diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bcd65967..840a66d1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -110,7 +110,7 @@ jobs: # --- CodeQL init --- - name: Initialize CodeQL - uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -128,7 +128,7 @@ jobs: # --- Analysis (fails build on real errors) --- - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: category: "/language:${{ matrix.language }}" upload: never @@ -162,7 +162,7 @@ jobs: # --- Upload (tolerates GHAS unavailability) --- - name: Upload SARIF to GitHub Security tab - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true # Requires GitHub Advanced Security with: @@ -188,7 +188,7 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: languages: swift build-mode: manual @@ -199,7 +199,7 @@ jobs: run: swift build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: category: "/language:swift" upload: never @@ -225,7 +225,7 @@ jobs: done - name: Upload SARIF to GitHub Security tab - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true # Requires GitHub Advanced Security with: diff --git a/.github/workflows/release-kotlin.yml b/.github/workflows/release-kotlin.yml index 7c0526e8..2d8f1fe7 100644 --- a/.github/workflows/release-kotlin.yml +++ b/.github/workflows/release-kotlin.yml @@ -38,7 +38,7 @@ jobs: java-version: '17' - name: Setup Gradle - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation - name: Build run: ./gradlew :basecamp-sdk:build @@ -86,7 +86,7 @@ jobs: java-version: '17' - name: Setup Gradle - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache - name: Extract version id: version diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml index c29e12af..1bcd4244 100644 --- a/.github/workflows/release-python.yml +++ b/.github/workflows/release-python.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation - name: Set up Python run: uv python install 3.13 @@ -87,7 +87,7 @@ jobs: git merge-base --is-ancestor "$GITHUB_SHA" origin/main - name: Install uv - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache - name: Set up Python run: uv python install 3.13 diff --git a/.github/workflows/release-ruby.yml b/.github/workflows/release-ruby.yml index 29e9a204..73f8e27b 100644 --- a/.github/workflows/release-ruby.yml +++ b/.github/workflows/release-ruby.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation + uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation with: ruby-version: '3.3' bundler-cache: true @@ -68,7 +68,7 @@ jobs: git merge-base --is-ancestor "$GITHUB_SHA" origin/main - name: Set up Ruby - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: ruby-version: '3.3' bundler-cache: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 11529ada..e55302b5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -33,7 +33,7 @@ jobs: path: results.sarif retention-days: 5 - - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 continue-on-error: true with: sarif_file: results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c1336b26..1f83ebcd 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -36,7 +36,7 @@ jobs: output: 'trivy-go-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true # Requires GitHub Advanced Security with: @@ -67,7 +67,7 @@ jobs: output: 'trivy-ts-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true # Requires GitHub Advanced Security with: @@ -128,7 +128,7 @@ jobs: run: gosec -severity high -exclude-dir=pkg/generated -fmt sarif -out gosec-results.sarif ./... - name: Upload gosec results - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true with: @@ -184,7 +184,7 @@ jobs: output: 'trivy-ruby-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0 + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 if: always() continue-on-error: true with: @@ -206,7 +206,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 + uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0 with: ruby-version: '3.3' bundler-cache: true @@ -242,7 +242,7 @@ jobs: java-version: '17' - name: Setup Gradle - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 - name: Run dependency verification run: ./gradlew :basecamp-sdk:dependencies --scan diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 99b77987..5720b540 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,7 +20,7 @@ jobs: persist-credentials: false - name: Run actionlint - uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 - name: Run zizmor uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 @@ -143,7 +143,7 @@ jobs: persist-credentials: false - name: Set up Ruby - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 + uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true @@ -175,7 +175,7 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0 - name: Set up Python run: uv python install ${{ matrix.python }} @@ -249,7 +249,7 @@ jobs: java-version: '17' - name: Setup Gradle - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 - name: Build run: ./gradlew :basecamp-sdk:build @@ -301,7 +301,7 @@ jobs: java-version: '17' - name: Setup Gradle - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 - name: Run Kotlin conformance tests working-directory: kotlin @@ -327,7 +327,7 @@ jobs: npm test - name: Set up Ruby - uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 + uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0 with: ruby-version: '3.3' bundler-cache: true @@ -338,7 +338,7 @@ jobs: run: ruby runner.rb - name: Install uv (Python) - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 + uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0 - name: Run Python conformance tests working-directory: conformance/runner/python