diff --git a/.github/workflows/android-ech.yml b/.github/workflows/android-ech.yml index e8c7915..70885f2 100644 --- a/.github/workflows/android-ech.yml +++ b/.github/workflows/android-ech.yml @@ -37,16 +37,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Configure JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.7.0 with: distribution: 'temurin' java-version: 21 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@v6.3.0 - name: Enable KVM group permissions run: | @@ -57,7 +57,7 @@ jobs: # API 37 is the emulator this suite needs: ECH is applied by OkHttp's Android platform # through android.net.ssl.EchConfigList, which arrived there. - name: Run the ECH suite against the fixture containers - uses: reactivecircus/android-emulator-runner@v2 + uses: reactivecircus/android-emulator-runner@v2.38.0 with: api-level: '37.0' target: google_apis_playstore_ps16k @@ -105,7 +105,7 @@ jobs: # The suite's XML, for the status page, whatever colour the job ended up. - name: Upload Test Results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: android-ech-test-results-${{ inputs.okhttpVersion || 'pinned-snapshot' }} path: | diff --git a/.github/workflows/conscrypt.yml b/.github/workflows/conscrypt.yml index 723dbff..054473b 100644 --- a/.github/workflows/conscrypt.yml +++ b/.github/workflows/conscrypt.yml @@ -44,11 +44,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 # Conscrypt's own build wants a JDK to compile against and JNI headers to build against. - name: Configure JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.7.0 with: distribution: 'temurin' java-version: 17 @@ -108,7 +108,7 @@ jobs: # fetched back — including on a pull request, where it exercises the fallback path. - name: Upload the build if: always() && (steps.existing.outputs.exists == 'false' || inputs.force) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: conscrypt-${{ steps.pin.outputs.tag }} path: conscrypt/build/dist/ diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml index 7909e31..75e3a30 100644 --- a/.github/workflows/containers.yml +++ b/.github/workflows/containers.yml @@ -51,16 +51,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Configure JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.7.0 with: distribution: 'temurin' java-version: 21 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@v6.3.0 - name: Run Container Tests # --continue so a failing container test doesn't stop loomTest from running: @@ -100,7 +100,7 @@ jobs: # the build. The status page reads results from here, not from the job's colour. - name: Upload Test Results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: container-test-results-${{ matrix.okhttpVersion || 'pinned' }} path: | diff --git a/.github/workflows/network.yml b/.github/workflows/network.yml index 69a176e..c2d692a 100644 --- a/.github/workflows/network.yml +++ b/.github/workflows/network.yml @@ -47,16 +47,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Configure JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.7.0 with: distribution: 'temurin' java-version: 21 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@v6.3.0 # Without this the Conscrypt suites are left out of the source set and a change that # breaks them compiles clean. Failure is not fatal here: a pull request that bumps the @@ -91,16 +91,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Configure JDK - uses: actions/setup-java@v5 + uses: actions/setup-java@v5.7.0 with: distribution: 'temurin' java-version: 21 - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 + uses: gradle/actions/setup-gradle@v6.3.0 # The ECH suites' other half: a Conscrypt that can encrypt a client hello, which is not # published anywhere. Downloaded rather than built — the build is its own workflow, and @@ -150,7 +150,7 @@ jobs: # results — the status page reads them from here, and shows them as findings. - name: Upload Test Results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: network-test-results-${{ matrix.okhttpVersion || 'pinned' }} path: | diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 17660bb..745f2fd 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -56,14 +56,14 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 # enablement creates the Pages site on the first run rather than requiring someone to # turn it on by hand: without it every build fails at this step with "Get Pages site # failed", and nothing is ever deployed. It is a no-op once the site exists. - name: Configure Pages id: pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@v5.0.0 with: enablement: true @@ -156,10 +156,10 @@ jobs: echo "collected $(python3 -c 'import json,sys; print(len(json.load(open("site/data/issues.json"))))') open issue(s)" - name: Upload Pages Artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@v4.0.0 with: path: site - name: Deploy id: deploy - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v4.0.5 diff --git a/.github/workflows/test-server.yml b/.github/workflows/test-server.yml index f00b316..df0a0e1 100644 --- a/.github/workflows/test-server.yml +++ b/.github/workflows/test-server.yml @@ -37,12 +37,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Configure Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v5.6.0 with: - go-version: '1.24' + go-version: '1.24.13' cache-dependency-path: test-server/go.mod - name: Vet and Test @@ -120,7 +120,7 @@ jobs: - name: Log in to GHCR if: github.event_name == 'push' && github.ref == 'refs/heads/main' - uses: docker/login-action@v3 + uses: docker/login-action@v3.7.0 with: registry: ghcr.io username: ${{ github.actor }}