diff --git a/.github/workflows/build-extension-jar.yml b/.github/workflows/build-extension-jar.yml index 2005486d..84ee4c9c 100644 --- a/.github/workflows/build-extension-jar.yml +++ b/.github/workflows/build-extension-jar.yml @@ -33,14 +33,14 @@ jobs: continue-on-error: true steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -48,7 +48,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -74,14 +74,14 @@ jobs: GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }} steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -109,7 +109,7 @@ jobs: echo "::add-mask::${GPG_KEY_CONTENT}" - name: Set up JDK 21 - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: "temurin" @@ -121,7 +121,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -131,7 +131,7 @@ jobs: #look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} extra-repository-id: extension-repo diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 74859b17..7996dfae 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -36,19 +36,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -78,7 +78,7 @@ jobs: - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf # v1.0.66 + uses: anthropics/claude-code-action@700e7f8316990de46bed556429765647af760efc # v1.0.176 with: anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }} allowed_bots: ${{ inputs.allowed_bots }} diff --git a/.github/workflows/claude-test-review.yml b/.github/workflows/claude-test-review.yml index 2c774e53..22c0e5c1 100644 --- a/.github/workflows/claude-test-review.yml +++ b/.github/workflows/claude-test-review.yml @@ -27,19 +27,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -47,7 +47,7 @@ jobs: - name: Run Claude Test Quality Review id: claude-test-review - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf # v1.0.66 + uses: anthropics/claude-code-action@700e7f8316990de46bed556429765647af760efc # v1.0.176 with: anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }} track_progress: true diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 63090403..aa37a7d6 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -30,19 +30,19 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -50,7 +50,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf # v1.0.66 + uses: anthropics/claude-code-action@700e7f8316990de46bed556429765647af760efc # v1.0.176 with: anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }} # Enable CI tools by granting actions:read permission to Claude diff --git a/.github/workflows/cleanup-individual-artifacts.yml b/.github/workflows/cleanup-individual-artifacts.yml index a11e0bda..77790057 100644 --- a/.github/workflows/cleanup-individual-artifacts.yml +++ b/.github/workflows/cleanup-individual-artifacts.yml @@ -23,7 +23,7 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] steps: - name: Delete ${{ matrix.os }} Artifacts - uses: geekyeggo/delete-artifact@b54d29a59e55046d1f7fc8226cdda507e6b9cf62 # v5 + uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5 with: name: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.artifact_id || inputs.artifact_id }}-${{ matrix.os }}-${{ github.event_name == 'repository_dispatch' && github.event.client_payload.artifact_version || inputs.artifact_version }}-artifacts failOnError: false \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5c8f18cf..dc7329a8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -61,11 +61,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access if: matrix.language == 'java' - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 @@ -73,7 +73,7 @@ jobs: - name: Get secrets from vault if: matrix.language == 'java' id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -98,7 +98,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: languages: ${{ matrix.language }} build-mode: ${{ steps.set-build-mode.outputs.buildMode }} @@ -112,7 +112,7 @@ jobs: - name: Setup JDK if: matrix.language == 'java' - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: 'temurin' @@ -127,7 +127,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml if: matrix.language == 'java' - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -142,6 +142,6 @@ jobs: ${BUILD_COMMAND} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 3a24ac8f..53adbbc2 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Create Release Draft id: create-release - uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2 # v7.1.1 + uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 11cac0c5..fc9c266c 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -27,7 +27,7 @@ jobs: - name: Dependabot metadata id: dependabot-metadata # Use 'dependabot/fetch-metadata' to fetch the metadata about the update - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 - name: Approve patch and minor updates # Conditional statement to run the steps only when the update type is a patch or minor diff --git a/.github/workflows/ephemeral-cloud-infra.yml b/.github/workflows/ephemeral-cloud-infra.yml index 2286b4f9..73a801ec 100644 --- a/.github/workflows/ephemeral-cloud-infra.yml +++ b/.github/workflows/ephemeral-cloud-infra.yml @@ -114,14 +114,14 @@ jobs: resources_id: ${{ steps.create_infra.outputs.resources_id }} # Used to reference the resources created in the ephemeral infra steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -129,7 +129,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -137,26 +137,26 @@ jobs: permission-contents: read - name: Checkout liquibase-infrastructure - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main repository: liquibase/liquibase-infrastructure token: ${{ steps.get-token.outputs.token }} - name: Setup Terraform - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0 + uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 with: terraform_version: "1.5.7" terraform_wrapper: false - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_DEV_GITHUB_OIDC_ROLE_ARN_BUILD_LOGIC }} aws-region: us-east-1 - name: Install spacectl - uses: spacelift-io/setup-spacectl@d0e2c81467c31a68af60db5b1f9f1f54f79cab96 # v2.0.0 + uses: spacelift-io/setup-spacectl@7ca28b2af27d40aaaad7c787337b71b7703a0df7 # v2.3.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SPACELIFT_API_KEY_ENDPOINT: ${{ env.SPACELIFT_API_KEY_ENDPOINT }} @@ -188,7 +188,7 @@ jobs: - name: Upload Terraform state as artifact if: ${{ inputs.deploy && always()}} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: terraform-state path: test-automation-ephemeral/stack/terraform.tfstate @@ -307,7 +307,7 @@ jobs: # GuardDuty to flag the surviving publicly-accessible RDS. The Spacelift # stack is kept (state preserved) so the destroy can be retried (TECHOPS-523). if: ${{ inputs.destroy && failure() && steps.destroy_infra.outcome == 'failure' }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ env.EPHEMERAL_DANGLING_RESOURCES_SLACK_WEBHOOK }} SLACK_COLOR: danger diff --git a/.github/workflows/extension-attach-artifact-release.yml b/.github/workflows/extension-attach-artifact-release.yml index 2e6f25b8..bea55446 100644 --- a/.github/workflows/extension-attach-artifact-release.yml +++ b/.github/workflows/extension-attach-artifact-release.yml @@ -86,27 +86,27 @@ jobs: artifact_version: ${{ steps.get-artifact-version.outputs.artifact_version }} platform: ${{ steps.normalize-os.outputs.platform }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Normalize OS platform name id: normalize-os - uses: liquibase/build-logic/.github/actions/normalize-os@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/normalize-os@fef562bec397dcb4a352540cd0136407a7d1f368 # main - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up JDK ${{ inputs.javaBuildVersion }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -119,7 +119,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -192,7 +192,7 @@ jobs: echo "artifact_version=$artifact_version" >> $GITHUB_OUTPUT - name: Save Artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.get-artifact-id.outputs.artifact_id }}-${{ steps.normalize-os.outputs.platform }}-${{ steps.get-artifact-version.outputs.artifact_version }}-artifacts path: | @@ -204,7 +204,7 @@ jobs: name: Combine Jars runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Download Linux Artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 @@ -253,7 +253,7 @@ jobs: cp /tmp/linux/${MULTI_ARTIFACT_ID}-${MULTI_ARTIFACT_VERSION}.pom /tmp/combined/ - name: Upload multiplatform artifact - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: multiplatform-artifacts path: | @@ -286,24 +286,24 @@ jobs: - run: sleep 30 if: ${{ inputs.dry_run == false }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up JDK ${{ inputs.javaBuildVersion }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -311,7 +311,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -527,7 +527,7 @@ jobs: - name: Import GPG key id: import_gpg - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} @@ -626,7 +626,7 @@ jobs: - name: Attach Files to Draft Release (dry-run) id: attach-files-dry-run if: ${{ inputs.dry_run == true }} - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: v${{ inputs.dry_run_version }} fail_on_unmatched_files: true @@ -657,20 +657,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Notify Slack on Failure - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: failure SLACK_MESSAGE: | diff --git a/.github/workflows/extension-automated-release.yml b/.github/workflows/extension-automated-release.yml index 66ded6e0..4ab837a0 100644 --- a/.github/workflows/extension-automated-release.yml +++ b/.github/workflows/extension-automated-release.yml @@ -35,14 +35,14 @@ jobs: repository: ${{ fromJson(inputs.repositories) }} steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -50,7 +50,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -86,14 +86,14 @@ jobs: repository: ${{ fromJson(inputs.repositories) }} steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -101,7 +101,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -167,14 +167,14 @@ jobs: steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -182,7 +182,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -190,7 +190,7 @@ jobs: repositories: ${{ matrix.repository }} - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: "liquibase/${{ matrix.repository }}" token: ${{ steps.get-token.outputs.token }} @@ -202,7 +202,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -251,14 +251,14 @@ jobs: - repository: liquibase-parent-pom steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -266,7 +266,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -356,14 +356,14 @@ jobs: - repository: liquibase-parent-pom steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -371,7 +371,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -390,7 +390,7 @@ jobs: echo "ref=${REF:-refs/heads/main}" >> $GITHUB_OUTPUT - name: Checkout build-logic - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: ${{ steps.build-logic-ref.outputs.ref }} @@ -427,7 +427,7 @@ jobs: fi - name: Set up Java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: '21' distribution: 'temurin' @@ -508,7 +508,7 @@ jobs: echo "$REPOSITORY: v${VERSION} (${DEPLOYMENT_ID})" >> published_extensions.txt - name: Archive published extensions - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: published-extensions-${{ matrix.repository }} path: published_extensions.txt diff --git a/.github/workflows/extension-release-prepare.yml b/.github/workflows/extension-release-prepare.yml index 4b124349..face1889 100644 --- a/.github/workflows/extension-release-prepare.yml +++ b/.github/workflows/extension-release-prepare.yml @@ -27,27 +27,27 @@ jobs: steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main persist-credentials: false - name: Set up JDK - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -56,7 +56,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -75,7 +75,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -85,7 +85,7 @@ jobs: permission-metadata: read - name: Create Pull Request for version bump - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ steps.get-token.outputs.token }} commit-message: "chore: update version after release" @@ -100,7 +100,7 @@ jobs: - name: Save Release files if: always() - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-files path: | diff --git a/.github/workflows/extension-release-published.yml b/.github/workflows/extension-release-published.yml index 4e900268..be8a2b17 100644 --- a/.github/workflows/extension-release-published.yml +++ b/.github/workflows/extension-release-published.yml @@ -61,24 +61,24 @@ jobs: runs-on: ubuntu-latest needs: maven-release steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up Java for publishing to Maven Central Repository - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -86,7 +86,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -119,7 +119,7 @@ jobs: echo "ref=${REF:-refs/heads/main}" >> $GITHUB_OUTPUT - name: Checkout build-logic - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: ${{ steps.build-logic-ref.outputs.ref }} @@ -127,7 +127,7 @@ jobs: sparse-checkout: .github/actions/publish-to-central-portal - name: Download Release Artifacts - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12 + uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: tag: "${{ inputs.tag || github.event.release.tag_name }}" fileName: "*" @@ -145,24 +145,24 @@ jobs: if: ${{ inputs.dry_run == true }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up Java for publishing to Maven Central Repository - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -170,7 +170,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} extra-repository-id: dry-run-sonatype-nexus-staging @@ -190,7 +190,7 @@ jobs: run: echo "artifact_id=$(mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout)" >> $GITHUB_ENV - name: Download Release Artifacts - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12 + uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: releaseId: "${{ inputs.dry_run_release_id }}" fileName: "*" @@ -303,28 +303,28 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Download xsd files - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # Relative path under $GITHUB_WORKSPACE to place the repository path: ${{ github.event.repository.name }} repository: "liquibase/${{ github.event.repository.name }}" - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_BUILD_LOGIC }} aws-region: us-east-1 diff --git a/.github/workflows/extension-release-rollback.yml b/.github/workflows/extension-release-rollback.yml index db2d7b9a..394454fe 100644 --- a/.github/workflows/extension-release-rollback.yml +++ b/.github/workflows/extension-release-rollback.yml @@ -22,21 +22,21 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: main @@ -46,7 +46,7 @@ jobs: git config --local user.name "liquibot" - name: Set up JDK - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: 'temurin' @@ -54,7 +54,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} diff --git a/.github/workflows/fossa_ai.yml b/.github/workflows/fossa_ai.yml index 93b5b5c4..9cd05c68 100644 --- a/.github/workflows/fossa_ai.yml +++ b/.github/workflows/fossa_ai.yml @@ -30,20 +30,20 @@ jobs: steps: - name: Checkout Code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.ref }} fetch-depth: 0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -116,7 +116,7 @@ jobs: - name: Label PR with AI label if: ${{ inputs.check_ai_generated_code }} - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 continue-on-error: true with: github-token: ${{ secrets.GITHUB_TOKEN }} @@ -151,7 +151,7 @@ jobs: - name: Archive FOSSA 3Party License Report if: ${{ inputs.generate_fossa_3p_license_report }} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fossa-3party-license-report path: fossa-3party-license-report.html diff --git a/.github/workflows/generate-upload-enterprise-3p-fossa-report.yml b/.github/workflows/generate-upload-enterprise-3p-fossa-report.yml index 5940201f..0211d8d6 100644 --- a/.github/workflows/generate-upload-enterprise-3p-fossa-report.yml +++ b/.github/workflows/generate-upload-enterprise-3p-fossa-report.yml @@ -22,19 +22,19 @@ jobs: id-token: write # Required for OIDC to assume the role steps: - name: Checkout Code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.ref }} - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -88,7 +88,7 @@ jobs: ' fossa.json >> $csv_filename - name: Configure AWS credentials for S3 access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_INFRASTRUCTURE }} aws-region: us-east-1 @@ -105,7 +105,7 @@ jobs: - name: Upload 3rd Party report to build page if: always() - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: fossa-reports path: | diff --git a/.github/workflows/jira-set-fixversion-on-release.yml b/.github/workflows/jira-set-fixversion-on-release.yml index 11fb321a..12b990ce 100644 --- a/.github/workflows/jira-set-fixversion-on-release.yml +++ b/.github/workflows/jira-set-fixversion-on-release.yml @@ -89,20 +89,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get Jira service-account credentials from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set Fix Version + mark released - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: PROJECT_KEYS: ${{ inputs.project_keys }} TARGET_VERSION_NAME: ${{ inputs.target_version_name }} diff --git a/.github/workflows/jira-ticket-linker.yml b/.github/workflows/jira-ticket-linker.yml index 638b6853..43175f5f 100644 --- a/.github/workflows/jira-ticket-linker.yml +++ b/.github/workflows/jira-ticket-linker.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check and add ticket link - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: TICKET_PREFIX: ${{ inputs.ticket_prefix }} with: diff --git a/.github/workflows/lth-docker.yml b/.github/workflows/lth-docker.yml index a1b56cd3..a5e52aa9 100644 --- a/.github/workflows/lth-docker.yml +++ b/.github/workflows/lth-docker.yml @@ -18,17 +18,17 @@ jobs: steps: - name: Checkout code # Checkout the code from the repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -38,7 +38,7 @@ jobs: run: docker compose -f src/test/resources/docker/docker-compose.yml up -d - name: Setup Temurin Java 21 # Set up Java 21 with Temurin distribution and cache the Maven packages - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: temurin @@ -55,7 +55,7 @@ jobs: run: mvn -ntp -Dtest=${TEST_LEVEL}ExtensionHarnessSuite test # Run the Liquibase test harness at each test level - name: Test Reporter # Generate a test report using the Test Reporter action - uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5 # v1.9.1 + uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0 if: always() # Run the action even if the previous steps fail with: name: Liquibase Test Harness - ${{ matrix.liquibase-support-level }} Reports # Set the name of the test report diff --git a/.github/workflows/os-extension-test.yml b/.github/workflows/os-extension-test.yml index ea2f11d5..620fba40 100644 --- a/.github/workflows/os-extension-test.yml +++ b/.github/workflows/os-extension-test.yml @@ -59,25 +59,26 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Set up JDK ${{ inputs.javaBuildVersion }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" @@ -90,7 +91,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -117,7 +118,7 @@ jobs: - name: Notify Slack on Build Failure if: ${{ failure() && inputs.nightly }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ job.status }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U042HRTL4DT>" @@ -143,14 +144,14 @@ jobs: echo "PROJECT_ARTIFACT_NAME=${PROJECT_ARTIFACT_NAME}" >> $GITHUB_ENV - name: Save Artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.PROJECT_ARTIFACT_NAME }}-artifacts path: | ${{ inputs.artifactPath }}/target/* - name: Save Event File - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: Event File path: ${{ github.event_path }} @@ -166,25 +167,26 @@ jobs: needs: build steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ matrix.java }} distribution: "temurin" @@ -214,7 +216,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -253,7 +255,7 @@ jobs: - name: Notify Slack on Build Failure if: ${{ failure() && inputs.nightly }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ job.status }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U042HRTL4DT>" @@ -267,11 +269,11 @@ jobs: - name: Normalize OS platform name if: ${{ always() }} id: normalize-os - uses: liquibase/build-logic/.github/actions/normalize-os@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/normalize-os@fef562bec397dcb4a352540cd0136407a7d1f368 # main - name: Archive Test Results - ${{ matrix.os }} if: ${{ always() }} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: test-reports-jdk-${{ matrix.java }}-${{ steps.normalize-os.outputs.platform }} path: | diff --git a/.github/workflows/owasp-scanner.yml b/.github/workflows/owasp-scanner.yml index 9970aee3..fd8b5734 100644 --- a/.github/workflows/owasp-scanner.yml +++ b/.github/workflows/owasp-scanner.yml @@ -36,35 +36,35 @@ jobs: REPO_DIR: ${{ inputs.repository }} steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/${{ inputs.repository }} ref: ${{ inputs.branch }} path: ${{ inputs.repository }} - name: Set up Java for publishing to GitHub Repository - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: "21" distribution: "temurin" cache: "maven" - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -83,7 +83,7 @@ jobs: - name: Upload OWASP Dependency-Check results if: always() - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: owasp-dependency-check path: ${{ inputs.repository }}/target/dependency-check-report.html diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index b1cae36c..6e5acac7 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -110,7 +110,7 @@ jobs: HOMEBREW_PR_URL: ${{ steps.capture-pr.outputs.HOMEBREW_PR_URL }} steps: - name: Configure AWS credentials for devops vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.DEVOPS_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 @@ -132,14 +132,14 @@ jobs: echo "Loaded CLOUDFLARE_ACCOUNT_ID + R2 access/secret keys from /vault/devops." - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -147,7 +147,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -155,10 +155,10 @@ jobs: permission-contents: write permission-actions: write - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: "21" distribution: "temurin" @@ -170,7 +170,7 @@ jobs: maven-version: ${{ env.MAVEN_VERSION }} - name: Set up Ruby - uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 3.1.4 @@ -224,13 +224,13 @@ jobs: - name: Import GPG key id: import_gpg - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_BUILD_LOGIC }} aws-region: us-east-1 @@ -302,7 +302,7 @@ jobs: - name: Import GPG key for deb signing if: ${{ inputs.dry_run == false }} id: import_gpg_deb - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} @@ -350,7 +350,7 @@ jobs: - name: Import GPG key for dry-run deb signing if: ${{ inputs.dry_run == true }} id: import_gpg_deb_dryrun - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} @@ -384,7 +384,7 @@ jobs: - name: Import GPG key for dry-run RPM signing if: ${{ inputs.dry_run == true }} id: import_gpg_rpm_dryrun - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} @@ -510,7 +510,7 @@ jobs: - name: Import GPG key for RPM signing if: ${{ inputs.dry_run == false }} id: import_gpg_rpm - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 with: gpg_private_key: ${{ env.GPG_KEY_CONTENT }} passphrase: ${{ env.GPG_PASSPHRASE }} @@ -867,7 +867,7 @@ jobs: - name: Update Homebrew formula for ${{ inputs.distribution }} if: ${{ inputs.distribution != 'liquibase-secure' && startsWith(inputs.version, '4.') && steps.check-brew-pr.outputs.PR_EXISTS == 'false' && inputs.dry_run == false }} continue-on-error: true - uses: mislav/bump-homebrew-formula-action@581d1a926c3b95b39a0048a3934a3489290408d2 # v3 + uses: mislav/bump-homebrew-formula-action@f865c8b0dbebd6e263cc06782a0e974c61cf12d2 # v3 with: formula-name: ${{ inputs.distribution }} formula-path: Formula/l/${{ inputs.distribution }}.rb @@ -1040,14 +1040,14 @@ jobs: if: ${{ inputs.distribution != 'liquibase-secure' && inputs.dry_run == false }} steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -1055,7 +1055,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -1063,7 +1063,7 @@ jobs: repositories: liquibase - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/liquibase token: ${{ steps.get-token.outputs.token }} @@ -1136,7 +1136,7 @@ jobs: upload_secure_ansible_role: if: ${{ inputs.distribution == 'liquibase-secure' }} - uses: liquibase/liquibase-secure-ansible/.github/workflows/deploy-role.yml@21cb490554af2a686d1e09bc581503a6fabd2508 # main + uses: liquibase/liquibase-secure-ansible/.github/workflows/deploy-role.yml@065c5a0c6927b48a26037560716117dfa05b8aba # main secrets: inherit with: version: ${{ inputs.version }} diff --git a/.github/workflows/pom-release-published.yml b/.github/workflows/pom-release-published.yml index dcecc6ef..e5ea7664 100644 --- a/.github/workflows/pom-release-published.yml +++ b/.github/workflows/pom-release-published.yml @@ -13,24 +13,24 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up Java for publishing to Maven Central Repository - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: "21" distribution: "temurin" @@ -52,7 +52,7 @@ jobs: git reset HEAD~ --hard - name: Checkout build-logic - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: main @@ -64,7 +64,7 @@ jobs: run: echo "artifact_id=$(mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout)" >> $GITHUB_ENV - name: Download Release Artifacts - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12 + uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: tag: "${{ github.event.release.tag_name }}" filename: "${{ env.artifact_id }}-*" diff --git a/.github/workflows/pro-extension-build-for-liquibase.yml b/.github/workflows/pro-extension-build-for-liquibase.yml index 2c71cd31..b174b31e 100644 --- a/.github/workflows/pro-extension-build-for-liquibase.yml +++ b/.github/workflows/pro-extension-build-for-liquibase.yml @@ -78,14 +78,14 @@ jobs: steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -93,7 +93,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -101,20 +101,20 @@ jobs: permission-contents: read permission-packages: write - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ inputs.repository || github.repository }} ref: ${{ inputs.branch }} token: ${{ steps.get-token.outputs.token }} - name: Configure AWS Credentials for S3 - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 - name: Set up JDK 21 - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: "temurin" @@ -127,7 +127,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -185,14 +185,14 @@ jobs: run: echo "::set-output name=artifact_version::$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" - name: Save Artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.get-artifact-id.outputs.artifact_id }}-${{ matrix.os }}-${{ inputs.version }}-artifacts path: | ${{ inputs.artifactPath }}/target/* - name: Save Event File - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: ${{ steps.get-artifact-id.outputs.artifact_id }}-${{ matrix.os }}-${{ inputs.version }}-events @@ -209,14 +209,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -224,7 +224,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -232,7 +232,7 @@ jobs: permission-contents: read permission-packages: write - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ inputs.repository || github.repository }} token: ${{ steps.get-token.outputs.token }} @@ -331,7 +331,7 @@ jobs: fi - name: Upload multiplatform artifact - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: multiplatform-artifacts path: | @@ -347,14 +347,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -362,7 +362,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} diff --git a/.github/workflows/pro-extension-test.yml b/.github/workflows/pro-extension-test.yml index 37288f56..4ea6775f 100644 --- a/.github/workflows/pro-extension-test.yml +++ b/.github/workflows/pro-extension-test.yml @@ -112,40 +112,41 @@ jobs: steps: - name: Normalize OS platform name id: normalize-os - uses: liquibase/build-logic/.github/actions/normalize-os@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/normalize-os@fef562bec397dcb4a352540cd0136407a7d1f368 # main - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 - name: Set up JDK 21 - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: "temurin" @@ -158,7 +159,7 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -181,7 +182,7 @@ jobs: Invoke-Expression $env:EXTRA_WINDOWS_COMMAND - name: Setup Hashicorp Vault token - uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0 + uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0 if: ${{ inputs.vaultAddr != '' && inputs.vaultNamespace != '' }} with: url: ${{ inputs.vaultAddr }} @@ -256,7 +257,7 @@ jobs: - name: Notify Slack on Build Failure if: ${{ failure() && inputs.nightly }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ job.status }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U042HRTL4DT>" @@ -305,14 +306,14 @@ jobs: echo "artifact_version=${ARTIFACT_VERSION}" >> $GITHUB_OUTPUT - name: Save Artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.PROJECT_ARTIFACT_NAME }}-${{ steps.normalize-os.outputs.platform }}-${{ steps.get-artifact-version.outputs.artifact_version }}-artifacts path: | ${{ inputs.artifactPath }}/target/* - name: Save Event File - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: name: ${{ env.PROJECT_ARTIFACT_NAME }}-${{ steps.normalize-os.outputs.platform }}-${{ steps.get-artifact-version.outputs.artifact_version }}-events @@ -320,7 +321,7 @@ jobs: - name: Save Artifacts for Ubuntu Latest to be used for GPM publishing if: contains(matrix.os, 'ubuntu') - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.PROJECT_ARTIFACT_NAME }}-artifacts path: | @@ -337,28 +338,29 @@ jobs: needs: build steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Get Project Artifact Name working-directory: ${{ inputs.artifactPath }} @@ -369,14 +371,14 @@ jobs: echo "PROJECT_ARTIFACT_NAME=${PROJECT_ARTIFACT_NAME}" >> $GITHUB_ENV - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ matrix.java }} distribution: "temurin" cache: "maven" - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 @@ -388,13 +390,13 @@ jobs: # look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} - name: Normalize OS platform name id: normalize-os - uses: liquibase/build-logic/.github/actions/normalize-os@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/normalize-os@fef562bec397dcb4a352540cd0136407a7d1f368 # main - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -420,7 +422,7 @@ jobs: Invoke-Expression $env:EXTRA_WINDOWS_COMMAND - name: Setup Hashicorp Vault token - uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0 + uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0 if: ${{ inputs.vaultAddr != '' && inputs.vaultNamespace != '' }} with: url: ${{ inputs.vaultAddr }} @@ -503,7 +505,7 @@ jobs: - name: Notify Slack on Build Failure if: ${{ failure() && inputs.nightly }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ job.status }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U042HRTL4DT>" @@ -516,7 +518,7 @@ jobs: - name: Archive Test Results - ${{ matrix.os }} if: ${{ always() }} - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: test-reports-jdk-${{ matrix.java }}-${{ steps.normalize-os.outputs.platform }} path: | @@ -529,9 +531,10 @@ jobs: name: Combine Jars runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Get Project Artifact Name working-directory: ${{ inputs.artifactPath }} @@ -663,7 +666,7 @@ jobs: fi - name: Upload multiplatform artifact - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: multiplatform-artifacts path: | @@ -679,28 +682,29 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_GITHUB_OIDC_ROLE_ARN_S3_GHA }} aws-region: us-east-1 - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ github.event.pull_request.head.sha || github.ref }} + allow-unsafe-pr-checkout: true - name: Get Project Artifact Name working-directory: ${{ inputs.artifactPath }} @@ -712,7 +716,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} diff --git a/.github/workflows/publish-for-liquibase.yml b/.github/workflows/publish-for-liquibase.yml index ffdcba22..6d050233 100644 --- a/.github/workflows/publish-for-liquibase.yml +++ b/.github/workflows/publish-for-liquibase.yml @@ -50,14 +50,14 @@ jobs: GIT_USERNAME: "liquibot" steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -68,7 +68,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -77,7 +77,7 @@ jobs: permission-packages: write - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: ${{ inputs.repository }} token: ${{ steps.get-token.outputs.token }} @@ -93,7 +93,7 @@ jobs: ls -l ./artifacts - name: Set up JDK 21 - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: "temurin" @@ -101,7 +101,7 @@ jobs: #look for dependencies in maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} extra-repository-id: extension-repo diff --git a/.github/workflows/release-notes-aggregate.yml b/.github/workflows/release-notes-aggregate.yml index b259903f..6a81c496 100644 --- a/.github/workflows/release-notes-aggregate.yml +++ b/.github/workflows/release-notes-aggregate.yml @@ -68,14 +68,14 @@ jobs: fi - name: Check out build-logic (for the aggregator script) - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: ${{ inputs.build_logic_ref }} path: build-logic - name: Setup Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -83,13 +83,13 @@ jobs: run: pip install --quiet requests python-dotenv - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get Jira credentials from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -123,7 +123,7 @@ jobs: } >> "$GITHUB_STEP_SUMMARY" - name: Upload artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-notes path: release-notes-output/ diff --git a/.github/workflows/reusable-docker-build-qa.yml b/.github/workflows/reusable-docker-build-qa.yml index 975f90a0..24aa21ba 100644 --- a/.github/workflows/reusable-docker-build-qa.yml +++ b/.github/workflows/reusable-docker-build-qa.yml @@ -92,7 +92,7 @@ jobs: steps: - name: Configure AWS credentials for devops vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.DEVOPS_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 @@ -113,14 +113,14 @@ jobs: echo "Loaded CLOUDFLARE_ACCOUNT_ID + R2 access/secret keys from /vault/devops." - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets-liquibase - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -128,7 +128,7 @@ jobs: - name: Configure AWS credentials for Liquibase-Secure builds if: ${{ inputs.build_type == 'secure' }} - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_LIQUIBASE_PRO }} aws-region: us-east-1 @@ -136,7 +136,7 @@ jobs: - name: Get GitHub App token for Liquibase-Secure workflow trigger if: ${{ inputs.build_type == 'secure' }} id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -146,7 +146,7 @@ jobs: permission-actions: write - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install jq run: | @@ -584,15 +584,15 @@ jobs: - name: Set up Docker Buildx if: ${{ steps.validate-build.outcome == 'success' }} - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Set up QEMU if: ${{ steps.validate-build.outcome == 'success' }} - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Log in to internal Nexus Docker Registry if: ${{ steps.validate-build.outcome == 'success' && inputs.push_nexus }} - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ${{ env.REPO_URL }} username: ${{ env.REPO_USER }} @@ -600,7 +600,7 @@ jobs: - name: Login to GHCR if: ${{ steps.validate-build.outcome == 'success' && inputs.push_ghcr }} - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -608,7 +608,7 @@ jobs: - name: Build and push Docker image if: ${{ steps.validate-build.outcome == 'success' }} - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 env: BUILD_CONTEXT: ${{ inputs.build_context }} with: diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml index bfc1a309..829d6ea3 100644 --- a/.github/workflows/reusable-docker-build.yml +++ b/.github/workflows/reusable-docker-build.yml @@ -160,17 +160,17 @@ jobs: steps: - name: Checkout caller repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -184,18 +184,18 @@ jobs: echo "DOCKERHUB_USERNAME_DECODED=$decoded_username" >> "$GITHUB_ENV" - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Install Cosign if: inputs.sign_with_cosign - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Configure AWS credentials for PROD ECR id: configure-aws-credentials-prod - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_INFRASTRUCTURE }} aws-region: us-east-1 @@ -203,14 +203,14 @@ jobs: - name: Login to Docker Hub if: ${{ !inputs.dry_run && inputs.push_dockerhub }} - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ env.DOCKERHUB_USERNAME_DECODED }} password: ${{ env.DOCKERHUB_TOKEN }} - name: Login to GitHub Container Registry if: ${{ !inputs.dry_run && inputs.push_ghcr }} - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -218,7 +218,7 @@ jobs: - name: Login to ECR Registry (public) if: ${{ !inputs.dry_run && inputs.push_ecr }} - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 env: AWS_REGION: us-east-1 with: @@ -241,7 +241,7 @@ jobs: - name: Login to Private ECR Registry (dry-run) if: inputs.dry_run - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 env: AWS_REGION: us-east-1 with: @@ -318,7 +318,7 @@ jobs: - name: Build and Push Docker Image id: build-and-push - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.build_context }} file: ${{ inputs.dockerfile_path }} @@ -405,13 +405,13 @@ jobs: contents: read steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -445,7 +445,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Notify Slack on failure - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ steps.webhook.outputs.url }} SLACK_COLOR: failure diff --git a/.github/workflows/reusable-docker-publish.yml b/.github/workflows/reusable-docker-publish.yml index 2744f986..a9e8c521 100644 --- a/.github/workflows/reusable-docker-publish.yml +++ b/.github/workflows/reusable-docker-publish.yml @@ -201,7 +201,7 @@ jobs: - name: Get Release Notes from Release Drafter Draft if: ${{ !inputs.reuse_existing_release }} id: get-release-notes - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: RELEASE_TYPE: ${{ inputs.release_type }} TARGET_TAG: ${{ steps.release-tag.outputs.tag_name }} @@ -245,7 +245,7 @@ jobs: - name: Create GitHub Release (draft) if: ${{ !inputs.reuse_existing_release }} - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: name: ${{ steps.release-tag.outputs.release_name }} tag_name: ${{ steps.release-tag.outputs.tag_name }} diff --git a/.github/workflows/reusable-docker-readme.yml b/.github/workflows/reusable-docker-readme.yml index f354455d..35bf4678 100644 --- a/.github/workflows/reusable-docker-readme.yml +++ b/.github/workflows/reusable-docker-readme.yml @@ -36,17 +36,17 @@ jobs: steps: - name: Checkout caller repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase diff --git a/.github/workflows/reusable-docker-scan.yml b/.github/workflows/reusable-docker-scan.yml index 6a06fd9e..a2d012c1 100644 --- a/.github/workflows/reusable-docker-scan.yml +++ b/.github/workflows/reusable-docker-scan.yml @@ -86,13 +86,13 @@ jobs: steps: - name: Checkout caller repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Login to GHCR - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -119,7 +119,7 @@ jobs: echo "GHCR target: ${GHCR_IMAGE}" - name: Build and push to GHCR - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.build_context }} file: ${{ inputs.dockerfile_path }} @@ -174,10 +174,10 @@ jobs: steps: - name: Checkout caller repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build ${{ inputs.image_name }}${{ inputs.suffix }} from Dockerfile env: @@ -191,14 +191,14 @@ jobs: -t "${IMAGE_NAME}${SUFFIX}:${GHCR_TAG}" "$BUILD_CONTEXT" - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -212,7 +212,7 @@ jobs: echo "DOCKERHUB_USERNAME_DECODED=$decoded_username" >> "$GITHUB_ENV" - name: Login to Docker Hub - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ env.DOCKERHUB_USERNAME_DECODED }} password: ${{ env.DOCKERHUB_TOKEN }} @@ -344,14 +344,14 @@ jobs: id: upload-sarif if: ${{ always() && hashFiles('scout-results.sarif') != '' }} continue-on-error: true - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: "scout-results.sarif" category: "${{ inputs.image_name }}${{ inputs.suffix }}" - name: Upload Scout scan results to GitHub Security tab (retry) if: ${{ always() && hashFiles('scout-results.sarif') != '' && steps.upload-sarif.outcome == 'failure' }} - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: "scout-results.sarif" category: "${{ inputs.image_name }}${{ inputs.suffix }}" @@ -412,13 +412,13 @@ jobs: contents: read steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -518,7 +518,7 @@ jobs: echo "Alert reason: ${reason}" - name: Notify Slack on failure - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ steps.webhook.outputs.url }} SLACK_COLOR: failure diff --git a/.github/workflows/reusable-docker-test.yml b/.github/workflows/reusable-docker-test.yml index dee19e66..004f81e0 100644 --- a/.github/workflows/reusable-docker-test.yml +++ b/.github/workflows/reusable-docker-test.yml @@ -45,10 +45,10 @@ jobs: steps: - name: Checkout caller repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Checkout build-logic (test fixtures) - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: ${{ inputs.build_logic_ref }} @@ -59,7 +59,7 @@ jobs: uses: douglascamata/setup-docker-macos-action@d5ccc6aae0ce23e7700154f5e63cc53e6433ac48 # v1.1.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build image from ${{ inputs.dockerfile_path }} env: @@ -70,14 +70,14 @@ jobs: docker build -f "$DOCKERFILE_PATH" -t "liquibase/liquibase:$IMAGE_TAG" "$BUILD_CONTEXT" - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase diff --git a/.github/workflows/reusable-preview-distribute.yml b/.github/workflows/reusable-preview-distribute.yml index 41b23c01..64e0a901 100644 --- a/.github/workflows/reusable-preview-distribute.yml +++ b/.github/workflows/reusable-preview-distribute.yml @@ -142,7 +142,7 @@ jobs: echo "Inputs validated: product=$PRODUCT version=$VERSION customers=$CUSTOMERS expires-days=$DAYS" - name: Configure AWS credentials for devops vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.DEVOPS_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 @@ -164,13 +164,13 @@ jobs: echo "Loaded CLOUDFLARE_ACCOUNT_ID + R2 access/secret keys from /vault/devops." - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -192,7 +192,7 @@ jobs: echo "arn=$ROLE_ARN" >> "$GITHUB_OUTPUT" - name: Configure AWS credentials for S3 artifact read - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ steps.role.outputs.arn }} aws-region: us-east-1 @@ -338,7 +338,7 @@ jobs: echo "Distributed to $COUNT customer(s)." - name: Upload CSV artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: preview-urls-${{ inputs.product }}-${{ inputs.version }}-${{ github.run_id }} path: ${{ steps.distribute.outputs.csv }} diff --git a/.github/workflows/reusable-vulnerability-scan.yml b/.github/workflows/reusable-vulnerability-scan.yml index 108f0480..b4a01e7a 100644 --- a/.github/workflows/reusable-vulnerability-scan.yml +++ b/.github/workflows/reusable-vulnerability-scan.yml @@ -147,7 +147,7 @@ jobs: steps: - name: Checkout build-logic - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: ${{ inputs.build_logic_ref }} @@ -187,7 +187,7 @@ jobs: - name: Log in to GHCR if: inputs.mode == 'docker' && startsWith(inputs.source, 'ghcr.io/') - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -227,7 +227,7 @@ jobs: - name: Generate SBOM with Syft if: inputs.mode == 'docker' && inputs.generate_sbom - uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0 + uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 with: image: ${{ inputs.source }} format: spdx-json @@ -344,7 +344,7 @@ jobs: # which collided on shared env-var names from parse-json-secrets. - name: Configure AWS credentials for vault access if: (inputs.run_osv && inputs.vex_enabled) || inputs.dispatch_new_cves - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 @@ -353,7 +353,7 @@ jobs: - name: Get secrets from vault id: vault-secrets if: (inputs.run_osv && inputs.vex_enabled) || inputs.dispatch_new_cves - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -363,7 +363,7 @@ jobs: - name: Get GitHub App token for liquibase-pro id: get-token if: (inputs.run_osv && inputs.vex_enabled) || inputs.dispatch_new_cves - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -449,7 +449,7 @@ jobs: - name: Trivy surface scan (Docker mode) if: inputs.mode == 'docker' - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: version: v0.69.3 # 6fb20c8edd70745d6b34bff0387b53b03c8a760a image-ref: ${{ inputs.source }} @@ -481,7 +481,7 @@ jobs: TRIVY_OFFLINE_SCAN: "true" - name: Trivy deep scan - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: version: v0.69.3 # 6fb20c8edd70745d6b34bff0387b53b03c8a760a scan-type: rootfs @@ -524,7 +524,7 @@ jobs: - name: Grype SBOM scan id: grype if: inputs.mode == 'docker' && inputs.generate_sbom - uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 with: sbom: sbom.spdx.json fail-build: false @@ -605,7 +605,7 @@ jobs: IMAGE_TAG: ${{ inputs.image_tag || inputs.version || 'unknown' }} - name: Upload vulnerability report - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: vulnerability-report-${{ steps.sanitize.outputs.image_name }}-${{ steps.sanitize.outputs.image_tag }} path: | @@ -619,7 +619,7 @@ jobs: - name: Upload SARIF to Security tab (deep scan) if: inputs.upload_sarif && always() - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: trivy-deep.sarif category: ${{ inputs.sarif_category }}-deep @@ -627,7 +627,7 @@ jobs: - name: Upload SARIF to Security tab (surface scan) if: inputs.upload_sarif && inputs.mode == 'docker' && always() - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: sarif_file: trivy-surface.sarif category: ${{ inputs.sarif_category }}-surface @@ -916,13 +916,13 @@ jobs: contents: read steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -956,7 +956,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Notify Slack on failure - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_WEBHOOK: ${{ steps.webhook.outputs.url }} SLACK_COLOR: failure diff --git a/.github/workflows/slack-notification.yml b/.github/workflows/slack-notification.yml index b49068c2..478494e0 100644 --- a/.github/workflows/slack-notification.yml +++ b/.github/workflows/slack-notification.yml @@ -13,21 +13,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Notify Slack on Build Failure - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ github.event.action == 'test-failure' && 'danger' || 'good' }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ github.event.client_payload.server_url }}/${{ github.event.client_payload.repository }}/actions/runs/${{ github.event.client_payload.run_id }} <@U042HRTL4DT>. Triggered by repository: ${{ github.event.client_payload.repository }} and job: ${{ github.job }}" diff --git a/.github/workflows/sonar-coverage-merge.yml b/.github/workflows/sonar-coverage-merge.yml index 78554fe6..c6c2036f 100644 --- a/.github/workflows/sonar-coverage-merge.yml +++ b/.github/workflows/sonar-coverage-merge.yml @@ -24,33 +24,34 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha || github.event.after }} + allow-unsafe-pr-checkout: true - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up JDK - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: 21 distribution: temurin cache: maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} @@ -68,7 +69,7 @@ jobs: merge-multiple: false - name: Cache SonarCloud packages - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml index 6a625310..136310db 100644 --- a/.github/workflows/sonar-scan.yml +++ b/.github/workflows/sonar-scan.yml @@ -25,38 +25,38 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up JDK - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.javaBuildVersion }} distribution: "temurin" cache: "maven" - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} - name: Cache SonarCloud packages - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar @@ -142,7 +142,7 @@ jobs: - name: Download test reports (Push) if: ${{ !github.event.pull_request.number && steps.find-test-reports.outputs.artifact_name != '' }} - uses: dawidd6/action-download-artifact@1f8785ff7a5130826f848e7f72725c85d241860f # v18 + uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21 with: github_token: ${{ secrets.GITHUB_TOKEN }} workflow: test.yml diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 5cd253a7..f7fa4209 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -16,37 +16,37 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Set up JDK - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version }} distribution: temurin cache: maven - name: Set up Maven settings.xml - uses: liquibase/build-logic/.github/actions/setup-maven-settings@2660ba32055efd3301bcf624a3d60ca8b11cc482 # main + uses: liquibase/build-logic/.github/actions/setup-maven-settings@fef562bec397dcb4a352540cd0136407a7d1f368 # main with: gpm-token: ${{ env.LIQUIBOT_PAT_GPM_ACCESS }} - name: Cache SonarCloud packages - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar diff --git a/.github/workflows/subtree-sync.yml b/.github/workflows/subtree-sync.yml index 31b2e6d2..33798c92 100644 --- a/.github/workflows/subtree-sync.yml +++ b/.github/workflows/subtree-sync.yml @@ -47,14 +47,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -62,7 +62,7 @@ jobs: - name: Get GitHub App token id: get-token - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ env.LIQUIBASE_GITHUB_APP_ID }} private-key: ${{ env.LIQUIBASE_GITHUB_APP_PRIVATE_KEY }} @@ -72,7 +72,7 @@ jobs: permission-metadata: read - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: token: ${{ steps.get-token.outputs.token }} fetch-depth: 0 # Required for subtree operations to work correctly @@ -147,7 +147,7 @@ jobs: - name: Create Pull Request if: steps.pull_subtree.outputs.changed == 'true' - uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 id: create-pr with: token: ${{ steps.get-token.outputs.token }} @@ -172,7 +172,7 @@ jobs: - name: Notify Slack on failure or conflicts if: failure() || steps.pull_subtree.outputs.status == 'conflict' - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ steps.pull_subtree.outputs.status == 'conflict' && 'warning' || 'danger' }} SLACK_MESSAGE: | diff --git a/.github/workflows/sync-vault-secrets.yml b/.github/workflows/sync-vault-secrets.yml index f3335850..71b59f8c 100644 --- a/.github/workflows/sync-vault-secrets.yml +++ b/.github/workflows/sync-vault-secrets.yml @@ -18,14 +18,14 @@ jobs: steps: - name: Configure AWS credentials for vault access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase diff --git a/.github/workflows/trigger-enterprise-fossa-third-party-license-report.yml b/.github/workflows/trigger-enterprise-fossa-third-party-license-report.yml index 8ca60b80..5b7e95be 100644 --- a/.github/workflows/trigger-enterprise-fossa-third-party-license-report.yml +++ b/.github/workflows/trigger-enterprise-fossa-third-party-license-report.yml @@ -34,14 +34,14 @@ jobs: VERSION_INPUT: ${{ github.event.inputs.version_number_for_3p_fossa_report_generation }} steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase @@ -95,7 +95,7 @@ jobs: shell: bash - name: Await Run ID ${{ steps.return_dispatch.outputs.run_id }} - uses: Codex-/await-remote-run@1fd400f3e2033480390bd521e6626b24365c9c20 # v1 + uses: Codex-/await-remote-run@a56c556e6434d2d7ec9438dc656143b39532324e # v1 with: token: ${{ env.FOSSA_TRIGGER_REPORT_GENERATION }} run_id: ${{ steps.return_dispatch.outputs.run_id }} @@ -110,27 +110,27 @@ jobs: needs: wait-for-fossa-report-generation steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase parse-json-secrets: true - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/build-logic ref: main path: build-logic - name: Configure AWS credentials for S3 access - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ env.AWS_PROD_GITHUB_OIDC_ROLE_ARN_INFRASTRUCTURE }} aws-region: us-east-1 @@ -182,7 +182,7 @@ jobs: - name: Upload CSV to Artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: enterprise_report path: ./enterprise_report.csv @@ -198,17 +198,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: ${{ secrets.LIQUIBASE_VAULT_OIDC_ROLE_ARN }} aws-region: us-east-1 - name: Get secrets from vault id: vault-secrets - uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 # v2.0.10 + uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1 with: secret-ids: | ,/vault/liquibase diff --git a/.github/workflows/verify-package-availability.yml b/.github/workflows/verify-package-availability.yml index 3408561a..6d1d0d93 100644 --- a/.github/workflows/verify-package-availability.yml +++ b/.github/workflows/verify-package-availability.yml @@ -23,7 +23,7 @@ jobs: branch_exists: ${{ steps.check-placeholder-branch.outputs.branch_exists }} steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/liquibase @@ -66,7 +66,7 @@ jobs: echo "Latest SDKMAN version: $SDKMAN_OSS_VERSION" - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: liquibase/liquibase @@ -100,7 +100,7 @@ jobs: uses: ./.github/actions/setup-aws-vault - name: Send Slack Notification - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ steps.set-slack-details.outputs.status_color }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ steps.set-slack-details.outputs.status_message }} <@U040C8J8143> <@U04P39MS2SW> <@UHHJ6UAEQ>" @@ -196,7 +196,7 @@ jobs: uses: ./.github/actions/setup-aws-vault - name: Send Slack Notification - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ steps.set-slack-details.outputs.status_color }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ steps.set-slack-details.outputs.status_message }} ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U040C8J8143> <@U04P39MS2SW> <@UHHJ6UAEQ> " @@ -230,7 +230,7 @@ jobs: uses: ./.github/actions/setup-aws-vault - name: Send Slack Notification - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3 + uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2.4.0 env: SLACK_COLOR: ${{ steps.set-slack-details.outputs.status_color }} SLACK_MESSAGE: "View details on GitHub Actions: ${{ steps.set-slack-details.outputs.status_message }} ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} <@U040C8J8143> <@U04P39MS2SW> <@UHHJ6UAEQ> "