From 4ea399f2a2698adf0afa3822b3d326c85d787cd2 Mon Sep 17 00:00:00 2001 From: Vladimir Rotariu Date: Mon, 21 Sep 2026 14:01:10 -0600 Subject: [PATCH] chore(deps): bump the github-actions group with 3 updates taiki-e/install-action v2.87.4 -> v2.87.10 (fa239534) github/codeql-action init and analyze v4.37.9 -> v4.38.0 (b96794f0) Rebuilt on top of #454, which landed exact version comments and a gate that resolves each one against the tag it names. Dependabot's branch carried the old `# v2` and `# v4` comments, which that gate now refuses, so the comments move with the SHAs here. Both SHAs were resolved against the upstream repositories rather than taken from the pull request body: fa239534 carries the tag v2.87.10 and b96794f0 carries v4.38.0, and each is a release commit in its own repository. $ bash scripts/verify-action-pins.sh . OK taiki-e/install-action fa239534 is v2.87.10 (ci.yml:296) OK taiki-e/install-action fa239534 is v2.87.10 (ci.yml:351) OK github/codeql-action/init b96794f0 is v4.38.0 (codeql.yml:48) OK github/codeql-action/analyze b96794f0 is v4.38.0 (codeql.yml:55) verify-action-pins: checked 54 pins --- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11159394..b28011fc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -293,7 +293,7 @@ jobs: run: cargo doc --no-deps --workspace --locked - name: Install cargo-nextest - uses: taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2.87.4 + uses: taiki-e/install-action@fa23953489c080190314742a9b907f8e97c6767c # v2.87.10 with: tool: cargo-nextest @@ -348,7 +348,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install cargo-audit - uses: taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2.87.4 + uses: taiki-e/install-action@fa23953489c080190314742a9b907f8e97c6767c # v2.87.10 with: tool: cargo-audit diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 48c91c52..e923d0ed 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,13 +45,13 @@ jobs: # check always reports a status. - name: Initialize CodeQL if: github.event.repository.visibility == 'public' - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL analysis if: github.event.repository.visibility == 'public' - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{ matrix.language }}"