From f8e7a9f6fe55a529c1b811f2a7c02283ac590f30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 03:36:38 +0000 Subject: [PATCH] ci: Bump the actions group across 1 directory with 4 updates Bumps the actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance), [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) and [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/attest-build-provenance` from 96b4a1ef7235a096b17240c259729fdd70c83d45 to e8998f949152b193b063cb0ec769d69d929409be - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/96b4a1ef7235a096b17240c259729fdd70c83d45...e8998f949152b193b063cb0ec769d69d929409be) Updates `dtolnay/rust-toolchain` from fa04a1451ff1842e2626ccb99004d0195b455a88 to 2c7215f132e9ebf062739d9130488b56d53c060c - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/fa04a1451ff1842e2626ccb99004d0195b455a88...2c7215f132e9ebf062739d9130488b56d53c060c) Updates `actions/setup-node` from 4.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: e8998f949152b193b063cb0ec769d69d929409be dependency-type: direct:production dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: 2c7215f132e9ebf062739d9130488b56d53c060c dependency-type: direct:production dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/agent.yml | 6 +++--- .github/workflows/chart.yml | 2 +- .github/workflows/e2e-tools-refresh.yml | 2 +- .github/workflows/e2e.yml | 2 +- .github/workflows/rust.yml | 16 ++++++++-------- 5 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/agent.yml b/.github/workflows/agent.yml index da1215e..31965fb 100644 --- a/.github/workflows/agent.yml +++ b/.github/workflows/agent.yml @@ -38,7 +38,7 @@ jobs: - name: Enable rust # The runner image installs rust under ~/.cargo/bin but doesn't put it on PATH. run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Compile agent with eBPF # --features ebpf: build.rs compiles the BPF object (nightly + bpf-linker, baked # into the runner image) and the userspace aya loader links it in. Full check. @@ -58,7 +58,7 @@ jobs: attestations: write # JEF-275: write the Sigstore-signed SLSA build-provenance attestation steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Log into registry if: github.event_name != 'pull_request' uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 @@ -138,7 +138,7 @@ jobs: # `provenance: true` above is the unsigned variant the observer never reads. - name: Attest build provenance (Sigstore-signed SLSA) if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') }} - uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2 + uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build-and-push.outputs.digest }} diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml index 283d0d7..ec78e4f 100644 --- a/.github/workflows/chart.yml +++ b/.github/workflows/chart.yml @@ -19,7 +19,7 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # First-party (Microsoft) Helm installer, pinned by commit SHA. - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 with: diff --git a/.github/workflows/e2e-tools-refresh.yml b/.github/workflows/e2e-tools-refresh.yml index 308c3e9..490f968 100644 --- a/.github/workflows/e2e-tools-refresh.yml +++ b/.github/workflows/e2e-tools-refresh.yml @@ -21,7 +21,7 @@ jobs: WF: .github/workflows/e2e.yml BRANCH: ci/refresh-e2e-tools steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Resolve latest versions + checksums, rewrite pins id: bump run: | diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index cafc2d1..c419836 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout protector - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install k3d # Pinned version + sha256 verification — no `curl | bash` of a mutable # upstream script (the repo pins all GitHub Actions to a SHA for the same diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 2d07152..bb4ccac 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -38,8 +38,8 @@ jobs: # automatically. Durable follow-up: bake sccache/nextest/cargo-audit into the runner image. GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable with: toolchain: stable components: clippy, rustfmt @@ -59,7 +59,7 @@ jobs: # cache, but not the binary, so a plain binstall skips and sccache is absent # from PATH (RUSTC_WRAPPER then fails). Force a real install every run. run: cargo binstall --no-confirm --force sccache - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" - name: Build dashboard bundle @@ -94,8 +94,8 @@ jobs: # automatically. Durable follow-up: bake sccache/nextest/cargo-audit into the runner image. GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # stable + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable with: toolchain: stable - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 @@ -106,7 +106,7 @@ jobs: cache-targets: false - name: Install sccache run: cargo binstall --no-confirm --force sccache - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" - name: Build dashboard bundle @@ -163,7 +163,7 @@ jobs: attestations: write # JEF-275: write the Sigstore-signed SLSA build-provenance attestation steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Log into registry if: github.event_name != 'pull_request' uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 @@ -240,7 +240,7 @@ jobs: # the observer (which reads signed signature/referrer layers) never sees. - name: Attest build provenance (Sigstore-signed SLSA) if: ${{ github.event_name != 'pull_request' }} - uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2 + uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build-and-push.outputs.digest }}