From 414d6f4c19cd2f1273cfc45087a44ae2476aba8c Mon Sep 17 00:00:00 2001 From: Mend Renovate Date: Mon, 26 Oct 2026 09:21:18 +0000 Subject: [PATCH] chore(deps): update github-actions --- .github/actions/build-base-image/action.yaml | 8 ++++---- .../actions/ossf-compiler-flags-scanner/action.yaml | 4 ++-- .github/workflows/github-actions-checker.yaml | 2 +- .github/workflows/license-scanner.yaml | 4 ++-- .github/workflows/main.yaml | 2 +- .github/workflows/openvex-sync.yml | 6 +++--- .github/workflows/ossf-compiler-flags-scanner.yaml | 2 +- .github/workflows/osv-scanner-scheduled.yml | 2 +- .github/workflows/pr-comment.yaml | 12 ++++++------ .github/workflows/renovate-vendored-deps.yaml | 2 +- .github/workflows/reusable-build-flavours.yaml | 2 +- .github/workflows/reusable-build-ios.yaml | 4 ++-- .github/workflows/reusable-build-macos.yaml | 6 +++--- .github/workflows/reusable-build-otp.yaml | 2 +- .github/workflows/reusable-build-windows.yaml | 4 ++-- .github/workflows/reusable-check-files.yaml | 2 +- .github/workflows/reusable-documentation.yaml | 2 +- .github/workflows/reusable-pack.yaml | 12 ++++++------ .github/workflows/reusable-release.yaml | 4 ++-- .github/workflows/reusable-sbom.yaml | 6 +++--- .github/workflows/reusable-static-analysis.yaml | 2 +- .github/workflows/reusable-system-test.yaml | 2 +- .github/workflows/reusable-test.yaml | 2 +- .../reusable-vendor-vulnerability-scanner.yml | 8 ++++---- .github/workflows/scorecard.yaml | 2 +- .github/workflows/sigstore-updater.yml | 8 ++++---- .github/workflows/sync-github-releases.yaml | 2 +- .github/workflows/update-base.yaml | 4 ++-- .github/workflows/upload-windows-zip.yaml | 2 +- 29 files changed, 60 insertions(+), 60 deletions(-) diff --git a/.github/actions/build-base-image/action.yaml b/.github/actions/build-base-image/action.yaml index b1b443f6133d..fc673366d092 100644 --- a/.github/actions/build-base-image/action.yaml +++ b/.github/actions/build-base-image/action.yaml @@ -47,14 +47,14 @@ runs: run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT - name: Cache BASE image - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 if: inputs.TYPE == '64-bit' || inputs.TYPE == 'clang' with: path: otp_docker_base.tar key: ${{ runner.os }}-${{ hashFiles('.github/dockerfiles/Dockerfile.ubuntu-base', '.github/scripts/build-base-image.sh') }}-${{ steps.date.outputs.date }}-${{ hashFiles('OTP_VERSION') }} - name: Docker login - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -70,7 +70,7 @@ runs: - name: Cache pre-built src id: cache-src if: inputs.BUILD_IMAGE == 'true' - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: otp_src.tar.gz key: prebuilt-src-${{ github.ref_name }}-${{ github.sha }} @@ -84,7 +84,7 @@ runs: - name: Cache pre-built binaries id: cache-binary if: inputs.BUILD_IMAGE == 'true' && steps.cache-src.outputs.cache-hit == 'true' - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: otp_cache.tar.gz key: prebuilt-cache-${{ inputs.TYPE }}-${{ github.ref_name }}-${{ github.sha }} diff --git a/.github/actions/ossf-compiler-flags-scanner/action.yaml b/.github/actions/ossf-compiler-flags-scanner/action.yaml index 9effd08f4983..9421101f1a22 100644 --- a/.github/actions/ossf-compiler-flags-scanner/action.yaml +++ b/.github/actions/ossf-compiler-flags-scanner/action.yaml @@ -28,7 +28,7 @@ inputs: runs: using: composite steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: ossf/wg-best-practices-os-developers sparse-checkout: docs/Compiler-Hardening-Guides/compiler-options-scraper @@ -58,6 +58,6 @@ runs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" if: ${{ !cancelled() && inputs.upload == 'true' }} - uses: github/codeql-action/upload-sarif@ce5e7eeac396d720fe2d802714996c8ce561e311 # v3.39.0 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/.github/workflows/github-actions-checker.yaml b/.github/workflows/github-actions-checker.yaml index 86940a4b4f18..b152d664fbbb 100644 --- a/.github/workflows/github-actions-checker.yaml +++ b/.github/workflows/github-actions-checker.yaml @@ -37,7 +37,7 @@ jobs: runs-on: 'ubuntu-latest' name: 'ratchet' steps: - - uses: 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' # v6.1.0 + - uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1 with: persist-credentials: false - id: files diff --git a/.github/workflows/license-scanner.yaml b/.github/workflows/license-scanner.yaml index 3d97f8ae46f1..b7ef28604cf3 100644 --- a/.github/workflows/license-scanner.yaml +++ b/.github/workflows/license-scanner.yaml @@ -35,13 +35,13 @@ jobs: run-scan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: '0' persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: - otp-version: '27' + otp-version: '29.1.2' - name: License Compliance Check all files run: ./scripts/license-header.es ci diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml index 3ab341f7e37e..de4f89e1768a 100644 --- a/.github/workflows/main.yaml +++ b/.github/workflows/main.yaml @@ -316,7 +316,7 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run zizmor diff --git a/.github/workflows/openvex-sync.yml b/.github/workflows/openvex-sync.yml index 8df711575d8d..16ed18329bfd 100644 --- a/.github/workflows/openvex-sync.yml +++ b/.github/workflows/openvex-sync.yml @@ -39,20 +39,20 @@ jobs: pull-requests: write # use inside the otp-compliance.es if: github.repository == 'erlang/otp' steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 'master' # '' = default branch persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: - otp-version: '28' + otp-version: '29.1.2' - uses: openvex/setup-vexctl@e85ca48f3c8a376289f6476129d59cda82147e71 # ratchet:openvex/setup-vexctl@v0.1.1 with: vexctl-release: '0.3.0' - - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: # required diff --git a/.github/workflows/ossf-compiler-flags-scanner.yaml b/.github/workflows/ossf-compiler-flags-scanner.yaml index f2dd0bfcf7f7..62113afe4a97 100644 --- a/.github/workflows/ossf-compiler-flags-scanner.yaml +++ b/.github/workflows/ossf-compiler-flags-scanner.yaml @@ -44,7 +44,7 @@ jobs: # Only need to read contents contents: read steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Create initial pre-release tar diff --git a/.github/workflows/osv-scanner-scheduled.yml b/.github/workflows/osv-scanner-scheduled.yml index 2a6d1c0d35b9..0d203797bb8d 100644 --- a/.github/workflows/osv-scanner-scheduled.yml +++ b/.github/workflows/osv-scanner-scheduled.yml @@ -41,7 +41,7 @@ jobs: outputs: versions: ${{ steps.get-versions.outputs.versions }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - id: get-versions diff --git a/.github/workflows/pr-comment.yaml b/.github/workflows/pr-comment.yaml index 1107ce7730c4..f1377f79981b 100644 --- a/.github/workflows/pr-comment.yaml +++ b/.github/workflows/pr-comment.yaml @@ -49,12 +49,12 @@ jobs: outputs: result: ${{ steps.pr-number.outputs.result }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: - otp-version: '27' + otp-version: '29.1.2' - name: Fetch PR number id: pr-number env: @@ -72,11 +72,11 @@ jobs: pull-requests: write if: github.event.action == 'requested' && needs.pr-number.outputs.result != '' steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ## We create an initial comment with some useful help to the user - - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # ratchet:actions/github-script@v8.0.0 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: PR_NUMBER: ${{ needs.pr-number.outputs.result }} with: @@ -99,7 +99,7 @@ jobs: needs.pr-number.outputs.result != '' && github.event.workflow_run.conclusion != 'skipped' steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download and Extract Artifacts @@ -139,7 +139,7 @@ jobs: ## Append some useful links and tips to the test results posted by ## Publish CT Test Results - - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # ratchet:actions/github-script@v8.0.0 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 if: always() env: PR_NUMBER: ${{ needs.pr-number.outputs.result }} diff --git a/.github/workflows/renovate-vendored-deps.yaml b/.github/workflows/renovate-vendored-deps.yaml index 6fcf9cd7c29f..cf4ca9051220 100644 --- a/.github/workflows/renovate-vendored-deps.yaml +++ b/.github/workflows/renovate-vendored-deps.yaml @@ -39,7 +39,7 @@ jobs: contains(github.event.pull_request.title, 'update dependency') && github.actor == 'renovate-bot' steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] # git push in renovate-vendored-deps.sh needs credentials with: diff --git a/.github/workflows/reusable-build-flavours.yaml b/.github/workflows/reusable-build-flavours.yaml index c71406ad965d..d0fb24ae052b 100644 --- a/.github/workflows/reusable-build-flavours.yaml +++ b/.github/workflows/reusable-build-flavours.yaml @@ -48,7 +48,7 @@ jobs: flavor: [jit, emu] fail-fast: false steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-build-ios.yaml b/.github/workflows/reusable-build-ios.yaml index 568d67bc79de..c757b488965c 100644 --- a/.github/workflows/reusable-build-ios.yaml +++ b/.github/workflows/reusable-build-ios.yaml @@ -38,12 +38,12 @@ jobs: RELEASE_LIBBEAM: yes TARGET_ARCH: aarch64-apple-ios name: Build Erlang/OTP (iOS) - runs-on: macos-15 + runs-on: macos-26 permissions: contents: read # actions/checkout actions: write # actions/upload-artifact steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-build-macos.yaml b/.github/workflows/reusable-build-macos.yaml index 4b48753e2ed6..b9665e9aed2b 100644 --- a/.github/workflows/reusable-build-macos.yaml +++ b/.github/workflows/reusable-build-macos.yaml @@ -35,7 +35,7 @@ permissions: jobs: build-macos: name: Build Erlang/OTP (macOS) - runs-on: macos-15 + runs-on: macos-26 permissions: contents: read # actions/checkout + actions/cache (restore/save) actions: write # actions/download-artifact + actions/upload-artifact @@ -43,7 +43,7 @@ jobs: WXWIDGETS_VERSION: 3.2.9 MACOS_VERSION: 15 steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -64,7 +64,7 @@ jobs: - name: Cache wxWidgets id: wxwidgets-cache - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: wxWidgets key: wxWidgets-${{ env.WXWIDGETS_VERSION }}-${{ runner.os }}-${{ hashFiles('.github/scripts/build-macos-wxwidgets.sh') }}-${{ env.MACOS_VERSION }}-${{ steps.brew-fingerprint.outputs.value }} diff --git a/.github/workflows/reusable-build-otp.yaml b/.github/workflows/reusable-build-otp.yaml index b85be42c206e..274937e66368 100644 --- a/.github/workflows/reusable-build-otp.yaml +++ b/.github/workflows/reusable-build-otp.yaml @@ -56,7 +56,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-build-windows.yaml b/.github/workflows/reusable-build-windows.yaml index dc9f15915ac8..ae9a7d522cb5 100644 --- a/.github/workflows/reusable-build-windows.yaml +++ b/.github/workflows/reusable-build-windows.yaml @@ -45,7 +45,7 @@ jobs: contents: read # actions/cache (restore/save wxWidgets cache) actions: write # actions/download-artifact + actions/upload-artifact steps: - - uses: Vampire/setup-wsl@887f39deb6c0976365e546926fe66f41b77d65ff # v6.1.0 + - uses: Vampire/setup-wsl@4c48163d9f981914dd8caa0fc335fe19cca5bff4 # v7.2.0 with: distribution: Ubuntu-18.04 @@ -70,7 +70,7 @@ jobs: run: echo "os=${ImageOS:-unknown}" >> "$GITHUB_OUTPUT" - name: Cache wxWidgets - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: wxWidgets key: wxWidgets-${{ env.WXWIDGETS_VERSION }}-${{ steps.image.outputs.os }} diff --git a/.github/workflows/reusable-check-files.yaml b/.github/workflows/reusable-check-files.yaml index 6d0ddfb6066c..924bbde0d720 100644 --- a/.github/workflows/reusable-check-files.yaml +++ b/.github/workflows/reusable-check-files.yaml @@ -55,7 +55,7 @@ jobs: permissions: contents: read # actions/checkout (fetch-depth: 0) + git diff (whitespace + BEAM detection) steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/reusable-documentation.yaml b/.github/workflows/reusable-documentation.yaml index f36bb6ee8e8d..5e6092f65970 100644 --- a/.github/workflows/reusable-documentation.yaml +++ b/.github/workflows/reusable-documentation.yaml @@ -50,7 +50,7 @@ jobs: contents: read # actions/checkout + ./.github/actions/build-base-image actions: write # actions/upload-artifact steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-pack.yaml b/.github/workflows/reusable-pack.yaml index 438f12cf5e45..3ec8e478d340 100644 --- a/.github/workflows/reusable-pack.yaml +++ b/.github/workflows/reusable-pack.yaml @@ -61,7 +61,7 @@ jobs: build-c-code: ${{ steps.build-c-code.outputs.value }} all: ${{ steps.apps.outputs.all }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -82,7 +82,7 @@ jobs: echo "all=${ALL_APPS}" >> $GITHUB_OUTPUT - name: Check which applications have changed - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: app-changes with: filters: .github/scripts/path-filters.yaml @@ -102,7 +102,7 @@ jobs: fi - name: Check if there are any C-code changes, if not then limit CI run - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: c-code-changes with: filters: .github/scripts/c-code-path-filters.yaml @@ -121,7 +121,7 @@ jobs: fi - name: Cache pre-built src - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: otp_src.tar.gz key: prebuilt-src-${{ github.ref_name }}-${{ github.sha }} @@ -129,7 +129,7 @@ jobs: prebuilt-src-${{ github.base_ref }}-${{ github.event.pull_request.base.sha }} - name: Cache pre-built binaries - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: otp_cache.tar.gz key: prebuilt-cache-64-bit-${{ github.ref_name }}-${{ github.sha }} @@ -146,7 +146,7 @@ jobs: path: otp_archive.tar.gz - name: Check how we can use the pre-built cache - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: cache with: filters: | diff --git a/.github/workflows/reusable-release.yaml b/.github/workflows/reusable-release.yaml index e410fa274fb1..b2956e60e614 100644 --- a/.github/workflows/reusable-release.yaml +++ b/.github/workflows/reusable-release.yaml @@ -54,7 +54,7 @@ jobs: actions: write # actions/download-artifact (otp_prebuilt, otp_doc_html, otp_doc_man, ort-results-*) # actions/upload-artifact (Attestations) steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -103,7 +103,7 @@ jobs: - name: Attest Distribution Assets with SBoM id: attest-sbom if: inputs.otp_sbom_version != '' # needed to not account for OTP-26 and 27 - uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # ratchet:actions/attest-sbom@v3 + uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4 with: subject-path: | artifacts/*.tar.gz diff --git a/.github/workflows/reusable-sbom.yaml b/.github/workflows/reusable-sbom.yaml index 5ddfc23076ec..1539ca61ba42 100644 --- a/.github/workflows/reusable-sbom.yaml +++ b/.github/workflows/reusable-sbom.yaml @@ -63,7 +63,7 @@ jobs: - name: Use HTTPS instead of SSH for Git cloning run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/ - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -72,7 +72,7 @@ jobs: BASE_BRANCH: ${{ inputs.base_branch }} - name: Fetch Default ORT Config - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: oss-review-toolkit/ort-config ref: "d2978deb230beae095bb6cfec074b94f1a74fd34" @@ -210,7 +210,7 @@ jobs: id-token: write # dependency submission OIDC actions: read # actions/download-artifact steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-static-analysis.yaml b/.github/workflows/reusable-static-analysis.yaml index 8fed28d38544..e6ed92b2fa03 100644 --- a/.github/workflows/reusable-static-analysis.yaml +++ b/.github/workflows/reusable-static-analysis.yaml @@ -39,7 +39,7 @@ jobs: contents: read security-events: write # needed for SARIF upload steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-system-test.yaml b/.github/workflows/reusable-system-test.yaml index 65ddefe101fe..d9f5ea05b12a 100644 --- a/.github/workflows/reusable-system-test.yaml +++ b/.github/workflows/reusable-system-test.yaml @@ -43,7 +43,7 @@ jobs: contents: read # actions/checkout + ./.github/actions/build-base-image actions: write # actions/download-artifact + actions/upload-artifact steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/reusable-test.yaml b/.github/workflows/reusable-test.yaml index 024279331d8e..7a30801a0b00 100644 --- a/.github/workflows/reusable-test.yaml +++ b/.github/workflows/reusable-test.yaml @@ -52,7 +52,7 @@ jobs: # type: ["os_mon","sasl"] fail-fast: false steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/build-base-image diff --git a/.github/workflows/reusable-vendor-vulnerability-scanner.yml b/.github/workflows/reusable-vendor-vulnerability-scanner.yml index 124faac80e09..051a13855bd5 100644 --- a/.github/workflows/reusable-vendor-vulnerability-scanner.yml +++ b/.github/workflows/reusable-vendor-vulnerability-scanner.yml @@ -104,7 +104,7 @@ jobs: outputs: vendor-files: ${{ steps.vendor-files.outputs.MODIFIED_FILES != '0' }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -131,14 +131,14 @@ jobs: actions: read if: ${{ !cancelled() && (needs.modified-vendor-files.result == 'success' || needs.modified-vendor-files.result == 'skipped') }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.checkout && inputs.version || ''}} # '' = default branch persist-credentials: false - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: - otp-version: '28' + otp-version: '29.1.2' - name: Set flag if it is not a forked PR run: echo "IS_NOT_FORKED_PR=$([[ -n '${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}' && -n '${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}' ]] && echo true || echo false)" >> $GITHUB_ENV @@ -149,7 +149,7 @@ jobs: # so we need to use the condition below for PRs based on a fork - name: "Generate GitHub App Token (if secrets exist)" if: ${{ env.IS_NOT_FORKED_PR == 'true' }} - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }} diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index f038b8ebe9b9..2ac8f1458700 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -45,7 +45,7 @@ jobs: actions: read steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/sigstore-updater.yml b/.github/workflows/sigstore-updater.yml index 6550f20f79e1..2f3f48d985a0 100644 --- a/.github/workflows/sigstore-updater.yml +++ b/.github/workflows/sigstore-updater.yml @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download release artifacts @@ -61,7 +61,7 @@ jobs: run: mkdir artifacts; cp *.tar.gz artifacts/ - name: Attest Distribution Assets with SBoM id: attest-sbom - uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3 + uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4 with: subject-path: | artifacts/*.tar.gz @@ -97,7 +97,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR branch - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: "${{ github.head_ref }}" fetch-depth: 0 @@ -140,7 +140,7 @@ jobs: uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.10 with: subject-path: 'vex/*.openvex.json' - - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 if: steps.changed.outputs.found == 'true' id: app-token with: diff --git a/.github/workflows/sync-github-releases.yaml b/.github/workflows/sync-github-releases.yaml index 70ae074b9b63..474e08993a99 100644 --- a/.github/workflows/sync-github-releases.yaml +++ b/.github/workflows/sync-github-releases.yaml @@ -43,7 +43,7 @@ jobs: contents: write actions: write steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ## We need to login to the package registry in order to pull diff --git a/.github/workflows/update-base.yaml b/.github/workflows/update-base.yaml index 6abdfbfb5dd4..3ea1b13121b0 100644 --- a/.github/workflows/update-base.yaml +++ b/.github/workflows/update-base.yaml @@ -55,7 +55,7 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ matrix.branch }} persist-credentials: false @@ -63,7 +63,7 @@ jobs: shell: bash run: .github/scripts/cleanup_gh_runner.sh - name: Docker login - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3.7.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/upload-windows-zip.yaml b/.github/workflows/upload-windows-zip.yaml index 836bcc95142d..66ff9a80ea24 100644 --- a/.github/workflows/upload-windows-zip.yaml +++ b/.github/workflows/upload-windows-zip.yaml @@ -43,7 +43,7 @@ jobs: env: BASENAME: otp_${{ inputs.target }}_${{ inputs.version }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false