Skip to content

Commit 171f2a2

Browse files
renovate-botcuixq
authored andcommitted
chore(deps): update workflows (google#977)
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | patch | `v4.1.4` -> `v4.1.6` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | action | minor | `v4.3.1` -> `v4.4.1` | | gaurav-nelson/github-action-markdown-link-check | action | digest | `25b2c43` -> `7d83e59` | | [github/codeql-action](https://github.com/github/codeql-action) | action | patch | `v3.25.3` -> `v3.25.6` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | action | minor | `v5.0.0` -> `v5.1.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | action | patch | `v2.3.1` -> `v2.3.3` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v4.1.6`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v416) [Compare Source](https://github.com/actions/checkout/compare/v4.1.5...v4.1.6) - Check platform to set archive extension appropriately by [@&#8203;cory-miller](https://github.com/cory-miller) in [https://github.com/actions/checkout/pull/1732](https://github.com/actions/checkout/pull/1732) ### [`v4.1.5`](https://github.com/actions/checkout/releases/tag/v4.1.5) [Compare Source](https://github.com/actions/checkout/compare/v4.1.4...v4.1.5) #### What's Changed - Update NPM dependencies by [@&#8203;cory-miller](https://github.com/cory-miller) in [https://github.com/actions/checkout/pull/1703](https://github.com/actions/checkout/pull/1703) - Bump github/codeql-action from 2 to 3 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/actions/checkout/pull/1694](https://github.com/actions/checkout/pull/1694) - Bump actions/setup-node from 1 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/actions/checkout/pull/1696](https://github.com/actions/checkout/pull/1696) - Bump actions/upload-artifact from 2 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/actions/checkout/pull/1695](https://github.com/actions/checkout/pull/1695) - README: Suggest `user.email` to be `41898282+github-actions[bot]@&#8203;users.noreply.github.com` by [@&#8203;cory-miller](https://github.com/cory-miller) in [https://github.com/actions/checkout/pull/1707](https://github.com/actions/checkout/pull/1707) **Full Changelog**: actions/checkout@v4.1.4...v4.1.5 </details> <details> <summary>codecov/codecov-action (codecov/codecov-action)</summary> ### [`v4.4.1`](https://github.com/codecov/codecov-action/compare/v4.4.0...v4.4.1) [Compare Source](https://github.com/codecov/codecov-action/compare/v4.4.0...v4.4.1) ### [`v4.4.0`](https://github.com/codecov/codecov-action/releases/tag/v4.4.0) [Compare Source](https://github.com/codecov/codecov-action/compare/v4.3.1...v4.4.0) #### What's Changed - chore: Clarify isPullRequestFromFork by [@&#8203;jsoref](https://github.com/jsoref) in [https://github.com/codecov/codecov-action/pull/1411](https://github.com/codecov/codecov-action/pull/1411) - build(deps): bump actions/checkout from 4.1.4 to 4.1.5 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/codecov/codecov-action/pull/1423](https://github.com/codecov/codecov-action/pull/1423) - build(deps): bump github/codeql-action from 3.25.3 to 3.25.4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/codecov/codecov-action/pull/1421](https://github.com/codecov/codecov-action/pull/1421) - build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/codecov/codecov-action/pull/1420](https://github.com/codecov/codecov-action/pull/1420) - feat: remove GPG and run on spawn by [@&#8203;thomasrockhu-codecov](https://github.com/thomasrockhu-codecov) in [https://github.com/codecov/codecov-action/pull/1426](https://github.com/codecov/codecov-action/pull/1426) - build(deps-dev): bump [@&#8203;typescript-eslint/parser](https://github.com/typescript-eslint/parser) from 7.8.0 to 7.9.0 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/codecov/codecov-action/pull/1428](https://github.com/codecov/codecov-action/pull/1428) - chore(release): 4.4.0 by [@&#8203;thomasrockhu-codecov](https://github.com/thomasrockhu-codecov) in [https://github.com/codecov/codecov-action/pull/1430](https://github.com/codecov/codecov-action/pull/1430) **Full Changelog**: codecov/codecov-action@v4.3.1...v4.4.0 </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v3.25.6`](https://github.com/github/codeql-action/compare/v3.25.5...v3.25.6) [Compare Source](https://github.com/github/codeql-action/compare/v3.25.5...v3.25.6) ### [`v3.25.5`](https://github.com/github/codeql-action/compare/v3.25.4...v3.25.5) [Compare Source](https://github.com/github/codeql-action/compare/v3.25.4...v3.25.5) ### [`v3.25.4`](https://github.com/github/codeql-action/compare/v3.25.3...v3.25.4) [Compare Source](https://github.com/github/codeql-action/compare/v3.25.3...v3.25.4) </details> <details> <summary>goreleaser/goreleaser-action (goreleaser/goreleaser-action)</summary> ### [`v5.1.0`](https://github.com/goreleaser/goreleaser-action/releases/tag/v5.1.0) [Compare Source](https://github.com/goreleaser/goreleaser-action/compare/v5.0.0...v5.1.0) #### Important This version changes the default behavior of `latest` to `~> v1`. The next major of this action (v6), will change this to `~> v2`, and will be launched together with GoReleaser v2. #### What's Changed - docs: bump actions to latest major by [@&#8203;crazy-max](https://github.com/crazy-max) in [https://github.com/goreleaser/goreleaser-action/pull/435](https://github.com/goreleaser/goreleaser-action/pull/435) - chore(deps): bump docker/bake-action from 3 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/436](https://github.com/goreleaser/goreleaser-action/pull/436) - chore(deps): bump codecov/codecov-action from 3 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/437](https://github.com/goreleaser/goreleaser-action/pull/437) - chore(deps): bump actions/setup-go from 4 to 5 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/443](https://github.com/goreleaser/goreleaser-action/pull/443) - chore(deps): bump actions/upload-artifact from 3 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/444](https://github.com/goreleaser/goreleaser-action/pull/444) - Delete .kodiak.toml by [@&#8203;vedantmgoyal9](https://github.com/vedantmgoyal9) in [https://github.com/goreleaser/goreleaser-action/pull/446](https://github.com/goreleaser/goreleaser-action/pull/446) - chore(deps): bump codecov/codecov-action from 3 to 4 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/448](https://github.com/goreleaser/goreleaser-action/pull/448) - chore(deps): bump ip from 2.0.0 to 2.0.1 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/450](https://github.com/goreleaser/goreleaser-action/pull/450) - Upgrade setup-go action version in README by [@&#8203;kishaningithub](https://github.com/kishaningithub) in [https://github.com/goreleaser/goreleaser-action/pull/455](https://github.com/goreleaser/goreleaser-action/pull/455) - chore(deps): bump tar from 6.1.14 to 6.2.1 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/456](https://github.com/goreleaser/goreleaser-action/pull/456) - chore: use corepack to install yarn by [@&#8203;crazy-max](https://github.com/crazy-max) in [https://github.com/goreleaser/goreleaser-action/pull/458](https://github.com/goreleaser/goreleaser-action/pull/458) - feat: lock this major version of the action to use '~> v1' as 'latest' by [@&#8203;caarlos0](https://github.com/caarlos0) in [https://github.com/goreleaser/goreleaser-action/pull/461](https://github.com/goreleaser/goreleaser-action/pull/461) - chore(deps): bump semver from 7.6.0 to 7.6.2 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/462](https://github.com/goreleaser/goreleaser-action/pull/462) - chore(deps): bump [@&#8203;actions/http-client](https://github.com/actions/http-client) from 2.2.0 to 2.2.1 by [@&#8203;dependabot](https://github.com/dependabot) in [https://github.com/goreleaser/goreleaser-action/pull/451](https://github.com/goreleaser/goreleaser-action/pull/451) #### New Contributors - [@&#8203;vedantmgoyal9](https://github.com/vedantmgoyal9) made their first contribution in [https://github.com/goreleaser/goreleaser-action/pull/446](https://github.com/goreleaser/goreleaser-action/pull/446) **Full Changelog**: goreleaser/goreleaser-action@v5.0.0...v5.1.0 </details> <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.3.3`](https://github.com/ossf/scorecard-action/releases/tag/v2.3.3) [Compare Source](https://github.com/ossf/scorecard-action/compare/v2.3.2...v2.3.3) > \[!NOTE]\ > There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag #### What's Changed - 🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1366](https://github.com/ossf/scorecard-action/pull/1366) - 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1374](https://github.com/ossf/scorecard-action/pull/1374) - 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1377](https://github.com/ossf/scorecard-action/pull/1377) For a full changelist of what these include, see the [v5.0.0-rc1](https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc1) and [v5.0.0-rc2](https://github.com/ossf/scorecard/releases/tag/v5.0.0-rc2) release notes. ##### Documentation - 📖 Move token discussion out of main README. by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1279](https://github.com/ossf/scorecard-action/pull/1279) - 📖 link to `ossf/scorecard` workflow instead of maintaining an example by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1352](https://github.com/ossf/scorecard-action/pull/1352) - 📖 update api links to new scorecard.dev site by [@&#8203;spencerschrock](https://github.com/spencerschrock) in [https://github.com/ossf/scorecard-action/pull/1376](https://github.com/ossf/scorecard-action/pull/1376) **Full Changelog**: ossf/scorecard-action@v2.3.1...v2.3.3 ### [`v2.3.2`](https://github.com/ossf/scorecard-action/compare/v2.3.1...v2.3.2) [Compare Source](https://github.com/ossf/scorecard-action/compare/v2.3.1...v2.3.2) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/google/osv-scanner). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNTEuMiIsInVwZGF0ZWRJblZlciI6IjM3LjM2My41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: Xueqin Cui <[email protected]>
1 parent edb03e3 commit 171f2a2

10 files changed

+27
-27
lines changed

.github/workflows/checks.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
runs-on: ubuntu-latest
4040
steps:
4141
- name: Check out code
42-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
42+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
4343
with:
4444
persist-credentials: false
4545
- run: scripts/report_uncleaned_snapshots.py
@@ -50,7 +50,7 @@ jobs:
5050
runs-on: ubuntu-latest
5151
steps:
5252
- name: Check out code
53-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
53+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
5454
with:
5555
persist-credentials: false
5656
- name: Run lint action
@@ -62,7 +62,7 @@ jobs:
6262
runs-on: ubuntu-latest
6363
steps:
6464
- name: Check out code
65-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
65+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
6666
with:
6767
persist-credentials: false
6868
- name: Set up Go
@@ -78,7 +78,7 @@ jobs:
7878
runs-on: ubuntu-latest
7979
steps:
8080
- name: Check out code
81-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
81+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
8282
with:
8383
persist-credentials: false
8484
- run: scripts/build_test_images.sh
@@ -100,7 +100,7 @@ jobs:
100100
runs-on: ${{ matrix.os }}
101101
steps:
102102
- name: Check out code
103-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
103+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
104104
with:
105105
persist-credentials: false
106106
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7

.github/workflows/codeql-analysis.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,15 @@ jobs:
4242

4343
steps:
4444
- name: Checkout repository
45-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
45+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
4646
# Update go to the latest version to support minor go versions is go.mod file
4747
- name: Install Go
4848
uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
4949
with:
5050
go-version-file: go.mod
5151
# Initializes the CodeQL tools for scanning.
5252
- name: Initialize CodeQL
53-
uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
53+
uses: github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
5454
with:
5555
languages: ${{ matrix.language }}
5656
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
6161
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
6262
# If this step fails, then you should remove it and run the build manually (see below)
6363
- name: Autobuild
64-
uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
64+
uses: github/codeql-action/autobuild@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
6565

6666
# ℹ️ Command-line programs to run using the OS shell.
6767
# 📚 https://git.io/JvXDl
@@ -75,4 +75,4 @@ jobs:
7575
# make release
7676

7777
- name: Perform CodeQL Analysis
78-
uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
78+
uses: github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6

.github/workflows/goreleaser.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
DOCKER_CLI_EXPERIMENTAL: "enabled"
2323
steps:
2424
- name: Checkout
25-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
25+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
2626
with:
2727
fetch-depth: 0
2828
ref: ${{ inputs.commit }}
@@ -41,7 +41,7 @@ jobs:
4141
password: ${{ secrets.GITHUB_TOKEN }}
4242
- name: Run GoReleaser
4343
id: run-goreleaser
44-
uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
44+
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
4545
with:
4646
version: latest
4747
args: release --rm-dist

.github/workflows/link-check-on-push.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ jobs:
1212
contents: read # to fetch code (actions/checkout)
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
16-
- uses: gaurav-nelson/github-action-markdown-link-check@25b2c436c653f0d4500d3c2df86e5c14e71e44e1
15+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
16+
- uses: gaurav-nelson/github-action-markdown-link-check@7d83e59a57f3c201c76eed3d33dff64ec4452d27
1717
with:
1818
use-quiet-mode: "yes"
1919
base-branch: "main"

.github/workflows/link-check.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ jobs:
1414
contents: read # to fetch code (actions/checkout)
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
18-
- uses: gaurav-nelson/github-action-markdown-link-check@25b2c436c653f0d4500d3c2df86e5c14e71e44e1
17+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
18+
- uses: gaurav-nelson/github-action-markdown-link-check@7d83e59a57f3c201c76eed3d33dff64ec4452d27
1919
with:
2020
use-quiet-mode: "yes"
2121
# Documentation available here: https://github.com/marketplace/actions/markdown-link-check

.github/workflows/osv-scanner-reusable-pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
security-events: write # for uploading SARIF files
5050
runs-on: ubuntu-latest
5151
steps:
52-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
52+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
5353
with:
5454
fetch-depth: 0
5555
# Do persist credentials, as we need it for the git checkout later
@@ -108,6 +108,6 @@ jobs:
108108
# Upload the results to GitHub's code scanning dashboard.
109109
- name: "Upload to code-scanning"
110110
if: ${{ !cancelled() && inputs.upload-sarif == true }}
111-
uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
111+
uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
112112
with:
113113
sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-reusable.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454
security-events: write # for uploading SARIF files
5555
runs-on: ubuntu-latest
5656
steps:
57-
- uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
57+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
5858
with:
5959
persist-credentials: false
6060
- name: "Download custom artifact if specified"
@@ -91,6 +91,6 @@ jobs:
9191
# Upload the results to GitHub's code scanning dashboard.
9292
- name: "Upload to code-scanning"
9393
if: "${{ !cancelled() && inputs.upload-sarif == true }}"
94-
uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
94+
uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
9595
with:
9696
sarif_file: ${{ inputs.results-file-name }}

.github/workflows/prerelease-check.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
runs-on: ubuntu-latest
3737
steps:
3838
- name: Check out code
39-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
39+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
4040
with:
4141
persist-credentials: false
4242
- name: Run lint action
@@ -48,7 +48,7 @@ jobs:
4848
runs-on: ubuntu-latest
4949
steps:
5050
- name: Check out code
51-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
51+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
5252
with:
5353
persist-credentials: false
5454
ref: ${{ inputs.commit }}
@@ -65,7 +65,7 @@ jobs:
6565
runs-on: ubuntu-latest
6666
steps:
6767
- name: Check out code
68-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
68+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
6969
with:
7070
persist-credentials: false
7171
- run: scripts/build_test_images.sh
@@ -87,7 +87,7 @@ jobs:
8787
runs-on: ${{ matrix.os }}
8888
steps:
8989
- name: Check out code
90-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
90+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
9191
with:
9292
persist-credentials: false
9393
ref: ${{ inputs.commit }}

.github/workflows/scorecards.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,12 @@ jobs:
3333

3434
steps:
3535
- name: "Checkout code"
36-
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
36+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
3737
with:
3838
persist-credentials: false
3939

4040
- name: "Run analysis"
41-
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
41+
uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
4242
with:
4343
results_file: results.sarif
4444
results_format: sarif
@@ -68,6 +68,6 @@ jobs:
6868

6969
# Upload the results to GitHub's code scanning dashboard.
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
71+
uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
7272
with:
7373
sarif_file: results.sarif

.github/workflows/test-action/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ runs:
2929
TEST_ACCEPTANCE: true
3030
run: ./scripts/run_tests.sh
3131
- name: Upload coverage to Codecov
32-
uses: codecov/codecov-action@5ecb98a3c6b747ed38dc09f787459979aebb39be # v4.3.1
32+
uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4.4.1
3333
with:
3434
token: ${{ inputs.codecov_token }}
3535
fail_ci_if_error: true

0 commit comments

Comments
 (0)