diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml index 6bc18aa..cd4b997 100644 --- a/.github/workflows/auto-approve.yml +++ b/.github/workflows/auto-approve.yml @@ -33,12 +33,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dd1ac22..18215c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,17 +65,17 @@ jobs: workflows: ${{ steps.filter.outputs.workflows }} steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 1 - - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: filter with: filters: | @@ -106,21 +106,21 @@ jobs: contents: read steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 1 - name: Install pnpm ๐Ÿ“ฆ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' @@ -195,12 +195,12 @@ jobs: contents: read steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index f5bb7b9..d0c8339 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -31,12 +31,12 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false @@ -56,10 +56,10 @@ jobs: git remote set-url origin "https://x-access-token:${TOKEN}@github.com/${REPO}" - name: Install pnpm ๐Ÿ“ฆ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml index 2c30d52..ba87d55 100644 --- a/.github/workflows/hygiene.yml +++ b/.github/workflows/hygiene.yml @@ -27,18 +27,18 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 100 # Needed to see history for commit validation - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 109e250..12bf15f 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -24,12 +24,12 @@ jobs: pull-requests: write steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 1 @@ -42,7 +42,7 @@ jobs: private-key: ${{ secrets.CHITRANK_BOT_PRIVATE_KEY }} - name: Label PR ๐Ÿท๏ธ - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0 + uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 with: repo-token: '${{ steps.generate_token.outputs.token }}' sync-labels: true diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml index 5a8d30e..cdd67a7 100644 --- a/.github/workflows/maintenance.yml +++ b/.github/workflows/maintenance.yml @@ -36,12 +36,12 @@ jobs: pull-requests: write steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false @@ -53,10 +53,10 @@ jobs: private-key: ${{ secrets.CHITRANK_BOT_PRIVATE_KEY }} - name: Install pnpm ๐Ÿ“ฆ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' diff --git a/.github/workflows/pr-autofill.yml b/.github/workflows/pr-autofill.yml index 56f104f..d666c86 100644 --- a/.github/workflows/pr-autofill.yml +++ b/.github/workflows/pr-autofill.yml @@ -28,12 +28,12 @@ jobs: !contains(github.event.pull_request.labels.*.name, 'release') steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # Required to get commit history persist-credentials: false diff --git a/.github/workflows/publish-jsr.yml b/.github/workflows/publish-jsr.yml index f255121..3edd8b8 100644 --- a/.github/workflows/publish-jsr.yml +++ b/.github/workflows/publish-jsr.yml @@ -32,21 +32,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false - name: Setup Publishing Environment ๐Ÿ› ๏ธ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} @@ -54,7 +54,7 @@ jobs: run: pnpm install --frozen-lockfile --prefer-offline - name: Setup Deno ๐Ÿฆ• - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 + uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 with: deno-version: v2.x diff --git a/.github/workflows/release-finalize.yml b/.github/workflows/release-finalize.yml index 41a220a..0d89edc 100644 --- a/.github/workflows/release-finalize.yml +++ b/.github/workflows/release-finalize.yml @@ -43,12 +43,12 @@ jobs: tag_name: ${{ steps.vars.outputs.tag_name }} steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false @@ -82,10 +82,10 @@ jobs: git tag "$TAG_NAME" && git push origin "$TAG_NAME" || echo "Tag push failed, continuing..." - name: Setup Publishing Environment ๐Ÿ› ๏ธ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' @@ -116,7 +116,7 @@ jobs: attestations: write steps: - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false @@ -133,10 +133,10 @@ jobs: private-key: ${{ secrets.CHITRANK_BOT_PRIVATE_KEY }} - name: Setup Publishing Environment ๐Ÿ› ๏ธ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' @@ -169,7 +169,7 @@ jobs: gh release create "$TAG_NAME" --title "$TAG_NAME" --notes "$RELEASE_NOTES" $PRERELEASE_FLAG - name: Attest Build Artifacts ๐Ÿ“œ - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | dist/** @@ -184,7 +184,7 @@ jobs: id-token: write steps: - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false @@ -194,10 +194,10 @@ jobs: name: build-output - name: Setup Publishing Environment ๐Ÿ› ๏ธ - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'pnpm' @@ -206,7 +206,7 @@ jobs: run: pnpm install --frozen-lockfile --prefer-offline - name: Setup Deno ๐Ÿฆ• - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4 + uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 with: deno-version: v2.x diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml index e30604a..50d5fd4 100644 --- a/.github/workflows/release-prepare.yml +++ b/.github/workflows/release-prepare.yml @@ -29,18 +29,18 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false - name: Setup Node.js ๐ŸŸข - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ env.NODE_VERSION }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index a4caf68..2e8ce49 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -32,18 +32,18 @@ jobs: steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: 'Checkout code' - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 0 - name: 'Run analysis' - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif @@ -58,6 +58,6 @@ jobs: retention-days: 5 - name: 'Upload to code-scanning' - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: results.sarif diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 96539c3..0663e09 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -23,12 +23,12 @@ jobs: pull-requests: write steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Mark Stale ๐Ÿงน - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions! ๐ŸŒŠ' stale-pr-message: 'This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions! ๐Ÿ—๏ธ' diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml index 85ba0be..e9fdf16 100644 --- a/.github/workflows/workflow-lint.yml +++ b/.github/workflows/workflow-lint.yml @@ -27,15 +27,15 @@ jobs: actions: read steps: - name: Harden Runner ๐Ÿ›ก๏ธ - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 with: egress-policy: audit - name: Checkout repository ๐Ÿ“ฅ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false fetch-depth: 1 - name: Run zizmor ๐ŸŒˆ - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2