From 176858d5658a454d04c6a6b33000ea7bbb0b9cf9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 02:46:40 +0000 Subject: [PATCH] Bump the github-actions group across 1 directory with 9 updates Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.3` | `7.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.0.0` | | [actions/configure-pages](https://github.com/actions/configure-pages) | `5.0.0` | `6.0.0` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `5.1.1` | `6.2.3` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.5.0` | `7.0.0` | Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4.4.0...820762786026740c76f36085b0efc47a31fe5020) Updates `actions/configure-pages` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/configure-pages/releases) - [Commits](https://github.com/actions/configure-pages/compare/983d7736d9b0ae728b81ab479565c72886d7745b...45bfe0192ca1faeb007ade9deae92b16b8254a0d) Updates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](https://github.com/actions/upload-pages-artifact/compare/56afc609e74202658d3ffba0e8f6dda462b719fa...fc324d3547104276b827a68afc52ff2a11cc49c9) Updates `actions/deploy-pages` from 4.0.5 to 5.0.0 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](https://github.com/actions/deploy-pages/compare/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e...cd2ce8fcbc39b97be8ca5fce6e763baed58fa128) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `aws-actions/configure-aws-credentials` from 5.1.1 to 6.2.3 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/61815dcd50bd041e203e49132bacad1fd04d2708...e6de054238d6b7531b4efff3b6587d9aade6a06c) Updates `actions/setup-go` from 6.5.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/configure-pages dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/deploy-pages dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/intel-engine.yml | 4 +- .github/workflows/pages.yml | 10 +-- .github/workflows/release-candidate.yml | 12 ++-- .github/workflows/release.yml | 96 ++++++++++++------------- .github/workflows/security.yml | 6 +- .github/workflows/tests.yml | 6 +- 6 files changed, 67 insertions(+), 67 deletions(-) diff --git a/.github/workflows/intel-engine.yml b/.github/workflows/intel-engine.yml index 2674c845..62924114 100644 --- a/.github/workflows/intel-engine.yml +++ b/.github/workflows/intel-engine.yml @@ -41,7 +41,7 @@ jobs: ENGINES: ${{ github.event.inputs.readiness_engines || 'dory' }} READINESS_EXTRA_ARGS: ${{ github.event.inputs.readiness_extra_args || '' }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false @@ -92,7 +92,7 @@ jobs: - name: Upload readiness artifacts if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: intel-readiness path: ${{ env.READINESS_WORKDIR }} diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 9b15833e..18c7183b 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -33,7 +33,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Configure the job-scoped Sparkle authority cache run: echo "DORY_SPARKLE_AUTHORITY_CACHE=$RUNNER_TEMP/dory-sparkle-authority" >> "$GITHUB_ENV" - name: Preserve newer live signed release metadata as one transaction @@ -51,7 +51,7 @@ jobs: done python3 .github/scripts/verify-pages-release-metadata.py \ preserve "$live" website/public - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -71,12 +71,12 @@ jobs: done python3 .github/scripts/verify-pages-release-metadata.py \ verify docs-build docs-build - - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: docs-build - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Verify all live signed metadata converges to the deployed transaction run: | set -euo pipefail diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml index 8be7c4cd..b2b88abc 100644 --- a/.github/workflows/release-candidate.yml +++ b/.github/workflows/release-candidate.yml @@ -33,7 +33,7 @@ jobs: outputs: previous_version: ${{ steps.identity.outputs.previous_version }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - name: Prove version, build, source, and release absence @@ -58,7 +58,7 @@ jobs: runs-on: ubuntu-24.04-arm timeout-minutes: 180 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Install guest build prerequisites run: sudo apt-get update && sudo apt-get install -y binutils-aarch64-linux-gnu e2fsprogs file patchelf protobuf-compiler zstd @@ -100,7 +100,7 @@ jobs: guest/desktop/verify-build.sh arm64 "$distro" done - name: Upload same-commit guest payloads - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-candidate-guest-arm64-${{ github.sha }}-${{ github.run_attempt }} retention-days: 30 @@ -142,7 +142,7 @@ jobs: runs-on: [self-hosted, macOS, arm64, dory, release] timeout-minutes: 720 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable @@ -161,7 +161,7 @@ jobs: - name: Ensure the pinned Xcode Metal toolchain is available run: xcodebuild -downloadComponent MetalToolchain - name: Download same-commit guest payloads - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-candidate-guest-arm64-${{ github.sha }}-${{ github.run_attempt }} path: guest/out @@ -320,7 +320,7 @@ jobs: raise SystemExit("candidate inventory does not bind the exact optional asset count") PY - name: Upload immutable signed candidate for physical qualification - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-signed-release-candidate-${{ github.sha }}-${{ github.run_attempt }} retention-days: 30 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 07f45035..f12dd827 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -81,7 +81,7 @@ jobs: build: ${{ steps.identity.outputs.build }} previous_version: ${{ steps.identity.outputs.previous_version }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - name: Prove project identity and monotonic build before artifact work @@ -177,7 +177,7 @@ jobs: DORY_BENCH_DOWNLOAD_BYTES: ${{ vars.DORY_BENCH_DOWNLOAD_BYTES }} steps: - name: Obtain short-lived ECR credentials through GitHub OIDC - uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ vars.DORY_RELEASE_AWS_ROLE_ARN }} aws-region: ${{ vars.DORY_RELEASE_ECR_REGION }} @@ -298,7 +298,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable with: components: rustfmt, clippy @@ -318,7 +318,7 @@ jobs: runs-on: ubuntu-24.04-arm timeout-minutes: 180 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Install guest build prerequisites run: sudo apt-get update && sudo apt-get install -y binutils-aarch64-linux-gnu e2fsprogs file patchelf protobuf-compiler zstd @@ -357,7 +357,7 @@ jobs: guest/desktop/verify-build.sh arm64 "$distro" done - name: Upload same-commit arm64 guest payload - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-guest-arm64-${{ github.sha }} retention-days: 30 @@ -399,7 +399,7 @@ jobs: runs-on: macos-latest timeout-minutes: 120 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Select newest installed Xcode run: | @@ -536,13 +536,13 @@ jobs: appcast: ${{ steps.build.outputs.appcast }} app_update: ${{ steps.build.outputs.app_update }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Download same-commit arm64 guest payload - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-guest-arm64-${{ github.sha }} path: guest/out @@ -847,7 +847,7 @@ jobs: - name: Upload live release-gate evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-live-release-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 30 @@ -858,7 +858,7 @@ jobs: ${{ runner.temp }}/dory-release-live-* - name: Stage immutable public candidate for long qualification - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} retention-days: 30 @@ -881,11 +881,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download the immutable candidate - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -903,7 +903,7 @@ jobs: --confirm CLEAN-RELEASE-USER-HOMEBREW-INSTALL - name: Retain Homebrew install evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-homebrew-install-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -919,11 +919,11 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download immutable public candidate before the job token expires - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -934,7 +934,7 @@ jobs: echo "selected: $xcode_app" echo "DEVELOPER_DIR=$xcode_app/Contents/Developer" >> "$GITHUB_ENV" - name: Obtain short-lived ECR credentials through GitHub OIDC - uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ vars.DORY_RELEASE_AWS_ROLE_ARN }} aws-region: ${{ vars.DORY_RELEASE_ECR_REGION }} @@ -964,11 +964,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download immutable public candidate - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -996,7 +996,7 @@ jobs: --download-bytes "${{ vars.DORY_BENCH_DOWNLOAD_BYTES }}" \ --confirm CLEAN-BENCHMARK-USER-DELETE-ENGINE-DATA - name: Retain exact container-engine performance evidence for publication - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-container-engine-performance-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -1012,11 +1012,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download immutable public candidate - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -1083,7 +1083,7 @@ jobs: --source-confirm PHYSICAL-VZ-SOURCE-PRESERVATION - name: Upload Sonoma certification evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-sonoma-vz-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -1100,11 +1100,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download immutable public candidate - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -1162,7 +1162,7 @@ jobs: --confirm PHYSICAL-SOURCE-PRESERVATION - name: Upload source-preservation evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-source-lan-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -1179,11 +1179,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: persist-credentials: false - name: Download immutable candidate for checksum binding - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build @@ -1222,7 +1222,7 @@ jobs: "$GITHUB_SHA" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" "$VERSION" "$ARM64_SHA256" \ > "$evidence/manifest.txt" - name: Retain exact-cask audit evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-homebrew-audit-evidence-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -1240,39 +1240,39 @@ jobs: version: ${{ needs.release_candidate.outputs.version }} sha256: ${{ needs.release_candidate.outputs.sha256 }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Download the exact candidate with fresh job credentials - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-release-candidate-${{ github.sha }}-${{ github.run_attempt }} path: release-build - name: Download exact-candidate physical sleep/wake evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-live-release-evidence-${{ github.sha }}-${{ github.run_attempt }} path: live-release-evidence - name: Download exact-candidate Sonoma VZ evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-sonoma-vz-evidence-${{ github.sha }}-${{ github.run_attempt }} path: sonoma-vz-evidence - name: Download exact-candidate LAN/Tailscale source-preservation evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-source-lan-evidence-${{ github.sha }}-${{ github.run_attempt }} path: source-lan-evidence - name: Download exact-candidate Homebrew audit evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-homebrew-audit-evidence-${{ github.sha }}-${{ github.run_attempt }} path: homebrew-audit-evidence - name: Download exact-candidate Homebrew install evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-homebrew-install-evidence-${{ github.sha }}-${{ github.run_attempt }} path: homebrew-install-evidence - name: Download exact-candidate container-engine performance evidence - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-container-engine-performance-evidence-${{ github.sha }}-${{ github.run_attempt }} path: container-engine-performance-evidence @@ -1677,7 +1677,7 @@ jobs: test ! -s "$(dirname "$manifest")/new-host-panic-reports.txt" done - name: Upload final qualification evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-release-qualification-${{ github.sha }}-${{ github.run_attempt }} retention-days: 90 @@ -1732,13 +1732,13 @@ jobs: shasum -a 256 -c "$(basename "$archive").sha256" ) - name: Upload generated appcast - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-appcast path: release-build/appcast.xml if-no-files-found: error - name: Upload generated component catalog - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dory-component-catalog path: | @@ -2008,16 +2008,16 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Configure the job-scoped Sparkle authority cache run: echo "DORY_SPARKLE_AUTHORITY_CACHE=$RUNNER_TEMP/dory-sparkle-authority" >> "$GITHUB_ENV" - name: Download metadata generated from the signed release - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-appcast path: appcast-artifact - name: Download catalog generated from the signed release - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dory-component-catalog path: component-catalog-artifact @@ -2063,7 +2063,7 @@ jobs: done python3 .github/scripts/verify-pages-release-metadata.py \ verify "$metadata" generated-release - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -2085,12 +2085,12 @@ jobs: done python3 .github/scripts/verify-pages-release-metadata.py \ verify docs-build release-pages-artifact - - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: docs-build - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 - name: Verify the public update metadata exactly matches this release run: | set -euo pipefail @@ -2129,7 +2129,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: ref: main - name: Bump cask to the released version @@ -2214,7 +2214,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Verify GitHub assets, Pages metadata, and both Homebrew casks env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4a4ebf87..a66813ee 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,13 +17,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable - name: Audit Rust lockfile run: | cargo install cargo-audit --locked --version 0.22.2 bash .github/scripts/test-rust-security.sh - - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' cache: npm @@ -40,7 +40,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: fail-on-severity: high diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 0cadee13..d5f30ba8 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Release publication contract run: scripts/publish-release.sh --check - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable @@ -26,7 +26,7 @@ jobs: runs-on: macos-latest timeout-minutes: 120 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Select Xcode run: | newest="$(ls -d /Applications/Xcode_26*.app | sort -V | tail -1)" @@ -107,7 +107,7 @@ jobs: python3 .github/scripts/test-release-candidate-qualifier.py python3 .github/scripts/test-release-qualification-verifier.py - name: Install Go toolchain - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.5' - name: Network helper