From 0c37fd4cfebd5f39bf27da2423ae893175d5e26b Mon Sep 17 00:00:00 2001 From: Heznpc Date: Mon, 24 Aug 2026 02:01:45 +0900 Subject: [PATCH] Take actions/checkout and setup-python to v7, and say which v7 Supersedes the two dependabot PRs that had been open a month and could no longer merge; both touched the same workflow file, so they land here as one change. Every SHA was checked against the upstream tag before being trusted -- `3d3c42e` is actions/checkout v7.0.1 and `5fda3b9` is setup-python v7.0.0, confirmed through the API rather than from the PR titles. Worth doing by hand for one reason beyond the conflict: dependabot's checkout bump moved the pin to v7.0.1 while leaving the comment reading `# v6`. A pin is only auditable if the comment beside it is true, and a reviewer skimming for the version would have read v6 off a v7 SHA. `codeql.yml` also pins checkout and is updated with it. --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/codeql.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fdac8c2..0c78154 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,9 +16,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' cache: pip @@ -64,9 +64,9 @@ jobs: runs-on: windows-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' cache: pip @@ -106,7 +106,7 @@ jobs: runs-on: macos-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Swift toolchain run: swift --version diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3c18713..6779848 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: os: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: github/codeql-action/init@1ad29ea4a422cce9a242a9fae469541dcd08addc # v4 with: