From c305ccdec9963ade6bd468ae1851fc6e8950b559 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Fri, 21 Aug 2026 09:26:28 -0400 Subject: [PATCH] chore(ci): collapse Dependabot pin refresh into one stack base Replace the overlapping #212/#213/#215/#216 siblings with a single bottom-of-stack commit: l9-ci-core pins to 0d28395, upload-artifact v7.0.1, and SPDX AND expressions on the license allow-list fallback so the observability layer can pass Dependency Review. Co-authored-by: Cursor --- .github/workflows/audit.yml | 2 +- .github/workflows/baseline-ratchet-caller.yml | 4 ++-- .github/workflows/l9-analysis.yml | 6 +++--- .github/workflows/supply-chain.yml | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 8524f2ae..e9b88706 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -34,7 +34,7 @@ jobs: - name: Upload reports if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: l9-audit-reports path: artifacts/ diff --git a/.github/workflows/baseline-ratchet-caller.yml b/.github/workflows/baseline-ratchet-caller.yml index 6771038d..946cad92 100644 --- a/.github/workflows/baseline-ratchet-caller.yml +++ b/.github/workflows/baseline-ratchet-caller.yml @@ -26,9 +26,9 @@ permissions: jobs: ratchet: name: Baseline Ratchet - uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@d81a06ed821106a487df2e5ad06d93e347392af6 + uses: Quantum-L9/l9-ci-core/.github/workflows/baseline-ratchet.yml@0d28395428426853c44825c4645c23ee8ace23b1 with: - core-revision: d81a06ed821106a487df2e5ad06d93e347392af6 + core-revision: 0d28395428426853c44825c4645c23ee8ace23b1 sdk-revision: 0779fca8238011f8abea551895f96584676e9d17 python-version: "3.12" pytest-paths: tests diff --git a/.github/workflows/l9-analysis.yml b/.github/workflows/l9-analysis.yml index d166bd53..65c65ca8 100644 --- a/.github/workflows/l9-analysis.yml +++ b/.github/workflows/l9-analysis.yml @@ -95,7 +95,7 @@ jobs: - id: sdk name: Provision immutable SDK if: steps.gov.outputs.enabled == 'true' - uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@f88116503430aa18992b70d8d31063e34ff97ef1 + uses: Quantum-L9/l9-ci-core/.github/actions/provision-sdk@0d28395428426853c44825c4645c23ee8ace23b1 - name: Normalize provider report if: steps.gov.outputs.enabled == 'true' @@ -156,7 +156,7 @@ jobs: - name: Upload analysis artifact set if: steps.gov.outputs.enabled == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.names.outputs.artifact-name }} path: | @@ -170,7 +170,7 @@ jobs: name: Publish analysis (Core) needs: analyze if: needs.analyze.outputs.enabled == 'true' - uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1 + uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@0d28395428426853c44825c4645c23ee8ace23b1 permissions: actions: read checks: write diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index e3db0a4f..1304b2ac 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -76,7 +76,7 @@ jobs: sarif_file: scorecard.sarif - name: Upload Scorecard Results as Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: scorecard-results path: scorecard.sarif @@ -122,7 +122,7 @@ jobs: fail-on-severity: high # dependency-review-action rejects specifying both allow-licenses and # deny-licenses. Keep the allow-list (stricter); deny-list is implied. - allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }} + allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause' }} comment-summary-in-pr: on-failure # ──────────────────────────────────────────────────────────────────────── @@ -217,7 +217,7 @@ jobs: - name: Upload License Report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.1 with: name: license-report path: |