diff --git a/.github/workflows/package-managers.yml b/.github/workflows/package-managers.yml index cc795ba..b3e92bb 100644 --- a/.github/workflows/package-managers.yml +++ b/.github/workflows/package-managers.yml @@ -99,7 +99,7 @@ jobs: - name: Upload the manifests if: steps.version.outputs.version != '' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: package-manifests path: out/ @@ -133,7 +133,7 @@ jobs: - name: Download the manifests if: steps.app.outputs.ready == 'true' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: package-manifests path: out @@ -141,7 +141,7 @@ jobs: - name: Mint a token for the tap and the bucket if: steps.app.outputs.ready == 'true' id: token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ vars.PACKAGING_APP_CLIENT_ID }} private-key: ${{ secrets.PACKAGING_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8739124..fb3dba5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -184,7 +184,7 @@ jobs: tar -C "$(dirname "$stage")" -czf "hodeishield-${VERSION}-${TARGET}.tar.gz" "$(basename "$stage")" - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-${{ matrix.target }} path: hodeishield-*.tar.gz @@ -236,7 +236,7 @@ jobs: cp target/man/*.1 stage/man/ - name: Upload the unsigned binary - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: unsigned-universal-apple-darwin path: stage/* @@ -282,7 +282,7 @@ jobs: MACOS_TEAM_ID: "" steps: - name: Download the unsigned binary - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: unsigned-universal-apple-darwin path: stage @@ -520,7 +520,7 @@ jobs: ls -l dist - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-universal-apple-darwin path: dist/* @@ -565,7 +565,7 @@ jobs: Copy-Item -Path "docs/user-information.md" -Destination stage/USER-INFORMATION.md - name: Upload the unsigned executable - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: unsigned-${{ matrix.target }} path: stage/* @@ -620,7 +620,7 @@ jobs: exe_sha256_arm64: ${{ steps.handoff.outputs.exe_sha256_arm64 }} steps: - name: Download the unsigned executable - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: unsigned-${{ matrix.target }} path: stage @@ -750,7 +750,7 @@ jobs: # The MSI is built for x64 only (an arm64 MSI is a follow-up). - name: Upload the signed executable for the MSI build if: matrix.key == 'x64' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-msi-input path: stage/* @@ -768,7 +768,7 @@ jobs: Compress-Archive -Path "$dir/*" -DestinationPath "dist/$stageName.zip" - name: Upload archive - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: archive-${{ matrix.target }} path: dist/*.zip @@ -798,7 +798,7 @@ jobs: persist-credentials: false - name: Download the signed executable - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-msi-input path: msi-input @@ -856,7 +856,7 @@ jobs: Write-Host "Install, PATH entry and uninstall: OK" - name: Upload the unsigned MSI - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: windows-msi-unsigned path: msi-out/*.msi @@ -885,7 +885,7 @@ jobs: persist-credentials: false - name: Download the MSI - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: windows-msi-unsigned path: msi @@ -1033,7 +1033,7 @@ jobs: - name: Upload the signed MSI if: env.SIGN == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks it up with the archives. name: archive-msi @@ -1062,7 +1062,7 @@ jobs: persist-credentials: false - name: Download the Linux archives - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: archive-*-unknown-linux-musl path: archives @@ -1108,7 +1108,7 @@ jobs: ls -l dist - name: Upload the packages - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks them up with the archives. name: archive-packages @@ -1166,7 +1166,7 @@ jobs: done - name: Upload the SBOMs - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: # `archive-` so `publish` picks them up with the archives. name: archive-sbom @@ -1205,7 +1205,7 @@ jobs: # run third-party code (build scripts, cargo-cyclonedx, nfpm, WiX); an extra `archive-*` # artifact from any of them makes this step fail instead of being published and signed. - name: Download the release artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: archive-* path: artifacts diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 345818a..809eb21 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,13 +35,13 @@ jobs: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload the results to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/security-tests.yml b/.github/workflows/security-tests.yml index 41777b9..6cd6e69 100644 --- a/.github/workflows/security-tests.yml +++ b/.github/workflows/security-tests.yml @@ -52,14 +52,14 @@ jobs: run: rustup show - name: Initialise CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: none queries: security-extended - name: Analyse - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: /language:${{ matrix.language }} @@ -72,7 +72,7 @@ jobs: actions: read # read by the SARIF upload contents: read security-events: write # upload the results to code scanning - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 with: scan-args: |- --recursive diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml index baf67f4..ccb9a19 100644 --- a/.github/workflows/workflow-lint.yml +++ b/.github/workflows/workflow-lint.yml @@ -104,7 +104,7 @@ jobs: run: '"$RUNNER_TEMP/zizmor" --persona pedantic --no-exit-codes --format sarif . > "$RUNNER_TEMP/zizmor.sarif"' - name: Upload the results to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: ${{ runner.temp }}/zizmor.sarif category: zizmor diff --git a/Cargo.lock b/Cargo.lock index 6e59c2c..18b7ee8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -779,6 +779,12 @@ version = "1.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" +[[package]] +name = "foldhash" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" + [[package]] name = "form_urlencoded" version = "1.2.2" @@ -2230,10 +2236,11 @@ dependencies = [ [[package]] name = "serde_json" -version = "1.0.152" +version = "1.0.154" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1741ab7a6cc54a03a89b5d563ed60075c277d9e3cfa73ad0c1f23f23974703c6" +checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6" dependencies = [ + "foldhash", "indexmap", "itoa", "memchr", diff --git a/deny.toml b/deny.toml index c7b30e4..07f38d0 100644 --- a/deny.toml +++ b/deny.toml @@ -40,6 +40,9 @@ allow = [ # License Agreement; it is a non-code data license, OSI/FSF-listed as free, # and widely allowed alongside MIT/Apache-2.0 in the Rust TLS ecosystem. "CDLA-Permissive-2.0", + # foldhash (a dependency of serde_json from 1.0.154) is Zlib-licensed; Zlib is a + # permissive OSI-approved license compatible with Apache-2.0. + "Zlib", ] confidence-threshold = 0.8 exceptions = []