diff --git a/.github/workflows/capture-baseline.yml b/.github/workflows/capture-baseline.yml index c4e26e5..24f8c34 100644 --- a/.github/workflows/capture-baseline.yml +++ b/.github/workflows/capture-baseline.yml @@ -60,7 +60,7 @@ jobs: skill: [hawkscan, api, stackhawk-data-seed, hawkscan-ci, optimize] model: [claude-sonnet-4-6, claude-opus-4-7, claude-haiku-4-5-20251001] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: ref: ${{ inputs.tag }} - uses: astral-sh/setup-uv@v5 @@ -126,7 +126,7 @@ jobs: skill: [hawkscan, api, stackhawk-data-seed, hawkscan-ci, optimize] model: [gpt-5.5, o3] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: ref: ${{ inputs.tag }} - uses: astral-sh/setup-uv@v5 @@ -206,7 +206,7 @@ jobs: skill: [hawkscan, api, stackhawk-data-seed, hawkscan-ci, optimize] model: [default] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: ref: ${{ inputs.tag }} - uses: astral-sh/setup-uv@v5 @@ -286,7 +286,7 @@ jobs: skill: [hawkscan, api, stackhawk-data-seed, hawkscan-ci, optimize] model: [default] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: ref: ${{ inputs.tag }} - uses: astral-sh/setup-uv@v5 @@ -353,7 +353,7 @@ jobs: if: always() runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 # download-artifact@v4 does NOT fail when the pattern matches zero artifacts # (it has no error-on-no-artifacts input) — so a run where every capture job diff --git a/.github/workflows/claude-pr-review-action.yml b/.github/workflows/claude-pr-review-action.yml index 8ca9a82..4a9c1a4 100644 --- a/.github/workflows/claude-pr-review-action.yml +++ b/.github/workflows/claude-pr-review-action.yml @@ -55,7 +55,7 @@ jobs: id-token: write steps: - name: Check out repository code - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/generate-and-validate.yml b/.github/workflows/generate-and-validate.yml index 28a70bd..9f65537 100644 --- a/.github/workflows/generate-and-validate.yml +++ b/.github/workflows/generate-and-validate.yml @@ -10,7 +10,7 @@ jobs: validate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Validate SKILL.md frontmatter run: | @@ -208,7 +208,7 @@ jobs: generate-cursor-rules: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Generate Cursor rules run: bash scripts/generate-cursor-rules.sh diff --git a/.github/workflows/marketplace-install-verify.yml b/.github/workflows/marketplace-install-verify.yml index 2db3c2b..13c4621 100644 --- a/.github/workflows/marketplace-install-verify.yml +++ b/.github/workflows/marketplace-install-verify.yml @@ -79,7 +79,7 @@ jobs: if: ${{ inputs.tool == 'all' || inputs.tool == 'claude-code' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # need tags for `git describe` in local mode - name: Install Claude Code CLI (native) @@ -132,7 +132,7 @@ jobs: if: ${{ inputs.tool == 'all' || inputs.tool == 'codex' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Rewrite git SSH->HTTPS @@ -195,7 +195,7 @@ jobs: if: ${{ inputs.tool == 'all' || inputs.tool == 'copilot' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - uses: actions/setup-node@v6 @@ -269,7 +269,7 @@ jobs: if: ${{ inputs.tool == 'all' || inputs.tool == 'agy' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Rewrite git SSH->HTTPS diff --git a/.github/workflows/publish-eval-badges.yml b/.github/workflows/publish-eval-badges.yml index 14a4990..c8f9ece 100644 --- a/.github/workflows/publish-eval-badges.yml +++ b/.github/workflows/publish-eval-badges.yml @@ -35,7 +35,7 @@ jobs: # stays available as the deliberate "publish this run anyway" override. if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # tags needed for the meta-artifact fallback below diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2fef851..7786adc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,7 +34,7 @@ jobs: echo "version=${version}" >> "$GITHUB_OUTPUT" echo "Running release for tag: ${tag}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ steps.version.outputs.tag }} @@ -135,7 +135,7 @@ jobs: permissions: actions: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Dispatch capture-baseline # GITHUB_TOKEN can dispatch workflows in the same repo for most orgs. # If org policy blocks it, swap to the TF_GITHUB_TOKEN PAT that @@ -162,7 +162,7 @@ jobs: - name: Pull secrets run: biodome ci save-secrets - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release.outputs.tag }} diff --git a/.github/workflows/skill-evals.yml b/.github/workflows/skill-evals.yml index 603d7d0..9477463 100644 --- a/.github/workflows/skill-evals.yml +++ b/.github/workflows/skill-evals.yml @@ -53,7 +53,7 @@ jobs: name: validate eval config runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 - name: Validate prompts.yaml + process-checks.json run: uv run validate @@ -63,7 +63,7 @@ jobs: name: pytest (lib) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 - name: Run lib tests run: uv run pytest -q @@ -83,7 +83,7 @@ jobs: model: [claude-sonnet-4-6, claude-opus-4-7, claude-haiku-4-5-20251001] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 - name: Install Claude Code CLI (native) @@ -180,7 +180,7 @@ jobs: model: [gpt-5.5, o3] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 - uses: actions/setup-node@v6 with: @@ -274,7 +274,7 @@ jobs: # model: [default] # # steps: -# - uses: actions/checkout@v7 +# - uses: actions/checkout@v7.0.1 # - uses: astral-sh/setup-uv@v5 # - name: Install Claude Code CLI (native, rubric grader) # run: | @@ -373,7 +373,7 @@ jobs: model: [default] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: astral-sh/setup-uv@v5 - name: Install Cursor CLI @@ -449,7 +449,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - uses: actions/download-artifact@v8 diff --git a/.github/workflows/tag-on-merge.yml b/.github/workflows/tag-on-merge.yml index 43e035b..d2f238f 100644 --- a/.github/workflows/tag-on-merge.yml +++ b/.github/workflows/tag-on-merge.yml @@ -11,7 +11,7 @@ jobs: tag: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create version tag run: |