From 164c9503de45ec4968eaf14359e5d811b9ce00f5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 03:50:17 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 12 updates Bumps the actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [actions/cache/restore](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.1.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.211` | `1.0.254` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.7.0` | | [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) | `2.3.8` | `2.7.0` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.0.0` | `3.3.0` | Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/cache/restore` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/cache/save` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/upload-artifact` from 4.6.2 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/download-artifact` from 4.3.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3) Updates `actions/setup-node` from 4.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `anthropics/claude-code-action` from 1.0.211 to 1.0.254 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/833fb0f8c9f6686b33d963a8bae0a94f4936ab2a...db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml` from 2.3.8 to 2.7.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/9a498708959aeaef5ef730655706c5a1df1edbc2...b1d267aea5211fa648d9d442fa64b90dbdcbdd36) Updates `google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml` from 2.3.8 to 2.7.0 - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](https://github.com/google/osv-scanner-action/compare/9a498708959aeaef5ef730655706c5a1df1edbc2...b1d267aea5211fa648d9d442fa64b90dbdcbdd36) Updates `actions/create-github-app-token` from 2.0.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/064492a9a1762067169d50c792a7dc02bc3d1254...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.254 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/bench-base.yml | 22 +++---- .github/workflows/bench.yml | 10 ++-- .github/workflows/ci.yml | 100 +++++++++++++++---------------- .github/workflows/claude.yml | 10 ++-- .github/workflows/fuzz.yml | 8 +-- .github/workflows/osv-scan.yml | 4 +- .github/workflows/release-pr.yml | 4 +- 7 files changed, 79 insertions(+), 79 deletions(-) diff --git a/.github/workflows/bench-base.yml b/.github/workflows/bench-base.yml index 21101c0..94f2176 100644 --- a/.github/workflows/bench-base.yml +++ b/.github/workflows/bench-base.yml @@ -42,7 +42,7 @@ jobs: CCACHE_MAXSIZE: 1G CCACHE_NOHASHDIR: 'true' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.sha || inputs.ref || github.sha }} persist-credentials: false @@ -55,7 +55,7 @@ jobs: git config --global --add safe.directory "$GITHUB_WORKSPACE" sha="$(git rev-parse HEAD:assimp)" echo "sha=$sha" >> "$GITHUB_OUTPUT" - - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: restore with: path: src/wasm/libassimp.* @@ -72,7 +72,7 @@ jobs: echo "CCACHE_COMPILERCHECK=string:$(cat emsdk-image.txt)" } >> "$GITHUB_ENV" # Restore only: ci.yml's build-wasm job owns these entries. - - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: steps.restore.outputs.cache-matched-key == '' with: path: .ccache @@ -85,12 +85,12 @@ jobs: env: LIBASSIMP_EMSDK: host run: node scripts/build-wasm.mjs - - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: steps.restore.outputs.cache-hit != 'true' with: path: src/wasm/libassimp.* key: ${{ steps.restore.outputs.cache-primary-key }} - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bench-base-wasm path: src/wasm/libassimp.* @@ -102,7 +102,7 @@ jobs: # Origin: the same ceiling as ci.yml's native-build job, which this mirrors. timeout-minutes: 90 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.sha || inputs.ref || github.sha }} persist-credentials: false @@ -119,7 +119,7 @@ jobs: run: | manifest="$(node -p "const p=require('./package.json');const h=require('node:crypto').createHash('sha256');h.update(JSON.stringify([p.version,p.binary,p.devDependencies['node-addon-api'],p.devDependencies['cmake-js'],process.versions.node.split('.')[0]]));h.digest('hex').slice(0,16)")" echo "key=addon-v1-linux-x64-gnu-manylinux-$manifest-$INPUTS-$(git rev-parse HEAD:assimp)" >> "$GITHUB_OUTPUT" - - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: restore with: path: native-artifacts @@ -134,12 +134,12 @@ jobs: scripts/build-manylinux.sh "${inc%%;*}" native-output mkdir -p native-artifacts cp native-output/libassimp.node native-artifacts/libassimp.linux-x64-gnu.node - - uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: steps.restore.outputs.cache-hit != 'true' with: path: native-artifacts key: ${{ steps.restore.outputs.cache-primary-key }} - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bench-base-native path: native-artifacts/libassimp.linux-x64-gnu.node @@ -160,7 +160,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 120 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 submodules: ${{ matrix.tier == 'small' }} @@ -191,7 +191,7 @@ jobs: node bench/matrix.mjs --backend "$BACKEND" --tier "$TIER" --inputs "$RUNNER_TEMP/matrix-inputs" \ --build "build=$entry,addon=/tmp/build/native/libassimp.linux-x64-gnu.node,rev=$revision" \ --out "/tmp/format-matrix/$BACKEND-$TIER.json" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: format-matrix-${{ matrix.backend }}-${{ matrix.tier }} path: /tmp/format-matrix/*.json diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 5d2f3f7..a6936e8 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -21,7 +21,7 @@ jobs: container: image: emscripten/emsdk:6.0.8@sha256:f174124ff798a3ead1abef247d9a849c270b642d552fea500a42565ff210f765 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -30,7 +30,7 @@ jobs: - name: Record the engine submodule commit id: engine run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: .ccache key: ccache-${{ runner.os }}-${{ hashFiles('emsdk-image.txt', 'assimp-builds.json', 'CMakeLists.txt', 'CMakePresets.json', 'src/cpp/**', '.gitmodules') }}-${{ steps.engine.outputs.sha }} @@ -38,7 +38,7 @@ jobs: env: LIBASSIMP_EMSDK: host run: node scripts/build-wasm.mjs - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wasm path: src/wasm/libassimp.* @@ -48,13 +48,13 @@ jobs: needs: build-wasm runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup with: node-version: '26' - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wasm path: src/wasm diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8c93f4b..86991c0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: smoke-matrix: ${{ steps.smoke-matrix.outputs.matrix }} version: ${{ steps.release.outputs.version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -65,7 +65,7 @@ jobs: CCACHE_MAXSIZE: 1G CCACHE_NOHASHDIR: 'true' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -77,7 +77,7 @@ jobs: # The artifacts are a pure function of these inputs, and determinism tests # prove the outputs are reproducible. No restore key is allowed: a near miss # is a wrong binary, and validate-pack checks the image and engine SHA. - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: wasm-cache with: path: src/wasm/libassimp.* @@ -92,7 +92,7 @@ jobs: echo "CCACHE_BASEDIR=$GITHUB_WORKSPACE" echo "CCACHE_COMPILERCHECK=string:$(cat emsdk-image.txt)" } >> "$GITHUB_ENV" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: steps.wasm-cache.outputs.cache-hit != 'true' with: path: .ccache @@ -108,7 +108,7 @@ jobs: ccache --zero-stats node scripts/build-wasm.mjs ccache --show-stats - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wasm path: src/wasm/libassimp.* @@ -119,7 +119,7 @@ jobs: runs-on: ubuntu-24.04 steps: # The format matrix reads the engine's own fixture corpus. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 submodules: true @@ -170,7 +170,7 @@ jobs: node: ['22.14.0', '24', '26'] runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -197,7 +197,7 @@ jobs: usd-core: ['25.8', '26.11'] runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -222,7 +222,7 @@ jobs: mapfile -t layers < <(node scripts/export-usd-matrix.mjs /tmp/usd-matrix) /tmp/usd/bin/python scripts/usd-strict-check.py "${layers[@]}" - if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: usd-matrix-${{ matrix.usd-core }} path: /tmp/usd-matrix @@ -249,7 +249,7 @@ jobs: CCACHE_NOHASHDIR: 'true' MACOSX_DEPLOYMENT_TARGET: '11.0' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -271,7 +271,7 @@ jobs: engine="$(git -C assimp rev-parse HEAD)" echo "engine=$engine" >> "$GITHUB_OUTPUT" echo "key=addon-v1-${{ matrix.suffix }}-$toolchain-$manifest-$INPUTS-$engine" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: addon-cache if: needs.preflight.outputs.npm-publish != 'true' with: @@ -286,7 +286,7 @@ jobs: scripts/install-ci-tool.sh --tool ccache echo "$GITHUB_WORKSPACE/.ci-tools/bin" >> "$GITHUB_PATH" echo "LIBASSIMP_COMPILER_LAUNCHER=ccache" >> "$GITHUB_ENV" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: steps.addon-cache.outputs.cache-hit != 'true' && matrix.recipe == 'host' with: path: .ccache @@ -331,7 +331,7 @@ jobs: if(files.length!==1)throw Error('expected one libassimp.node, found '+files.length); f.mkdirSync('native-artifacts',{recursive:true}); f.copyFileSync(p.join('native-output',files[0]),p.join('native-artifacts','libassimp.'+process.env.NATIVE_SUFFIX+'.node'))" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bindings-${{ matrix.target }} path: native-artifacts/libassimp.*.node @@ -364,7 +364,7 @@ jobs: LIBASSIMP_COMPILER_LAUNCHER: ccache LIBASSIMP_NATIVE_BUILD_DIR: build/native-${{ matrix.gate }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -375,7 +375,7 @@ jobs: - name: Record the engine submodule commit id: engine run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: .ccache key: ccache-v1-${{ matrix.gate }}-${{ steps.engine.outputs.sha }} @@ -405,7 +405,7 @@ jobs: sha256: ${{ steps.freeze.outputs.sha256 }} version: ${{ steps.freeze.outputs.version }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -443,7 +443,7 @@ jobs: run: | node scripts/generate-sbom.mjs --check node scripts/generate-sbom.mjs --out sbom - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sbom path: sbom/libassimp.cdx.json @@ -472,14 +472,14 @@ jobs: echo "sha256=$(cut -d' ' -f1 < "$archive.sha256")" echo "version=$version" } >> "$GITHUB_OUTPUT" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: prepared-release path: | prepared-release-*.tgz prepared-release-*.tgz.sha256 if-no-files-found: error - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-tarballs path: tarballs/ @@ -497,7 +497,7 @@ jobs: runs-on: ${{ matrix.os }} timeout-minutes: 45 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -530,7 +530,7 @@ jobs: LIBASSIMP_FINGERPRINTS_OUT: ${{ runner.temp }}/native-fingerprints run: pnpm exec vitest run --config vitest.native.config.ts - if: ${{ !cancelled() }} - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: native-fingerprints-${{ matrix.suffix }} path: ${{ runner.temp }}/native-fingerprints @@ -581,7 +581,7 @@ jobs: os: macos-15 runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false @@ -597,7 +597,7 @@ jobs: id: playwright shell: bash run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cache/ms-playwright @@ -622,7 +622,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -636,11 +636,11 @@ jobs: - name: Record the Playwright version id: playwright run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ms-playwright key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}-chromium - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.npm key: npm-bundlers-${{ hashFiles('tests/bundlers/package-lock.json') }} @@ -662,7 +662,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 submodules: true @@ -718,7 +718,7 @@ jobs: - name: Restore main's Wasm from its CI cache id: base-wasm if: steps.base-checkout.outcome == 'success' - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: src/wasm/libassimp.* key: wasm-${{ hashFiles('.bench-base/emsdk-image.txt', '.bench-base/assimp-builds.json', '.bench-base/CMakeLists.txt', '.bench-base/CMakePresets.json', '.bench-base/src/cpp/**', '.bench-base/.gitmodules', '.bench-base/scripts/build-wasm.mjs') }}-${{ steps.base-checkout.outputs.engine }} @@ -823,7 +823,7 @@ jobs: writeFileSync('/tmp/benchmark.md', `${marker}\n${body || '### Benchmark\n\nBenchmark did not complete.'}\n`); NODE - if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: native-wasm-benchmark path: | @@ -832,7 +832,7 @@ jobs: /tmp/*regression*.json if-no-files-found: error - if: always() - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('node:fs'); @@ -876,7 +876,7 @@ jobs: - { backend: native, tier: large, shard: '2/2' } steps: # The small tier reads the engine's fixture corpus; the large tier generates its inputs. - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 submodules: ${{ matrix.tier == 'small' }} @@ -925,7 +925,7 @@ jobs: mkdir -p /tmp/format-matrix node bench/matrix.mjs "${args[@]}" --out "/tmp/format-matrix/$name.json" - if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: format-matrix-${{ strategy.job-index }} path: /tmp/format-matrix/*.json @@ -941,13 +941,13 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '26' - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: format-matrix-* path: /tmp/format-matrix @@ -972,13 +972,13 @@ jobs: fi exit "$status" - if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: format-matrix-report path: /tmp/format-matrix.md if-no-files-found: warn - if: always() - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('node:fs'); @@ -996,7 +996,7 @@ jobs: needs: preflight runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -1013,7 +1013,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/setup @@ -1034,7 +1034,7 @@ jobs: --json preview.json --no-template './preview-packages/*' - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pkg-pr-new-preview path: preview.json @@ -1047,10 +1047,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '26' - uses: ./.github/actions/download-verified-artifact @@ -1058,7 +1058,7 @@ jobs: name: test-tarballs path: tarballs expect: test-tarballs.json - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: pkg-pr-new-preview path: preview @@ -1075,7 +1075,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/download-verified-artifact @@ -1094,7 +1094,7 @@ jobs: with: subject-path: tarballs/*.tgz sbom-path: sbom/libassimp.cdx.json - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '26' registry-url: https://registry.npmjs.org @@ -1129,7 +1129,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/download-verified-artifact @@ -1137,7 +1137,7 @@ jobs: name: test-tarballs path: tarballs expect: test-tarballs.json - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '26' registry-url: https://registry.npmjs.org @@ -1161,10 +1161,10 @@ jobs: runs-on: ${{ matrix.os }} timeout-minutes: 15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '22.14.0' registry-url: https://registry.npmjs.org @@ -1182,7 +1182,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/download-verified-artifact diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 23043a7..af0842b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -25,7 +25,7 @@ jobs: issues: write steps: - name: Post approval needed comment - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const requester = context.payload.comment.user.login; @@ -72,14 +72,14 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 20 persist-credentials: false - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@833fb0f8c9f6686b33d963a8bae0a94f4936ab2a # v1.0.211 + uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # The workflow token replaces the OIDC exchange for an app token, so @@ -142,14 +142,14 @@ jobs: ;; esac - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 20 persist-credentials: false - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@833fb0f8c9f6686b33d963a8bae0a94f4936ab2a # v1.0.211 + uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # The workflow token replaces the OIDC exchange for an app token, so diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 38f54ea..1eb68bd 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -63,11 +63,11 @@ jobs: SECONDS_BUDGET: ${{ github.event_name == 'pull_request' && '120' || github.event_name == 'push' && '600' || inputs.seconds || '3600' }} STRICT: ${{ github.event_name != 'pull_request' }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: submodules: true persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '26' - name: Require the checked-in corpus to match its generator @@ -76,7 +76,7 @@ jobs: - name: Record the engine submodule commit id: engine run: echo "sha=$(git -C assimp rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: .ccache key: ccache-v1-fuzz-${{ steps.engine.outputs.sha }} @@ -126,7 +126,7 @@ jobs: exit 1 fi - if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: fuzz-findings path: | diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml index ff89a9b..ba9fba3 100644 --- a/.github/workflows/osv-scan.yml +++ b/.github/workflows/osv-scan.yml @@ -21,7 +21,7 @@ jobs: scan-pr: name: OSV scan (report-only) if: github.event_name == 'pull_request' - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 with: scan-args: |- --lockfile=pnpm-lock.yaml @@ -36,7 +36,7 @@ jobs: scan-main: name: OSV scan (blocking) if: github.event_name != 'pull_request' - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 with: scan-args: |- --lockfile=pnpm-lock.yaml diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml index 29ed6a9..68462c1 100644 --- a/.github/workflows/release-pr.yml +++ b/.github/workflows/release-pr.yml @@ -54,7 +54,7 @@ jobs: steps: - name: Mint tau-release-bot token id: bot - uses: actions/create-github-app-token@064492a9a1762067169d50c792a7dc02bc3d1254 # v2.0.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ secrets.RELEASE_BOT_APP_ID }} private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }} @@ -64,7 +64,7 @@ jobs: permission-pull-requests: write - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ github.event.workflow_run.head_sha || 'main' }}