diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96478535..26339673 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: name: Rustfmt runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust nightly with rustfmt run: | rustup toolchain install nightly --profile minimal --component rustfmt @@ -43,7 +43,7 @@ jobs: name: cargo-deny (licenses, advisories, bans, sources) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install cargo-deny run: cargo install cargo-deny --locked - name: Restore helper manifest @@ -65,7 +65,7 @@ jobs: name: Compliance (copyright headers) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Check copyright headers run: bash scripts/check_copyright_headers.sh @@ -80,7 +80,7 @@ jobs: matrix: os: [ubuntu-latest, windows-latest, macos-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust stable with clippy shell: bash run: | @@ -216,7 +216,7 @@ jobs: if: github.event_name == 'push' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust stable with clippy run: | rustup toolchain install stable --profile minimal --component clippy @@ -269,7 +269,7 @@ jobs: if: runner.os != 'Windows' run: chmod +x bin/${{ matrix.binary }} - name: Checkout openjd-specifications - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: OpenJobDescription/openjd-specifications path: openjd-specifications @@ -293,7 +293,7 @@ jobs: name: MSRV runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install MSRV toolchain run: | rustup toolchain install 1.94.1 --profile minimal @@ -315,7 +315,7 @@ jobs: name: Documentation runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust stable run: | rustup toolchain install stable --profile minimal @@ -343,7 +343,7 @@ jobs: matrix: variant: [localuser, ldap] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Run cross-user tests run: | if [ "${{ matrix.variant }}" = "ldap" ]; then @@ -362,7 +362,7 @@ jobs: needs: build-test runs-on: windows-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust stable shell: bash run: | @@ -423,7 +423,7 @@ jobs: name: openjd-for-js (WASM + JS tests) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install rust stable with wasm32 target shell: bash run: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0cb33deb..ffa2ca93 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,7 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Initialize CodeQL uses: github/codeql-action/init@v4.37.8 diff --git a/.github/workflows/eval_crate.yml b/.github/workflows/eval_crate.yml index 782d7051..267c27b9 100644 --- a/.github/workflows/eval_crate.yml +++ b/.github/workflows/eval_crate.yml @@ -211,7 +211,7 @@ jobs: # The skill resolves sibling repos relative to the openjd-rs root, so # everything is checked out as siblings INSIDE the workspace. - name: Check out openjd-rs - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0 with: # In PR mode evaluate the PR's own code; otherwise the default ref. ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }} @@ -219,7 +219,7 @@ jobs: persist-credentials: false - name: Check out openjd-specifications (canonical specs) - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0 with: repository: OpenJobDescription/openjd-specifications ref: mainline @@ -232,7 +232,7 @@ jobs: # no feature branches: this job holds Bedrock credentials, so what it # checks out is a trust decision, not a convenience. - name: Check out Python reference - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0 with: repository: ${{ fromJSON('{"expr":"OpenJobDescription/openjd-model-for-python","model":"OpenJobDescription/openjd-model-for-python","sessions":"OpenJobDescription/openjd-sessions-for-python","cli":"OpenJobDescription/openjd-cli"}')[matrix.crate] }} ref: mainline @@ -266,7 +266,7 @@ jobs: # ---- Bedrock auth: the same shape as the org's review workflow ---- - name: Check out workflow tooling (pinned requirements) - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0 with: repository: aws-deadline/.github ref: mainline @@ -460,7 +460,7 @@ jobs: # writes only FETCH_HEAD, so a later `git checkout ` would fail and # silently recreate the branch from the shallow tip. - name: Check out the default branch - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0 with: ref: ${{ github.event.repository.default_branch }} fetch-depth: 0 diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index cb5884eb..544056ef 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -61,7 +61,7 @@ jobs: id-token: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -121,7 +121,7 @@ jobs: cancel-in-progress: true steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 persist-credentials: false