diff --git a/.github/workflows/agileplus-pillar-scorecard.yml b/.github/workflows/agileplus-pillar-scorecard.yml index 82e5f027..257a1700 100644 --- a/.github/workflows/agileplus-pillar-scorecard.yml +++ b/.github/workflows/agileplus-pillar-scorecard.yml @@ -9,7 +9,7 @@ jobs: score: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Run pillar scoring run: | echo "AgilePlus pillar scoring" diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 30a0feaa..d1d05c8a 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -46,7 +46,7 @@ jobs: run: cargo audit --json > audit.json - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: audit.json continue-on-error: true diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index c3b4c5f0..1166c8fc 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -156,7 +156,7 @@ jobs: retention-days: 90 - name: Install hyperfine - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: hyperfine @@ -213,7 +213,7 @@ jobs: key: hyperfine-healthz - name: Install hyperfine - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: hyperfine diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8c69c183..8f1ae55f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -250,7 +250,7 @@ jobs: - name: Scan Cargo.lock with OSV-Scanner # Severity gate intent: --severity=HIGH,CRITICAL (documented; osv-scanner # v2.3.8 has no CLI severity flag — findings gate via code-scanning alerts). - uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 + uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1 with: scan-args: |- --lockfile=Cargo.lock diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index cd329ba6..cf09fa4f 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -35,7 +35,7 @@ jobs: - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2 with: tool: cargo-llvm-cov diff --git a/.github/workflows/nightly-bench.yml b/.github/workflows/nightly-bench.yml index fb38aa21..a9da750a 100644 --- a/.github/workflows/nightly-bench.yml +++ b/.github/workflows/nightly-bench.yml @@ -101,7 +101,7 @@ jobs: retention-days: 90 - name: Install hyperfine - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: hyperfine diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml index 0b402b55..72305e12 100644 --- a/.github/workflows/osv.yml +++ b/.github/workflows/osv.yml @@ -24,7 +24,7 @@ jobs: # Severity gate intent: --severity=HIGH,CRITICAL (documented; osv-scanner # v2.3.8 has no CLI severity flag — findings gate via code-scanning alerts). id: scan - uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 + uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1 with: scan-args: |- --lockfile=Cargo.lock @@ -33,7 +33,7 @@ jobs: --output=osv-results.sarif - name: Upload SARIF if: always() && hashFiles('osv-results.sarif') != '' - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: osv-results.sarif continue-on-error: true diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml index 7cd09d7f..198ac9e2 100644 --- a/.github/workflows/quality-gate.yml +++ b/.github/workflows/quality-gate.yml @@ -51,7 +51,7 @@ jobs: uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2 with: tool: cargo-llvm-cov diff --git a/.github/workflows/release-attestation.yml b/.github/workflows/release-attestation.yml index 0959db0d..b515b1c7 100644 --- a/.github/workflows/release-attestation.yml +++ b/.github/workflows/release-attestation.yml @@ -32,7 +32,7 @@ jobs: # Pinned to v2.0.0 commit SHA per SLSA L3 hardening requirement # (digest-pinned generator). Tag `@v2` is mutable; this SHA is immutable. # Resolves via: curl -sL https://api.github.com/repos/slsa-framework/slsa-github-generator/git/refs/tags/v2.0.0 | jq -r .object.sha - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_containerized_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_containerized_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 with: source-repo: ${{ github.repository_owner }}/${{ github.event.repository.name }} build-command: | diff --git a/.github/workflows/scorecard-ci.yml b/.github/workflows/scorecard-ci.yml index 255af6f3..360a9aa9 100644 --- a/.github/workflows/scorecard-ci.yml +++ b/.github/workflows/scorecard-ci.yml @@ -16,10 +16,10 @@ jobs: scorecard: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.11' @@ -54,7 +54,7 @@ jobs: - name: Upload Scorecard Report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: scorecard-report path: scorecard-report.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c4e4a3fd..a205777d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -43,7 +43,7 @@ jobs: publish_results: true - name: Upload SARIF - uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b2eeb0c2..460d2032 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -47,7 +47,7 @@ jobs: fetch-depth: 0 - name: Run TruffleHog - uses: trufflesecurity/trufflehog@e12da3c72f1fa4bd17a7345467d735c5aae1fbcf + uses: trufflesecurity/trufflehog@0c952ace0f842f11c75775922d7400335cf60bc6 with: version: 3.97.0 extra_args: --only-verified @@ -121,6 +121,6 @@ jobs: - name: Upload Trivy results if: ${{ hashFiles('Dockerfile') != '' }} - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 with: sarif_file: 'trivy-results.sarif'