From 731789a9aa33a8c0b1d60192a5860fa60849cd34 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 22:36:03 +0000 Subject: [PATCH] Bump the actions group across 1 directory with 5 updates Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.0.0` | `4.1.1` | | [actions/attest-sbom](https://github.com/actions/attest-sbom) | `3.0.0` | `4.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | Updates `actions/checkout` from 4.2.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.2.2...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/attest-build-provenance` from 3.0.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/977bb373ede98d70efdf65b84cb5f73e068dcc2a...0f67c3f4856b2e3261c31976d6725780e5e4c373) Updates `actions/attest-sbom` from 3.0.0 to 4.1.0 - [Release notes](https://github.com/actions/attest-sbom/releases) - [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-sbom/compare/4651f806c01d8637787e274ac3bdf724ef169f34...c604332985a26aa8cf1bdc465b92731239ec6b9e) Updates `github/codeql-action/init` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/attest-sbom dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/attest-release.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/publish-sparkle-appcast.yml | 2 +- .github/workflows/quality.yml | 10 +++++----- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/attest-release.yml b/.github/workflows/attest-release.yml index f583263..8ee3119 100644 --- a/.github/workflows/attest-release.yml +++ b/.github/workflows/attest-release.yml @@ -74,7 +74,7 @@ jobs: --checksums dist/SHA256SUMS.txt - name: Attest verified release assets - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: | dist/SwanSong-${{ env.VERSION }}-macOS-universal.zip @@ -84,7 +84,7 @@ jobs: dist/SHA256SUMS.txt - name: Attach the SPDX inventory to the app archive - uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3 + uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0 with: subject-path: dist/SwanSong-${{ env.VERSION }}-macOS-universal.zip sbom-path: dist/SwanSong-${{ env.VERSION }}.spdx.json diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9688e5e..845c60e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 with: languages: ${{ matrix.language }} build-mode: manual @@ -49,6 +49,6 @@ jobs: --product SwanSongChecks - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/publish-sparkle-appcast.yml b/.github/workflows/publish-sparkle-appcast.yml index 5f6806f..0c2f11a 100644 --- a/.github/workflows/publish-sparkle-appcast.yml +++ b/.github/workflows/publish-sparkle-appcast.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Check out reviewed main - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 34c09bd..7393066 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -24,7 +24,7 @@ jobs: tests: ${{ steps.classify.outputs.tests }} steps: - name: Check out exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -115,13 +115,13 @@ jobs: - name: Check out exact source if: env.RUN_TESTS == 'true' - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check out locked SwanSong SDK source if: env.RUN_TESTS == 'true' - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: RegionallyFamous/swansong-sdk ref: f9bab7451593d0d8640816c60e0836377c65027e @@ -223,13 +223,13 @@ jobs: - name: Check out exact source if: env.RUN_PREFLIGHT == 'true' - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check out locked SwanSong SDK source if: env.RUN_PREFLIGHT == 'true' - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: RegionallyFamous/swansong-sdk ref: f9bab7451593d0d8640816c60e0836377c65027e