Merge branch 'main' into chore/scorecard-periodic

Author: hyperpolymath

.github/workflows/agda-meta-checker.yml

@@ -62,7 +62,7 @@ jobs:
 
       - name: Setup Haskell
         if: steps.detect.outputs.relevant == 'true'
-        uses: haskell-actions/setup@v2.11.0
+        uses: haskell-actions/setup@v2.12.0
         with:
           ghc-version: '9.6'
           cabal-version: '3.10'

.github/workflows/codeql.yml

@@ -42,12 +42,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.3
+        uses: github/codeql-action/init@v4.37.6
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.3
+        uses: github/codeql-action/analyze@v4.37.6
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/mvp-smoke.yml

@@ -40,7 +40,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.9.1
 
       - name: Install just
-        uses: taiki-e/install-action@v2.85.3
+        uses: taiki-e/install-action@v2.85.8
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`

.github/workflows/s4-loop.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2.9.1
       - name: Install just
-        uses: taiki-e/install-action@v2.85.3
+        uses: taiki-e/install-action@v2.85.8
         with:
           tool: just@1.51.0
       - name: Install system dependencies

.hypatia-baseline.json

@@ -2016,5 +2016,143 @@
     "type": "SD022",
     "file": "docs/SSG_ROADMAP.adoc",
     "note": "Roadmap doc: paths are planned future modules, not renames"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "scorecard",
+    "type": "DependencyPinning",
+    "file": "."
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "agda-meta-checker.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "boj-build.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "bridge-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cargo-audit.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cflite_batch.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "cflite_pr.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "chapel-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "codeql.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "container-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "dogfood-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "dogfood-proofs-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "formal-verification.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "generator-generic-ossf-slsa3-publish.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "ghcr-publish.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "idris2-abi-ci.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "live-provers.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "mvp-smoke.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "pages.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "s4-loop.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "server-boot-gate.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "verification-proofs-cron.yml"
+  },
+  {
+    "severity": "medium",
+    "rule_module": "workflow_audit",
+    "type": "unpinned_action",
+    "file": "workflow-linter.yml"
   }
 ]