From aaf84230074b0d364d9ae15c1c44670c241751eb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:12:15 +0000 Subject: [PATCH] chore(deps): bump the actions-deps group across 1 directory with 9 updates Bumps the actions-deps group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.20.0` | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.6.0` | | [sbt/setup-sbt](https://github.com/sbt/setup-sbt) | `1.5.0` | `1.5.4` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.5.1` | | [oasdiff/oasdiff-action/breaking](https://github.com/oasdiff/oasdiff-action) | `0.1.5` | `0.1.10` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.3` | `4.37.3` | Updates `step-security/harden-runner` from 2.19.4 to 2.20.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-java` from 5.4.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/1bcf9fb12cf4aa7d266a90ae39939e61372fe520...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `sbt/setup-sbt` from 1.5.0 to 1.5.4 - [Release notes](https://github.com/sbt/setup-sbt/releases) - [Commits](https://github.com/sbt/setup-sbt/compare/66fb4376e81982c7d92a4074170846fff88e2e30...f6db8ab474efba716fc7f04441ab33714e4825af) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6.4.0...v7) Updates `docker/login-action` from 4.4.0 to 4.5.1 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...abd2ef45e78c5afb21d64d4ca52ee8550d9572c7) Updates `oasdiff/oasdiff-action/breaking` from 0.1.5 to 0.1.10 - [Release notes](https://github.com/oasdiff/oasdiff-action/releases) - [Commits](https://github.com/oasdiff/oasdiff-action/compare/291b6594ce617f22f49af5898ee038ed0b46e8fe...0ab8ad204b00d25acc5ae87106281433e288d0c1) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc) Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: sbt/setup-sbt dependency-version: 1.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-deps - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps - dependency-name: oasdiff/oasdiff-action/breaking dependency-version: 0.1.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-deps - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-deps ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-merge.yml | 4 +-- .github/workflows/build.yml | 10 +++---- .github/workflows/dependency-review.yml | 4 +-- .github/workflows/integration-tests.yml | 30 +++++++++---------- .github/workflows/lint.yml | 4 +-- .github/workflows/oasdiff.yml | 4 +-- .github/workflows/performance-tests.yml | 12 ++++---- .github/workflows/pr-lint.yml | 2 +- .github/workflows/release-clients.yml | 6 ++-- .github/workflows/release.yml | 12 ++++---- .../workflows/sbt-dependency-submission.yml | 6 ++-- .github/workflows/scala-steward.yml | 4 +-- .github/workflows/scorecard.yml | 8 ++--- .github/workflows/unit-tests.yml | 10 +++---- .github/workflows/update-oas.yml | 4 +-- 15 files changed, 60 insertions(+), 60 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 5c07406c76..84c3347185 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -64,7 +64,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 37813f5611..ee0d19a6d8 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -33,28 +33,28 @@ jobs: OAS_PUBLISHED: ${{ steps.upload-oas.conclusion == 'success' }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: java-version: 21 distribution: temurin cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Setup Node.js - uses: actions/setup-node@v6.4.0 + uses: actions/setup-node@v7.0.0 with: node-version: "lts/*" - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 818143bf5c..a50c700830 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,11 +17,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: 'Checkout Repository' - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 'Dependency Review' uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 0211984b1e..c2b1378823 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -31,28 +31,28 @@ jobs: DOCKER_API_VERSION: "1.44" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: temurin java-version: 21 cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Setup Gradle uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: registry: ghcr.io username: hyperledger-bot @@ -76,14 +76,14 @@ jobs: echo "prism_node_version=$(grep PRISM_NODE_VERSION infrastructure/local/.env | cut -d'=' -f2 | tr -d ' ')" >> "${GITHUB_OUTPUT}" echo "neoprism_version=$(grep NEOPRISM_VERSION infrastructure/local/.env | cut -d'=' -f2 | tr -d ' ')" >> "${GITHUB_OUTPUT}" - - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: "zulu" java-version: "21" cache: "sbt" - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Run integration tests (neoprism) working-directory: "tests/integration-tests" @@ -189,7 +189,7 @@ jobs: SLACK_USERNAME: circleci SLACK_WEBHOOK: ${{ secrets.E2E_TESTS_SLACK_WEBHOOK }} - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4.4.0 with: node-version: 20 @@ -221,28 +221,28 @@ jobs: DOCKER_API_VERSION: "1.44" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: temurin java-version: 21 cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Setup Gradle uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: registry: ghcr.io username: hyperledger-bot @@ -265,14 +265,14 @@ jobs: echo "agent_version=$(cut -d'=' -f2 version.sbt | tr -d '\" ')" >> "${GITHUB_OUTPUT}" echo "prism_node_version=$(grep PRISM_NODE_VERSION infrastructure/local/.env | cut -d'=' -f2 | tr -d ' ')" >> "${GITHUB_OUTPUT}" - - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: "zulu" java-version: "21" cache: "sbt" - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Run integration tests (prism-node) working-directory: "tests/integration-tests" diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index b9a44a9b1f..c739928dba 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -30,12 +30,12 @@ jobs: steps: # Git Checkout - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout Code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 diff --git a/.github/workflows/oasdiff.yml b/.github/workflows/oasdiff.yml index a33bfa2fde..af76fdce67 100644 --- a/.github/workflows/oasdiff.yml +++ b/.github/workflows/oasdiff.yml @@ -36,7 +36,7 @@ jobs: pull-requests: write steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -81,7 +81,7 @@ jobs: echo "Revision url: ${{ env.REV_URL }}" - name: Running OpenAPI Spec diff action - uses: oasdiff/oasdiff-action/breaking@291b6594ce617f22f49af5898ee038ed0b46e8fe + uses: oasdiff/oasdiff-action/breaking@0ab8ad204b00d25acc5ae87106281433e288d0c1 with: fail-on: "ERR" base: ${{ env.BASE_URL }} diff --git a/.github/workflows/performance-tests.yml b/.github/workflows/performance-tests.yml index 856aeb04d9..4f581d27b1 100644 --- a/.github/workflows/performance-tests.yml +++ b/.github/workflows/performance-tests.yml @@ -32,28 +32,28 @@ jobs: if: ${{ !contains(github.event.pull_request.title, '[skip ci]') }} steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: temurin java-version: 21 cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Setup Gradle uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: registry: ghcr.io username: ${{ env.GITHUB_ACTOR }} @@ -96,7 +96,7 @@ jobs: down-flags: "--volumes" - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4.4.0 with: node-version: 16.x registry-url: "https://npm.pkg.github.com" diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml index 08f00c8053..42406ed071 100644 --- a/.github/workflows/pr-lint.yml +++ b/.github/workflows/pr-lint.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit diff --git a/.github/workflows/release-clients.yml b/.github/workflows/release-clients.yml index 26b4f13f8a..78cf7b782f 100644 --- a/.github/workflows/release-clients.yml +++ b/.github/workflows/release-clients.yml @@ -47,15 +47,15 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4.4.0 with: node-version: "22.16.0" registry-url: "https://registry.npmjs.org" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cc2ea69e43..b5b235d230 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,28 +25,28 @@ jobs: packages: write steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.IDENTUS_CI }} ref: ${{ github.event.inputs.release-branch }} fetch-depth: 0 - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: temurin java-version: 21 cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4.4.0 with: node-version: "lts/*" @@ -61,7 +61,7 @@ jobs: git_tag_gpgsign: false - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/sbt-dependency-submission.yml b/.github/workflows/sbt-dependency-submission.yml index 566095bfda..2fcefa36a7 100644 --- a/.github/workflows/sbt-dependency-submission.yml +++ b/.github/workflows/sbt-dependency-submission.yml @@ -20,17 +20,17 @@ jobs: contents: write steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java and Scala uses: olafurpg/setup-scala@32ffa16635ff8f19cc21ea253a987f0fdf29844c # v14 with: java-version: adopt@1.11 - name: Setup Node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v3.9.1 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v3.9.1 with: node-version: "18" # or whatever # - name: Setup Scala.JS diff --git a/.github/workflows/scala-steward.yml b/.github/workflows/scala-steward.yml index 1c4bd9bc6f..3306611802 100644 --- a/.github/workflows/scala-steward.yml +++ b/.github/workflows/scala-steward.yml @@ -12,12 +12,12 @@ jobs: name: Launch Scala Steward steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout the repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 id: import_gpg diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0a3c62e5d5..852b62f09e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -34,17 +34,17 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: "Checkout code" - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif @@ -78,6 +78,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: results.sarif diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 8d6af06e9f..478ed25e3f 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -28,18 +28,18 @@ jobs: TESTCONTAINERS_RYUK_DISABLED: true steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Git checkout (merge) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 if: github.event_name != 'pull_request' with: fetch-depth: 0 - name: Git checkout (PR) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 if: github.event_name == 'pull_request' with: fetch-depth: 0 @@ -47,14 +47,14 @@ jobs: ref: ${{ github.event.pull_request.head.sha }} - name: Set up JDK 21 (Temurin) with sbt cache - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.2.0 pinned + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.2.0 pinned with: distribution: temurin java-version: 21 cache: sbt - name: Set up sbt - uses: sbt/setup-sbt@66fb4376e81982c7d92a4074170846fff88e2e30 # v1.1.18 pinned + uses: sbt/setup-sbt@f6db8ab474efba716fc7f04441ab33714e4825af # v1.1.18 pinned - name: Download dependencies run: sbt +update diff --git a/.github/workflows/update-oas.yml b/.github/workflows/update-oas.yml index aa5cf4e4a5..1fd5c19d20 100644 --- a/.github/workflows/update-oas.yml +++ b/.github/workflows/update-oas.yml @@ -31,11 +31,11 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0