From 4939662b0b150a41ffa67e7789c5085381921060 Mon Sep 17 00:00:00 2001 From: Harish Seshadri Date: Mon, 3 Aug 2026 07:17:49 -0700 Subject: [PATCH 1/2] chore(ci): every first-party ref runs the v9.0.0 composite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nine self-pins still resolved to ci-v3.0.0, whose tree carries setup-uv v8.3.2 — so python-gate, python-publish and security-audit all executed the old version while ci.yml ran v9.0.0. Bumping the composite in #14 fixed the file; nothing that calls it moved until now. Comments move with the SHAs. A stale version comment is what zizmor's ref-version-mismatch fails on, and it turned main red this morning. Verified: 9 pins before, 0 remaining at 2a575cd after — asserted, not assumed. zizmor exit 0. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx --- .github/workflows/cloudflare-pages-deploy.yml | 4 ++-- .github/workflows/frontend-gate.yml | 4 ++-- .github/workflows/python-gate.yml | 2 +- .github/workflows/python-publish.yml | 2 +- .github/workflows/security-audit.yml | 4 ++-- .github/workflows/ts-publish.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cloudflare-pages-deploy.yml b/.github/workflows/cloudflare-pages-deploy.yml index 248b540..60e27e9 100644 --- a/.github/workflows/cloudflare-pages-deploy.yml +++ b/.github/workflows/cloudflare-pages-deploy.yml @@ -192,7 +192,7 @@ jobs: ref: ${{ github.event.workflow_run.head_sha || github.ref }} - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} @@ -213,7 +213,7 @@ jobs: run: bash --noprofile --norc -euo pipefail -c "$TRUSTED_COMMAND" - name: Deploy to Cloudflare Pages - uses: hseshadr/ci/.github/actions/pages-deploy-dist@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/pages-deploy-dist@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: project-name: ${{ inputs.project-name }} dist-dir: ${{ inputs.dist-dir }} diff --git a/.github/workflows/frontend-gate.yml b/.github/workflows/frontend-gate.yml index 6411457..d7edc4f 100644 --- a/.github/workflows/frontend-gate.yml +++ b/.github/workflows/frontend-gate.yml @@ -88,7 +88,7 @@ jobs: persist-credentials: false - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} @@ -99,7 +99,7 @@ jobs: - name: Setup Playwright (cached) if: ${{ inputs.install-playwright }} - uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: browsers: ${{ inputs.playwright-browsers }} working-directory: ${{ inputs.playwright-working-directory || inputs.working-directory }} diff --git a/.github/workflows/python-gate.yml b/.github/workflows/python-gate.yml index 4e1b10b..2010ba8 100644 --- a/.github/workflows/python-gate.yml +++ b/.github/workflows/python-gate.yml @@ -79,7 +79,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: python-version: ${{ inputs.python-version }} sync-args: ${{ inputs.sync-args }} diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 57f33ba..b2064c5 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -115,7 +115,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: python-version: ${{ inputs.python-version }} sync-args: ${{ inputs.sync-args }} diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index 8dbcafd..00c7e5e 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -107,7 +107,7 @@ jobs: # run-sync: false — we `uv export` the lock, not build a venv. - name: Setup Python + uv - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: ${{ inputs.python-working-directory }} run-sync: "false" @@ -163,7 +163,7 @@ jobs: # install: false — `pnpm audit` reads the lockfile + queries the advisory DB # directly; no node_modules needed. - name: Setup pnpm + Node - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: ${{ inputs.frontend-working-directory }}/package.json node-version: ${{ inputs.node-version }} diff --git a/.github/workflows/ts-publish.yml b/.github/workflows/ts-publish.yml index 14b42af..b0e3d48 100644 --- a/.github/workflows/ts-publish.yml +++ b/.github/workflows/ts-publish.yml @@ -141,7 +141,7 @@ jobs: registry-url: ${{ inputs.registry-url }} - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} From 505a7943148968273fbf97353212471078a7d8f0 Mon Sep 17 00:00:00 2001 From: Harish Seshadri Date: Mon, 3 Aug 2026 07:21:20 -0700 Subject: [PATCH 2/2] chore(ci): re-pin the published examples too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first-party currency guard covers examples/, not just .github/ — and it is right to. examples/ is the path consumers copy; ci-v2.0.0 got into every consumer exactly this way, because every example pointed at it while it carried nested @ci-v1 moving tags. 17 example refs moved to 33c5e5fa (ci-v3.1.0). tests/security-policy.sh exits 0. Co-Authored-By: Claude Opus 5 (1M context) --- examples/almamesh/security-audit.yml | 2 +- examples/aml-filter/ci.yml | 8 ++++---- examples/aml-filter/deploy.yml | 4 ++-- examples/aml-filter/security-audit.yml | 4 ++-- examples/assay/publish.yml | 4 ++-- examples/edge-proc/ci.yml | 4 ++-- examples/edge-proc/publish.yml | 2 +- examples/edge-proc/security-audit.yml | 2 +- examples/edge-reco/ci.yml | 14 +++++++------- examples/edge-reco/deploy.yml | 2 +- examples/edge-reco/security-audit.yml | 2 +- examples/edgeproc-core/ci.yml | 4 ++-- examples/edgeproc-core/publish.yml | 2 +- examples/edgeproc-core/security-audit.yml | 2 +- examples/privacy-core/ci.yml | 4 ++-- examples/privacy-core/publish.yml | 2 +- examples/privacy-core/security-audit.yml | 2 +- 17 files changed, 32 insertions(+), 32 deletions(-) diff --git a/examples/almamesh/security-audit.yml b/examples/almamesh/security-audit.yml index 5cbe7e5..ae42dbe 100644 --- a/examples/almamesh/security-audit.yml +++ b/examples/almamesh/security-audit.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-python-audit: true python-working-directory: backend diff --git a/examples/aml-filter/ci.yml b/examples/aml-filter/ci.yml index c122ad9..173d43d 100644 --- a/examples/aml-filter/ci.yml +++ b/examples/aml-filter/ci.yml @@ -33,7 +33,7 @@ jobs: permissions: contents: read pull-requests: read - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 frontend: runs-on: ubuntu-latest @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc @@ -51,7 +51,7 @@ jobs: # Weights come from a GitHub RELEASE, not a package registry, so the fetch # needs GH_TOKEN. Job-level `env:` is what reaches a composite's steps — # the composite deliberately takes no secret input. - - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 env: GH_TOKEN: ${{ github.token }} with: @@ -67,7 +67,7 @@ jobs: gh release download model-weights-v1 --repo "$GITHUB_REPOSITORY" --dir "$dir/onnx" --clobber \ --pattern model_quantized.onnx node scripts/download-model.mjs - - uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: frontend cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }} diff --git a/examples/aml-filter/deploy.yml b/examples/aml-filter/deploy.yml index dae6882..2be664b 100644 --- a/examples/aml-filter/deploy.yml +++ b/examples/aml-filter/deploy.yml @@ -39,7 +39,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc @@ -105,7 +105,7 @@ jobs: fi # --- shared deploy half: identical wrangler step used by every Pages repo --- - - uses: hseshadr/ci/.github/actions/pages-deploy-dist@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/pages-deploy-dist@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: project-name: aml-filter dist-dir: frontend/app/dist diff --git a/examples/aml-filter/security-audit.yml b/examples/aml-filter/security-audit.yml index f4e0b64..68e6f98 100644 --- a/examples/aml-filter/security-audit.yml +++ b/examples/aml-filter/security-audit.yml @@ -8,10 +8,10 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-pnpm-audit: true frontend-working-directory: frontend pnpm-audit-level: low gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 diff --git a/examples/assay/publish.yml b/examples/assay/publish.yml index 482bff0..ad571e4 100644 --- a/examples/assay/publish.yml +++ b/examples/assay/publish.yml @@ -59,7 +59,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: sync-args: "--frozen --all-extras" @@ -121,7 +121,7 @@ jobs: permissions: id-token: write # OIDC — npm verifies this against the registered trusted publisher. contents: read - uses: hseshadr/ci/.github/workflows/ts-publish.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/ts-publish.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: ts # assay has no ROOT package.json/lockfile — the TS package lives wholly in ts/. diff --git a/examples/edge-proc/ci.yml b/examples/edge-proc/ci.yml index 2e60bbd..4eed0a9 100644 --- a/examples/edge-proc/ci.yml +++ b/examples/edge-proc/ci.yml @@ -12,8 +12,8 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: sync-args: "--frozen --all-extras" gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 diff --git a/examples/edge-proc/publish.yml b/examples/edge-proc/publish.yml index d78d942..5f2b864 100644 --- a/examples/edge-proc/publish.yml +++ b/examples/edge-proc/publish.yml @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: sync-args: "--frozen --all-extras" diff --git a/examples/edge-proc/security-audit.yml b/examples/edge-proc/security-audit.yml index 65c2430..e737512 100644 --- a/examples/edge-proc/security-audit.yml +++ b/examples/edge-proc/security-audit.yml @@ -8,6 +8,6 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-python-audit: true diff --git a/examples/edge-reco/ci.yml b/examples/edge-reco/ci.yml index 7ad5d1a..6adb07f 100644 --- a/examples/edge-reco/ci.yml +++ b/examples/edge-reco/ci.yml @@ -17,10 +17,10 @@ permissions: pull-requests: read jobs: gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 quality: - uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: backend sync-args: "--locked --group dev" @@ -31,13 +31,13 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc cache-dependency-path: frontend/pnpm-lock.yaml working-directory: frontend - - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: cache-path: frontend/app/public/models cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }} @@ -53,19 +53,19 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc cache-dependency-path: frontend/pnpm-lock.yaml working-directory: frontend - - uses: hseshadr/ci/.github/actions/restore-model-cache@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: cache-path: frontend/app/public/models cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }} fetch-command: node scripts/download-model.mjs working-directory: frontend/app - - uses: hseshadr/ci/.github/actions/setup-playwright@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + - uses: hseshadr/ci/.github/actions/setup-playwright@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: frontend cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }} diff --git a/examples/edge-reco/deploy.yml b/examples/edge-reco/deploy.yml index 629f5ff..19272ad 100644 --- a/examples/edge-reco/deploy.yml +++ b/examples/edge-reco/deploy.yml @@ -32,7 +32,7 @@ jobs: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }} - uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: project-name: edge-reco dist-dir: frontend/app/dist diff --git a/examples/edge-reco/security-audit.yml b/examples/edge-reco/security-audit.yml index 43a22b4..8a80e96 100644 --- a/examples/edge-reco/security-audit.yml +++ b/examples/edge-reco/security-audit.yml @@ -8,7 +8,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-python-audit: true run-pnpm-audit: true diff --git a/examples/edgeproc-core/ci.yml b/examples/edgeproc-core/ci.yml index 7564aae..de1992d 100644 --- a/examples/edgeproc-core/ci.yml +++ b/examples/edgeproc-core/ci.yml @@ -13,7 +13,7 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/python-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: upload-coverage: true # Name the one secret the gate needs. `secrets: inherit` would forward every repo @@ -21,4 +21,4 @@ jobs: secrets: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 diff --git a/examples/edgeproc-core/publish.yml b/examples/edgeproc-core/publish.yml index 7cdf11e..0af9c39 100644 --- a/examples/edgeproc-core/publish.yml +++ b/examples/edgeproc-core/publish.yml @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: sync-args: "--frozen --all-extras" diff --git a/examples/edgeproc-core/security-audit.yml b/examples/edgeproc-core/security-audit.yml index 4145a70..c0a1b57 100644 --- a/examples/edgeproc-core/security-audit.yml +++ b/examples/edgeproc-core/security-audit.yml @@ -8,6 +8,6 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-python-audit: true diff --git a/examples/privacy-core/ci.yml b/examples/privacy-core/ci.yml index d86439f..dca9ac2 100644 --- a/examples/privacy-core/ci.yml +++ b/examples/privacy-core/ci.yml @@ -13,9 +13,9 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/frontend-gate.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/frontend-gate.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true" install-playwright: true gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 diff --git a/examples/privacy-core/publish.yml b/examples/privacy-core/publish.yml index ddbc763..ef9c31e 100644 --- a/examples/privacy-core/publish.yml +++ b/examples/privacy-core/publish.yml @@ -37,7 +37,7 @@ jobs: permissions: id-token: write # OIDC — npm verifies this against the registered trusted publisher. contents: read - uses: hseshadr/ci/.github/workflows/ts-publish.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/ts-publish.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: working-directory: "." install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true" diff --git a/examples/privacy-core/security-audit.yml b/examples/privacy-core/security-audit.yml index 99274b7..27a992a 100644 --- a/examples/privacy-core/security-audit.yml +++ b/examples/privacy-core/security-audit.yml @@ -8,7 +8,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@2a575cd193e2e1fc093ccd26821020538e2547b7 # ci-v3.0.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@33c5e5fa421210e6cc91ea30cad708bce29a2407 # ci-v3.1.0 with: run-pnpm-audit: true frontend-working-directory: "."