38c..a047ffc8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: name: Verify CI passes runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: # The same tags test.yml needs. tests/test_compose_image_pins.py # compares the pinned image tag against the newest RELEASED version, @@ -31,7 +31,7 @@ jobs: # exactly as designed. It blocked v1.11.4 after six merges. fetch-depth: 0 fetch-tags: true - - uses: actions/setup-python@v7 + - uses: actions/setup-python@v7.0.0 with: # The interpreter the images ship (Dockerfile:2, Dockerfile.worker:2), # and the one test.yml uses. This job is what the release is actually @@ -60,7 +60,7 @@ jobs: build_worker: ${{ steps.changes.outputs.worker }} steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -225,7 +225,7 @@ jobs: # protected. Nothing else in this job needs it. pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 fetch-tags: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f53cd3e6..bffbe330 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,7 +10,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: # Tags are needed by the compose-pin drift test, which compares the # pinned image tag against the newest RELEASED version. checkout does @@ -19,11 +19,11 @@ jobs: fetch-depth: 0 fetch-tags: true - - uses: actions/setup-python@v7 + - uses: actions/setup-python@v7.0.0 with: python-version: "3.14" - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7 with: node-version: "22"