From 9afaa20e28d9f0eb948c62932a4a5a8ead5c479b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 8 Aug 2026 00:52:34 +0000 Subject: [PATCH] chore(deps): update github actions --- .github/actions/1password-secret-sync/action.yml | 2 +- .github/actions/checkout-as-app/action.yml | 2 +- .github/actions/github-app-auth/action.yml | 4 ++-- .github/actions/lint-syft/action.yml | 2 +- .github/actions/lint-trivy/action.yml | 2 +- .github/workflows/check.yaml | 8 ++++---- .github/workflows/pages.yaml | 8 ++++---- .github/workflows/sync-main-to-edge.yaml | 4 ++-- .github/workflows/sync-plugin-specs.yaml | 2 +- 9 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/actions/1password-secret-sync/action.yml b/.github/actions/1password-secret-sync/action.yml index 4c3b427..09e647c 100644 --- a/.github/actions/1password-secret-sync/action.yml +++ b/.github/actions/1password-secret-sync/action.yml @@ -37,7 +37,7 @@ runs: steps: - name: Install 1Password CLI # Pin to commit SHA for supply chain security — update when action changes - uses: 1password/install-cli-action@9a0c9dd934086b7ab1d90115d455bda1c53c2bdb # v2.0.2 + uses: 1password/install-cli-action@a5215d3a7f75c1629216c465ea9ab3ab399c4b71 # v4.0.0 - name: Sync secrets id: sync diff --git a/.github/actions/checkout-as-app/action.yml b/.github/actions/checkout-as-app/action.yml index dcd77de..317cdd4 100644 --- a/.github/actions/checkout-as-app/action.yml +++ b/.github/actions/checkout-as-app/action.yml @@ -143,7 +143,7 @@ runs: # ── Step 2: Checkout with app token baked into the remote URL ── - name: Checkout repository as GitHub App id: checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ steps.auth.outputs.token }} repository: ${{ inputs.repository }} diff --git a/.github/actions/github-app-auth/action.yml b/.github/actions/github-app-auth/action.yml index eba0889..76cff05 100644 --- a/.github/actions/github-app-auth/action.yml +++ b/.github/actions/github-app-auth/action.yml @@ -50,7 +50,7 @@ runs: steps: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 with: app-id: ${{ inputs.app-id }} private-key: ${{ inputs.private-key }} @@ -94,7 +94,7 @@ runs: - name: Configure repo checkout token if: inputs.skip-checkout != 'true' - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ steps.app-token.outputs.token }} clean: false diff --git a/.github/actions/lint-syft/action.yml b/.github/actions/lint-syft/action.yml index b5c4b4d..b85e626 100644 --- a/.github/actions/lint-syft/action.yml +++ b/.github/actions/lint-syft/action.yml @@ -12,7 +12,7 @@ runs: echo "SBOM generated: syft-sbom.json" - name: Upload SBOM artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: syft-sbom path: syft-sbom.json diff --git a/.github/actions/lint-trivy/action.yml b/.github/actions/lint-trivy/action.yml index 858cf88..003c5fd 100644 --- a/.github/actions/lint-trivy/action.yml +++ b/.github/actions/lint-trivy/action.yml @@ -17,7 +17,7 @@ runs: trivy fs . --format cyclonedx --output trivy-sbom.json - name: Upload SBOM artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: trivy-sbom path: trivy-sbom.json diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 4d6e6fd..4402f03 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -22,7 +22,7 @@ jobs: contents: write steps: - name: Checkout Code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false fetch-depth: 0 @@ -46,7 +46,7 @@ jobs: echo "has_conflicts=false" >> "$GITHUB_OUTPUT" - name: Install mise - uses: jdx/mise-action@v2 + uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 - name: Run format id: format @@ -88,12 +88,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 - name: Install mise and tools - uses: jdx/mise-action@v2 + uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 with: install_args: 'grype trivy syft gitleaks trufflehog checkov aqua:secretlint/secretlint' diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml index 59feb1d..1f36f27 100644 --- a/.github/workflows/pages.yaml +++ b/.github/workflows/pages.yaml @@ -33,16 +33,16 @@ jobs: name: github-pages url: ${{ steps.deploy.outputs.page_url }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Configure Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 - name: Upload pages/ artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 with: path: pages - name: Deploy to GitHub Pages id: deploy - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 diff --git a/.github/workflows/sync-main-to-edge.yaml b/.github/workflows/sync-main-to-edge.yaml index c4a6e96..bf4d77d 100644 --- a/.github/workflows/sync-main-to-edge.yaml +++ b/.github/workflows/sync-main-to-edge.yaml @@ -43,7 +43,7 @@ jobs: has_targets: ${{ steps.plan.outputs.has_targets }} steps: - name: Checkout caller repo - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: persist-credentials: false @@ -122,7 +122,7 @@ jobs: - name: Checkout target branch if: steps.check.outputs.exists == 'true' - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: ref: ${{ matrix.target }} persist-credentials: false diff --git a/.github/workflows/sync-plugin-specs.yaml b/.github/workflows/sync-plugin-specs.yaml index 539b892..3e221bb 100644 --- a/.github/workflows/sync-plugin-specs.yaml +++ b/.github/workflows/sync-plugin-specs.yaml @@ -34,7 +34,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: token: ${{ secrets.GITHUB_TOKEN }}