From 1aa536f0e2d4a297f561abdcc2966371e65e19d5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 04:24:53 +0000 Subject: [PATCH] deps(actions): bump the github-actions group across 1 directory with 15 updates Bumps the github-actions group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `7.0.1` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `e18b497796c12c097a38f9edb9d0641fb99eee32` | `f0d9c3887740aee45f6153b24b3a6b815192ec16` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.83.2` | `2.87.5` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.2` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.2` | `3.0.3` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.7.0` | `4.3.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.3.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.3.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.6.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.9` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.9` | Updates `actions/checkout` from 4.3.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.3.1...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `Swatinem/rust-cache` from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](https://github.com/swatinem/rust-cache/compare/e18b497796c12c097a38f9edb9d0641fb99eee32...f0d9c3887740aee45f6153b24b3a6b815192ec16) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4.4.0...820762786026740c76f36085b0efc47a31fe5020) Updates `taiki-e/install-action` from 2.83.2 to 2.87.5 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/43aecc8d72668fbcfe75c31400bc4f890f1c5853...5bf6ce016fd2e72eefc647cbca1e4213f65955b8) Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `actions/attest` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...1e69f48acb82d1966a394da916b4c1698aa569d6) Updates `softprops/action-gh-release` from 2.6.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/3bb12739c298aeb8a4eeaf626c5b8d85266b0e65...efb35369e0ad2afab669f228072c1b0d510eae64) Updates `docker/setup-qemu-action` from 3.7.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...1f40c72289eff860ee54a304f1438e3cff362e0a) Updates `docker/setup-buildx-action` from 3.12.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...37fe631027851001ddb9b187196cc803df7f5f0e) Updates `docker/build-push-action` from 6.19.2 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `docker/login-action` from 3.7.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...dbcb813823bdd20940b903addbd779551569679f) Updates `github/codeql-action/init` from 4.37.0 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: Swatinem/rust-cache dependency-version: f0d9c3887740aee45f6153b24b3a6b815192ec16 dependency-type: direct:production dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.87.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 24 +++---- .github/workflows/publish-npm-packages.yml | 42 ++++++------ .github/workflows/release.yml | 76 +++++++++++----------- .github/workflows/security.yml | 16 ++--- .github/workflows/turbo-validate.yml | 14 ++-- 5 files changed, 86 insertions(+), 86 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 01e1b85..0bd69cc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: working-directory: api steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable @@ -31,7 +31,7 @@ jobs: components: clippy, rustfmt - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target @@ -76,13 +76,13 @@ jobs: working-directory: api steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target shared-key: backend-${{ matrix.feature }} @@ -98,13 +98,13 @@ jobs: timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target shared-key: runtime-sqlite @@ -148,13 +148,13 @@ jobs: --health-retries 20 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target shared-key: runtime-postgres-16 @@ -201,13 +201,13 @@ jobs: --health-retries 30 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target shared-key: runtime-mysql-8-4 @@ -239,10 +239,10 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm diff --git a/.github/workflows/publish-npm-packages.yml b/.github/workflows/publish-npm-packages.yml index 34ed81e..9c9414a 100644 --- a/.github/workflows/publish-npm-packages.yml +++ b/.github/workflows/publish-npm-packages.yml @@ -69,7 +69,7 @@ jobs: --health-retries 30 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: fetch-depth: 0 persist-credentials: false @@ -108,7 +108,7 @@ jobs: fi - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm @@ -164,12 +164,12 @@ jobs: components: clippy, rustfmt - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target - name: Install cargo-audit - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-audit@0.22.2 @@ -236,12 +236,12 @@ jobs: MANUAL_VERSION: ${{ inputs.version }} steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm @@ -369,7 +369,7 @@ jobs: pack_package packages/authos-cli authos-cli - name: Generate sso-sdk SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: file: .artifacts/npm-packages/sso-sdk.tgz format: spdx-json @@ -378,7 +378,7 @@ jobs: upload-release-assets: false - name: Generate authos-node SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: file: .artifacts/npm-packages/authos-node.tgz format: spdx-json @@ -387,7 +387,7 @@ jobs: upload-release-assets: false - name: Generate authos-react SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: file: .artifacts/npm-packages/authos-react.tgz format: spdx-json @@ -396,7 +396,7 @@ jobs: upload-release-assets: false - name: Generate authos-vue SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: file: .artifacts/npm-packages/authos-vue.tgz format: spdx-json @@ -405,7 +405,7 @@ jobs: upload-release-assets: false - name: Generate authos-cli SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: file: .artifacts/npm-packages/authos-cli.tgz format: spdx-json @@ -438,7 +438,7 @@ jobs: python3 scripts/npm-release-evidence.py verify "${evidence_dir}" - name: Upload npm package evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: npm-package-evidence path: .artifacts/npm-packages @@ -472,13 +472,13 @@ jobs: id-token: write steps: - name: Setup Node.js registry client - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' registry-url: https://registry.npmjs.org - name: Download prepared npm artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: npm-package-evidence path: .artifacts/npm-packages @@ -488,7 +488,7 @@ jobs: run: sha256sum --check npm-SHA256SUMS.txt - name: Attest npm package artifacts - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: | .artifacts/npm-packages/*.tgz @@ -497,31 +497,31 @@ jobs: .artifacts/npm-packages/npm-SHA256SUMS.txt - name: Attest sso-sdk SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: .artifacts/npm-packages/sso-sdk.tgz sbom-path: .artifacts/npm-packages/sso-sdk.spdx.json - name: Attest authos-node SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: .artifacts/npm-packages/authos-node.tgz sbom-path: .artifacts/npm-packages/authos-node.spdx.json - name: Attest authos-react SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: .artifacts/npm-packages/authos-react.tgz sbom-path: .artifacts/npm-packages/authos-react.spdx.json - name: Attest authos-vue SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: .artifacts/npm-packages/authos-vue.tgz sbom-path: .artifacts/npm-packages/authos-vue.spdx.json - name: Attest authos-cli SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: .artifacts/npm-packages/authos-cli.tgz sbom-path: .artifacts/npm-packages/authos-cli.spdx.json @@ -543,7 +543,7 @@ jobs: done - name: Attach durable npm evidence to draft release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: draft: true overwrite_files: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9d72820..773beeb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,7 @@ jobs: --health-retries 30 steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: fetch-depth: 0 persist-credentials: false @@ -89,7 +89,7 @@ jobs: fi - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm @@ -145,12 +145,12 @@ jobs: components: clippy, rustfmt - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: api -> target - name: Install cargo-audit - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-audit@0.22.2 @@ -232,7 +232,7 @@ jobs: run: tar -czf frontend-dist.tar.gz -C lite-web-client dist - name: Upload frontend dist - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: frontend-dist path: frontend-dist.tar.gz @@ -259,7 +259,7 @@ jobs: rust_target: aarch64-unknown-linux-musl steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false @@ -274,7 +274,7 @@ jobs: version: 0.13.0 - name: Install cargo-zigbuild - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-zigbuild fallback: none @@ -340,7 +340,7 @@ jobs: # crates itself. An artifact belongs to the run, so nothing else can # displace it, and dropping the cache entry also returns some of that # shared budget to the jobs that still use it. - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: turbo-store-${{ matrix.arch }} path: turbo-store.tar.zst @@ -398,12 +398,12 @@ jobs: standalone: false steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' @@ -413,7 +413,7 @@ jobs: targets: ${{ matrix.rust_target }} - name: Restore Rust cache - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2 with: workspaces: | api -> target @@ -424,7 +424,7 @@ jobs: version: 0.13.0 - name: Install cargo-zigbuild - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-zigbuild fallback: none @@ -434,7 +434,7 @@ jobs: # artifact is not an error: the build simply compiles the dependencies # itself, exactly as it did before any of this existed. continue-on-error: true - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: turbo-store-${{ matrix.arch }} path: .artifacts/turbo @@ -477,7 +477,7 @@ jobs: fi - name: Download frontend dist - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: frontend-dist path: .artifacts/frontend @@ -495,7 +495,7 @@ jobs: - name: Generate standalone SPDX SBOM if: matrix.standalone - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: .authos/releases/authos-sqlite-linux-${{ matrix.arch }} format: spdx-json @@ -505,7 +505,7 @@ jobs: - name: Upload standalone artifacts if: matrix.standalone - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: standalone-${{ matrix.arch }} path: | @@ -515,7 +515,7 @@ jobs: if-no-files-found: error - name: Upload Docker binary artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: docker-${{ matrix.backend }}-${{ matrix.arch }} path: api/target/dist/linux-${{ matrix.arch }}/${{ matrix.binary_name }} @@ -531,7 +531,7 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: fetch-depth: 0 fetch-tags: true @@ -562,12 +562,12 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false - name: Download standalone artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: standalone-* path: dist @@ -606,7 +606,7 @@ jobs: run: python3 scripts/verify-release-assets.py dist - name: Upload prepared standalone release set - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: standalone-release-set path: dist @@ -625,7 +625,7 @@ jobs: id-token: write steps: - name: Download prepared standalone release set - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: standalone-release-set path: dist @@ -635,7 +635,7 @@ jobs: run: sha256sum --check SHA256SUMS.txt - name: Attest release build provenance - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: | dist/install.sh @@ -647,19 +647,19 @@ jobs: dist/SHA256SUMS.txt - name: Attest amd64 SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: dist/authos-sqlite-linux-amd64.tar.gz sbom-path: dist/authos-sqlite-linux-amd64.spdx.json - name: Attest arm64 SBOM - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: dist/authos-sqlite-linux-arm64.tar.gz sbom-path: dist/authos-sqlite-linux-arm64.spdx.json - name: Attach assets to draft GitHub release - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: draft: true overwrite_files: false @@ -697,24 +697,24 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false - name: Setup QEMU - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 + uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 - name: Setup Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Download amd64 Docker binary - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docker-${{ matrix.backend }}-amd64 path: .artifacts/docker/${{ matrix.backend }}/amd64 - name: Download arm64 Docker binary - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docker-${{ matrix.backend }}-arm64 path: .artifacts/docker/${{ matrix.backend }}/arm64 @@ -728,7 +728,7 @@ jobs: - name: Build immutable multi-architecture OCI archive id: build_oci - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ./api file: ./api/Dockerfile @@ -776,7 +776,7 @@ jobs: > authos-docker-${{ matrix.backend }}.sha256 - name: Upload prepared OCI archive - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: prepared-docker-${{ matrix.backend }} path: dist @@ -956,7 +956,7 @@ jobs: sudo apt-get install -y skopeo - name: Download prepared OCI archive - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: prepared-docker-${{ matrix.backend }} path: dist @@ -983,7 +983,7 @@ jobs: echo "digest=${digest}" >> "${GITHUB_OUTPUT}" - name: Login to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -1018,18 +1018,18 @@ jobs: done - name: Attest Docker image provenance - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-name: docker.io/${{ env.DOCKER_IMAGE }} subject-digest: ${{ steps.image.outputs.digest }} - name: Attest container release record - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: dist/authos-docker-${{ matrix.backend }}-manifest.json - name: Attach container release record to draft - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: draft: true overwrite_files: false diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 3ee2157..a8819e7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -25,7 +25,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -42,12 +42,12 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' @@ -61,12 +61,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install cargo-audit - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-audit@0.22.2 @@ -85,18 +85,18 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: javascript-typescript build-mode: none queries: security-extended - name: Analyze - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:javascript-typescript diff --git a/.github/workflows/turbo-validate.yml b/.github/workflows/turbo-validate.yml index a8bd2a1..6405893 100644 --- a/.github/workflows/turbo-validate.yml +++ b/.github/workflows/turbo-validate.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false @@ -37,7 +37,7 @@ jobs: version: 0.13.0 - name: Install cargo-zigbuild - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-zigbuild fallback: none @@ -83,7 +83,7 @@ jobs: run: tar -C "${HOME}/.cache" --zstd -cf turbo-store.tar.zst cargo-turbo - name: Upload the shared dependency store - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: turbo-store path: turbo-store.tar.zst @@ -103,12 +103,12 @@ jobs: supplied: [true, false] steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' @@ -123,14 +123,14 @@ jobs: version: 0.13.0 - name: Install cargo-zigbuild - uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2 + uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2 with: tool: cargo-zigbuild fallback: none - name: Download the shared dependency store if: matrix.supplied - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: turbo-store path: .artifacts/turbo