From 756e4c87458d538d3496ac903aeb35894d582f19 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 04:17:24 +0000 Subject: [PATCH] build(deps): bump the actions group with 8 updates Bumps the actions group with 8 updates: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [Apple-Actions/import-codesign-certs](https://github.com/apple-actions/import-codesign-certs) | `7.0.0` | `7.1.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `Apple-Actions/import-codesign-certs` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/apple-actions/import-codesign-certs/releases) - [Commits](https://github.com/apple-actions/import-codesign-certs/compare/5142e029c445c10ffc7149d172e540235a065466...77ba2a2a8f5cfc8c405ebf3159f767c323e238f9) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: Apple-Actions/import-codesign-certs dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/desktop-backfill.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/npm-test.yml | 20 ++++++++++---------- .github/workflows/publish.yml | 14 +++++++------- .github/workflows/runtime-conformance.yml | 2 +- .github/workflows/scorecard.yml | 6 +++--- 7 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 78dd37430..e483066ea 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -28,10 +28,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} - name: Analyze - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/desktop-backfill.yml b/.github/workflows/desktop-backfill.yml index b542f1326..cf6f9da4f 100644 --- a/.github/workflows/desktop-backfill.yml +++ b/.github/workflows/desktop-backfill.yml @@ -175,7 +175,7 @@ jobs: - uses: ./.github/actions/setup-bun if: steps.existing.outputs.found != 'true' - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 if: steps.existing.outputs.found != 'true' with: node-version: "24" diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index d6e16a970..d6dac3240 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -89,7 +89,7 @@ jobs: - name: Upload Playwright artifacts if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: playwright-${{ matrix.settings.name }}-${{ github.run_attempt }} if-no-files-found: ignore diff --git a/.github/workflows/npm-test.yml b/.github/workflows/npm-test.yml index 8de6fbc4f..6f9a882fe 100644 --- a/.github/workflows/npm-test.yml +++ b/.github/workflows/npm-test.yml @@ -92,7 +92,7 @@ jobs: fetch-depth: 0 ref: ${{ needs.version.outputs.source }} - uses: ./.github/actions/setup-bun - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - name: Restore immutable npm test artifacts @@ -160,7 +160,7 @@ jobs: # registry.npmjs.org, so the rehearsal never waits for the registry to # commit fifteen uploads. The real staging happens once, in publish.yml. - name: Share the packed candidate with the gate jobs - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: npm-candidate-${{ needs.version.outputs.version }} path: .release/npm-test/${{ needs.version.outputs.version }} @@ -184,7 +184,7 @@ jobs: fetch-depth: 0 ref: ${{ needs.version.outputs.source }} - uses: ./.github/actions/setup-bun - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" registry-url: "https://registry.npmjs.org" @@ -214,7 +214,7 @@ jobs: with: ref: ${{ needs.version.outputs.source }} - uses: ./.github/actions/setup-bun - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - name: Set Playwright browser path @@ -394,7 +394,7 @@ jobs: cat "$RUNNER_TEMP/openscience-fake-model.log" || true - name: Upload packaged E2E artifacts if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: npm-test-packaged-e2e-${{ github.run_attempt }} if-no-files-found: ignore @@ -433,7 +433,7 @@ jobs: - uses: ./.github/actions/setup-bun with: install: "false" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - uses: ./.github/actions/candidate-registry @@ -481,7 +481,7 @@ jobs: bun --no-env-file backend/cli/script/smoke-darwin-launcher.ts "$native" "$RUNNER_TEMP/darwin-launcher-smoke" - name: Upload macOS worker startup evidence if: always() && runner.os == 'macOS' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: npm-test-darwin-launcher-${{ github.run_attempt }} if-no-files-found: error @@ -537,7 +537,7 @@ jobs: shell: sh run: apk add --no-cache curl libstdc++ - name: Download the packed candidate - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: npm-candidate-${{ needs.version.outputs.version }} path: ${{ runner.temp }}/npm-candidate @@ -608,7 +608,7 @@ jobs: - uses: ./.github/actions/setup-bun with: install: "false" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - uses: ./.github/actions/candidate-registry @@ -690,7 +690,7 @@ jobs: NODE - name: Upload scientific capability evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: npm-test-scientific-capability-${{ matrix.os }}-${{ matrix.capability }}-${{ github.run_attempt }} if-no-files-found: ignore diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5e1510bea..10bebe39e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -125,7 +125,7 @@ jobs: "Run it from main with packaged E2E, OS smoke, and scientific canary enabled.", ) - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" registry-url: "https://registry.npmjs.org" @@ -271,7 +271,7 @@ jobs: fail-on-cache-miss: true - name: Import Developer ID if: steps.signed.outputs.cache-hit != 'true' - uses: Apple-Actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7.0.0 + uses: Apple-Actions/import-codesign-certs@77ba2a2a8f5cfc8c405ebf3159f767c323e238f9 # v7.1.0 with: p12-file-base64: ${{ secrets.APPLE_DEVELOPER_ID_P12_BASE64 }} p12-password: ${{ secrets.APPLE_DEVELOPER_ID_P12_PASSWORD }} @@ -409,7 +409,7 @@ jobs: git show "$WORKFLOW_SOURCE:$file" > "$file" done - uses: ./.github/actions/setup-bun - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" registry-url: "https://registry.npmjs.org" @@ -588,7 +588,7 @@ jobs: --trusted true fi - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 if: steps.existing.outputs.found != 'true' with: node-version: "24" @@ -804,7 +804,7 @@ jobs: - uses: ./.github/actions/setup-bun if: steps.existing.outputs.found != 'true' - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 if: steps.existing.outputs.found != 'true' with: node-version: "24" @@ -1175,7 +1175,7 @@ jobs: OPENSCIENCE_PREVIOUS_ZIP: ${{ steps.previous.outputs.zip }} OPENSCIENCE_ZIP: ${{ matrix.zip }} run: bun frontend/desktop/script/update-download-canary.mjs "$OPENSCIENCE_PREVIOUS_ZIP" "$OPENSCIENCE_ZIP" differential-download.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: differential-download-${{ matrix.arch }} path: differential-download.json @@ -1224,7 +1224,7 @@ jobs: git show "$WORKFLOW_SOURCE:$file" > "$file" done - uses: ./.github/actions/setup-bun - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/runtime-conformance.yml b/.github/workflows/runtime-conformance.yml index 21355c2a1..d6a577de6 100644 --- a/.github/workflows/runtime-conformance.yml +++ b/.github/workflows/runtime-conformance.yml @@ -113,7 +113,7 @@ jobs: --execute - name: Retain native Harbor conformance evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: native-harbor-conformance-${{ github.run_attempt }} path: ${{ runner.temp }}/native-harbor-conformance diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f7eb94f0e..52d8edfb1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -21,18 +21,18 @@ jobs: with: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif