diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index 039db67..b95d637 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -35,7 +35,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Run actionlint uses: raven-actions/actionlint@v2 diff --git a/.github/workflows/anomaly-to-issue.yml b/.github/workflows/anomaly-to-issue.yml index 429ca01..062eec4 100644 --- a/.github/workflows/anomaly-to-issue.yml +++ b/.github/workflows/anomaly-to-issue.yml @@ -40,10 +40,10 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.merge_commit_sha }} - - uses: actions/github-script@v7 + - uses: actions/github-script@v9 env: ANOMALY_DIR: ${{ inputs.anomaly-dir }} README_NAME: ${{ inputs.readme-filename }} diff --git a/.github/workflows/anomaly-triage.yml b/.github/workflows/anomaly-triage.yml index 3107ede..bb2fd44 100644 --- a/.github/workflows/anomaly-triage.yml +++ b/.github/workflows/anomaly-triage.yml @@ -65,13 +65,13 @@ jobs: issues: write steps: - name: Checkout PR head - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 - name: Triage anomalies - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: ANOMALIES_PATH: ${{ inputs.anomalies-path }} DEFAULT_DOWNSTREAM: ${{ inputs.default-downstream-repo }} @@ -316,7 +316,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Run actionlint uses: raven-actions/actionlint@v2 with: diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index 5a70e9b..a7ac068 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: meta - uses: dependabot/fetch-metadata@v2 + uses: dependabot/fetch-metadata@v3 with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/branch-naming.yml b/.github/workflows/branch-naming.yml index 783254e..c2b09bb 100644 --- a/.github/workflows/branch-naming.yml +++ b/.github/workflows/branch-naming.yml @@ -33,7 +33,7 @@ jobs: permissions: pull-requests: read steps: - - uses: actions/github-script@v7 + - uses: actions/github-script@v9 env: BRANCH_PATTERN: ${{ inputs.pattern }} ENFORCE: ${{ inputs.enforce }} diff --git a/.github/workflows/changelog-fragment.yml b/.github/workflows/changelog-fragment.yml index 626f1d6..1bc6b7c 100644 --- a/.github/workflows/changelog-fragment.yml +++ b/.github/workflows/changelog-fragment.yml @@ -35,7 +35,7 @@ jobs: pull-requests: read contents: read steps: - - uses: actions/github-script@v7 + - uses: actions/github-script@v9 env: SRC_PREFIX: ${{ inputs.src-path-prefix }} FRAGMENT_DIR: ${{ inputs.fragment-dir }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index e1b15ce..40211e8 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -35,8 +35,8 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@v4 - - uses: actions/dependency-review-action@v4 + - uses: actions/checkout@v7 + - uses: actions/dependency-review-action@v5 with: fail-on-severity: ${{ inputs.fail-on-severity }} fail-on-scopes: ${{ inputs.fail-on-scopes }} diff --git a/.github/workflows/doc-orphan-detector.yml b/.github/workflows/doc-orphan-detector.yml index 08d3dbd..365037f 100644 --- a/.github/workflows/doc-orphan-detector.yml +++ b/.github/workflows/doc-orphan-detector.yml @@ -43,13 +43,13 @@ jobs: contents: read issues: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: # Full history + all branches so `origin/main...` diffs and # per-path commit timestamps are available for every branch. fetch-depth: 0 - - uses: actions/github-script@v7 + - uses: actions/github-script@v9 env: STALE_HOURS: ${{ inputs.stale-hours }} BASE_LABEL: ${{ inputs.base-label }} diff --git a/.github/workflows/doc-policy-lint.yml b/.github/workflows/doc-policy-lint.yml index 8ea8884..bc82050 100644 --- a/.github/workflows/doc-policy-lint.yml +++ b/.github/workflows/doc-policy-lint.yml @@ -47,12 +47,12 @@ jobs: contents: read steps: - name: Check out caller repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Check out github-workflows for doc-policy helper scripts - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ArchonVII/github-workflows ref: ${{ inputs.workflow-library-ref }} diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml index f482eb1..483fb3e 100644 --- a/.github/workflows/go-ci.yml +++ b/.github/workflows/go-ci.yml @@ -89,9 +89,9 @@ jobs: os: ${{ fromJSON(inputs.os-matrix) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v6 with: go-version: ${{ matrix.go }} cache: ${{ inputs.cache }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 3e98472..6a0e9af 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -24,7 +24,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/labeler@v5 + - uses: actions/labeler@v6 with: repo-token: ${{ secrets.GITHUB_TOKEN }} sync-labels: ${{ inputs.sync-labels }} diff --git a/.github/workflows/lock-threads.yml b/.github/workflows/lock-threads.yml index 5e13709..6850df5 100644 --- a/.github/workflows/lock-threads.yml +++ b/.github/workflows/lock-threads.yml @@ -33,7 +33,7 @@ jobs: issues: write pull-requests: write steps: - - uses: dessant/lock-threads@v5 + - uses: dessant/lock-threads@v6 with: issue-inactive-days: ${{ inputs.issue-inactive-days }} pr-inactive-days: ${{ inputs.pr-inactive-days }} diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml index 09536b2..d2d52c5 100644 --- a/.github/workflows/node-ci.yml +++ b/.github/workflows/node-ci.yml @@ -66,7 +66,7 @@ jobs: os: ${{ fromJSON(inputs.os-matrix) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Detect package manager id: pm @@ -163,12 +163,12 @@ jobs: - name: Set up pnpm if: steps.pm.outputs.manager == 'pnpm' - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: ${{ inputs.pnpm-version }} run_install: false - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: ${{ matrix.node }} cache: ${{ steps.pm.outputs.cache }} diff --git a/.github/workflows/pr-body-autoinject.yml b/.github/workflows/pr-body-autoinject.yml index 262dd43..295bc47 100644 --- a/.github/workflows/pr-body-autoinject.yml +++ b/.github/workflows/pr-body-autoinject.yml @@ -29,7 +29,7 @@ jobs: pull-requests: write contents: read steps: - - uses: actions/github-script@v7 + - uses: actions/github-script@v9 env: DOC_EXT_LIST: ${{ inputs.doc-only-extensions }} DOC_PREFIXES: ${{ inputs.doc-only-path-prefixes }} diff --git a/.github/workflows/pr-policy.yml b/.github/workflows/pr-policy.yml index 988b8db..66d6e9d 100644 --- a/.github/workflows/pr-policy.yml +++ b/.github/workflows/pr-policy.yml @@ -147,14 +147,14 @@ jobs: # (2026-05-20), finding M1. - name: Check out github-workflows for policy helper scripts if: github.event.pull_request.draft == false - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ArchonVII/github-workflows ref: ${{ inputs.workflow-library-ref }} path: __github-workflows__ - name: Enforce ready-for-review PR policy - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: REQUIRE_LINKED_ISSUE: ${{ inputs.require-linked-issue }} REQUIRE_VERIFICATION_SECTION: ${{ inputs.require-verification-section }} @@ -246,7 +246,7 @@ jobs: # ---------------------------------------------------------------------- - name: Role separation check if: inputs.role-separation-warnings || inputs.enforce-role-separation - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: ENFORCE_ROLE_SEPARATION: ${{ inputs.enforce-role-separation }} ROLE_PROTECTED_PATHS: ${{ inputs.role-protected-paths }} @@ -360,7 +360,7 @@ jobs: # update. The exemption lives upstream in the commit path. # ---------------------------------------------------------------------- - name: Evidence check (warning-only by default) - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: DOC_EXT_LIST: ${{ inputs.doc-only-extensions }} DOC_PREFIXES: ${{ inputs.doc-only-path-prefixes }} @@ -494,7 +494,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Run actionlint uses: raven-actions/actionlint@v2 with: diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index 9eda6b6..b309dc8 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -68,15 +68,15 @@ jobs: os: ${{ fromJSON(inputs.os-matrix) }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v6 with: python-version: ${{ matrix.python }} - name: Install uv if: inputs.use-uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@v7 - name: Install dependencies shell: bash diff --git a/.github/workflows/repo-required-gate.yml b/.github/workflows/repo-required-gate.yml index dc1c82d..faa8594 100644 --- a/.github/workflows/repo-required-gate.yml +++ b/.github/workflows/repo-required-gate.yml @@ -239,7 +239,7 @@ jobs: # `workflow-library-ref` (default v1) so parser+workflow are versioned # together. - name: Check out github-workflows for classifier script - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ArchonVII/github-workflows ref: ${{ inputs.workflow-library-ref }} @@ -247,7 +247,7 @@ jobs: - name: Classify changed files id: detect - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: STACK: ${{ inputs.stack }} NODE_PATHS: ${{ inputs.node-paths }} @@ -370,14 +370,14 @@ jobs: pull-requests: write steps: - name: Check out github-workflows for PR contract validator - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ArchonVII/github-workflows ref: ${{ inputs.workflow-library-ref }} path: __github-workflows__ - name: Enforce PR policy - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: BRANCH_PATTERN: ${{ inputs.branch-pattern }} REQUIRE_LINKED_ISSUE: ${{ inputs.require-linked-issue }} @@ -505,7 +505,7 @@ jobs: # 2026-06-07 (ArchonVII/hudson-bend#43; #53). - name: Warn if the repo PR template can't pass the contract if: ${{ !cancelled() && github.event.pull_request.draft == false }} - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: WORKFLOW_LIBRARY_REF: ${{ inputs.workflow-library-ref }} with: @@ -572,7 +572,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Run actionlint if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }} uses: raven-actions/actionlint@v2 @@ -603,7 +603,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Validate check map shell: bash run: | @@ -623,9 +623,9 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Dependency review - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@v5 with: fail-on-severity: high fail-on-scopes: runtime @@ -690,9 +690,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: ${{ fromJSON(inputs.node-versions)[0] }} diff --git a/.github/workflows/repo-update-log-fragment.yml b/.github/workflows/repo-update-log-fragment.yml index 54d0a04..42a0042 100644 --- a/.github/workflows/repo-update-log-fragment.yml +++ b/.github/workflows/repo-update-log-fragment.yml @@ -63,14 +63,14 @@ jobs: contents: read steps: - name: Check out github-workflows for ledger validator - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ArchonVII/github-workflows ref: ${{ inputs.workflow-library-ref }} path: __github-workflows__ - name: Enforce repo update log fragment - uses: actions/github-script@v7 + uses: actions/github-script@v9 env: FRAGMENT_DIR: ${{ inputs.fragment-dir }} WORKFLOW_LIBRARY_REF: ${{ inputs.workflow-library-ref }} diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml index be75ec8..384fc29 100644 --- a/.github/workflows/self-test.yml +++ b/.github/workflows/self-test.yml @@ -29,9 +29,9 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 with: node-version: "20" cache: "npm" diff --git a/.github/workflows/semantic-pr-title.yml b/.github/workflows/semantic-pr-title.yml index dea402a..b429e0a 100644 --- a/.github/workflows/semantic-pr-title.yml +++ b/.github/workflows/semantic-pr-title.yml @@ -49,7 +49,7 @@ jobs: permissions: pull-requests: read steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index d8744a4..094397f 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -1,6 +1,6 @@ name: Stale (reusable) -# Auto-mark and auto-close stale issues and PRs. Wraps actions/stale@v9 so +# Auto-mark and auto-close stale issues and PRs. Wraps actions/stale@v10 so # every consumer repo gets the same versioning and a consistent tone. # # Defaults are conservative: 60 days idle → marked stale, another 14 days @@ -48,7 +48,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@v9 + - uses: actions/stale@v10 with: days-before-stale: ${{ inputs.days-before-stale }} days-before-close: ${{ inputs.days-before-close }} diff --git a/scripts/workflow-structure.test.mjs b/scripts/workflow-structure.test.mjs index ee0d867..7ec391e 100644 --- a/scripts/workflow-structure.test.mjs +++ b/scripts/workflow-structure.test.mjs @@ -24,7 +24,7 @@ describe('node-ci workflow package-manager setup', () => { const detectIndex = body.indexOf('- name: Detect package manager'); const setupPnpmIndex = body.indexOf('- name: Set up pnpm'); - const setupNodeIndex = body.indexOf('- uses: actions/setup-node@v4'); + const setupNodeIndex = body.search(/- uses: actions\/setup-node@v\d+/); expect(detectIndex).toBeGreaterThan(-1); expect(setupPnpmIndex).toBeGreaterThan(detectIndex); @@ -34,7 +34,7 @@ describe('node-ci workflow package-manager setup', () => { it('installs pnpm before setup-node enables pnpm caching', () => { const body = readWorkflow('node-ci'); - expect(body).toContain('uses: pnpm/action-setup@v4'); + expect(body).toMatch(/uses: pnpm\/action-setup@v\d+/); expect(body).toContain("if: steps.pm.outputs.manager == 'pnpm'"); expect(body).toContain('version: ${{ inputs.pnpm-version }}'); expect(body).toContain('run_install: false');