diff --git a/.github/workflows/package-managers.yml b/.github/workflows/package-managers.yml index cc795ba..b3e92bb 100644 --- a/.github/workflows/package-managers.yml +++ b/.github/workflows/package-managers.yml @@ -99,7 +99,7 @@ jobs: - name: Upload the manifests if: steps.version.outputs.version != '' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: package-manifests path: out/ @@ -133,7 +133,7 @@ jobs: - name: Download the manifests if: steps.app.outputs.ready == 'true' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: package-manifests path: out @@ -141,7 +141,7 @@ jobs: - name: Mint a token for the tap and the bucket if: steps.app.outputs.ready == 'true' id: token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.PACKAGING_APP_CLIENT_ID }} private-key: ${{ secrets.PACKAGING_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8739124..fb3dba5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -184,7 +184,7 @@ jobs: tar -C "$(dirname "$stage")" -czf "hodeishield-${VERSION}-${TARGET}.tar.gz" "$(basename "$stage")" - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-${{ matrix.target }} path: hodeishield-*.tar.gz @@ -236,7 +236,7 @@ jobs: cp target/man/*.1 stage/man/ - name: Upload the unsigned binary - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: unsigned-universal-apple-darwin path: stage/* @@ -282,7 +282,7 @@ jobs: MACOS_TEAM_ID: "" steps: - name: Download the unsigned binary - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: unsigned-universal-apple-darwin path: stage @@ -520,7 +520,7 @@ jobs: ls -l dist - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-universal-apple-darwin path: dist/* @@ -565,7 +565,7 @@ jobs: Copy-Item -Path "docs/user-information.md" -Destination stage/USER-INFORMATION.md - name: Upload the unsigned executable - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: unsigned-${{ matrix.target }} path: stage/* @@ -620,7 +620,7 @@ jobs: exe_sha256_arm64: ${{ steps.handoff.outputs.exe_sha256_arm64 }} steps: - name: Download the unsigned executable - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: unsigned-${{ matrix.target }} path: stage @@ -750,7 +750,7 @@ jobs: # The MSI is built for x64 only (an arm64 MSI is a follow-up). - name: Upload the signed executable for the MSI build if: matrix.key == 'x64' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-msi-input path: stage/* @@ -768,7 +768,7 @@ jobs: Compress-Archive -Path "$dir/*" -DestinationPath "dist/$stageName.zip" - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-${{ matrix.target }} path: dist/*.zip @@ -798,7 +798,7 @@ jobs: persist-credentials: false - name: Download the signed executable - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-msi-input path: msi-input @@ -856,7 +856,7 @@ jobs: Write-Host "Install, PATH entry and uninstall: OK" - name: Upload the unsigned MSI - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-msi-unsigned path: msi-out/*.msi @@ -885,7 +885,7 @@ jobs: persist-credentials: false - name: Download the MSI - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-msi-unsigned path: msi @@ -1033,7 +1033,7 @@ jobs: - name: Upload the signed MSI if: env.SIGN == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks it up with the archives. name: archive-msi @@ -1062,7 +1062,7 @@ jobs: persist-credentials: false - name: Download the Linux archives - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: archive-*-unknown-linux-musl path: archives @@ -1108,7 +1108,7 @@ jobs: ls -l dist - name: Upload the packages - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks them up with the archives. name: archive-packages @@ -1166,7 +1166,7 @@ jobs: done - name: Upload the SBOMs - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks them up with the archives. name: archive-sbom @@ -1205,7 +1205,7 @@ jobs: # run third-party code (build scripts, cargo-cyclonedx, nfpm, WiX); an extra `archive-*` # artifact from any of them makes this step fail instead of being published and signed. - name: Download the release artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: archive-* path: artifacts diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 345818a..809eb21 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,13 +35,13 @@ jobs: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload the results to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/security-tests.yml b/.github/workflows/security-tests.yml index 41777b9..6cd6e69 100644 --- a/.github/workflows/security-tests.yml +++ b/.github/workflows/security-tests.yml @@ -52,14 +52,14 @@ jobs: run: rustup show - name: Initialise CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: none queries: security-extended - name: Analyse - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: /language:${{ matrix.language }} @@ -72,7 +72,7 @@ jobs: actions: read # read by the SARIF upload contents: read security-events: write # upload the results to code scanning - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 with: scan-args: |- --recursive diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml index baf67f4..ccb9a19 100644 --- a/.github/workflows/workflow-lint.yml +++ b/.github/workflows/workflow-lint.yml @@ -104,7 +104,7 @@ jobs: run: '"$RUNNER_TEMP/zizmor" --persona pedantic --no-exit-codes --format sarif . > "$RUNNER_TEMP/zizmor.sarif"' - name: Upload the results to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: ${{ runner.temp }}/zizmor.sarif category: zizmor