diff --git a/.github/workflows/automatic-postmerge-audit-readonly.yml b/.github/workflows/automatic-postmerge-audit-readonly.yml index 0425bb4b..38a89dbf 100644 --- a/.github/workflows/automatic-postmerge-audit-readonly.yml +++ b/.github/workflows/automatic-postmerge-audit-readonly.yml @@ -36,7 +36,7 @@ jobs: path: .pgextwin-build persist-credentials: false - name: Set up Python only for read-only evidence matching - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Bind actual protected main-push to exact prior native audit diff --git a/.github/workflows/build-extension-attested.yml b/.github/workflows/build-extension-attested.yml index b6dc019e..11439e60 100644 --- a/.github/workflows/build-extension-attested.yml +++ b/.github/workflows/build-extension-attested.yml @@ -52,7 +52,7 @@ jobs: path: .pgextwin-build - name: Set up Python for Test Contract validation - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/build-extension.yml b/.github/workflows/build-extension.yml index 8be69ec4..49d30e40 100644 --- a/.github/workflows/build-extension.yml +++ b/.github/workflows/build-extension.yml @@ -49,7 +49,7 @@ jobs: path: .pgextwin-build - name: Set up Python for Test Contract validation - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/candidate-update.yml b/.github/workflows/candidate-update.yml index 66a675cd..6ca3f177 100644 --- a/.github/workflows/candidate-update.yml +++ b/.github/workflows/candidate-update.yml @@ -38,7 +38,7 @@ jobs: repository: pgextwin/build ref: ${{ job.workflow_sha }} path: .pgextwin-build - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Check live central BUILD authorization @@ -103,7 +103,7 @@ jobs: with: name: candidate-decision path: ${{ runner.temp }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Recheck tag, create/reuse owned PR, dispatch normal Windows CI diff --git a/.github/workflows/check-extension-updates.yml b/.github/workflows/check-extension-updates.yml index 21cdee2f..693b5335 100644 --- a/.github/workflows/check-extension-updates.yml +++ b/.github/workflows/check-extension-updates.yml @@ -37,7 +37,7 @@ jobs: path: .pgextwin-build - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml index a93a1283..1f9f2038 100644 --- a/.github/workflows/fleet-status.yml +++ b/.github/workflows/fleet-status.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Read GitHub state without mutation diff --git a/.github/workflows/fleet-upstream-watch.yml b/.github/workflows/fleet-upstream-watch.yml index f09fad0e..a207630a 100644 --- a/.github/workflows/fleet-upstream-watch.yml +++ b/.github/workflows/fleet-upstream-watch.yml @@ -39,7 +39,7 @@ jobs: with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Read-only check of all 17 stable upstreams @@ -90,7 +90,7 @@ jobs: ref: ${{ github.sha }} persist-credentials: false - name: Setup Python for original immutable Windows artifact audit - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Re-GET original approved native PR CI and independently audit ZIP/SPDX/Grype @@ -131,7 +131,7 @@ jobs: ref: ${{ github.sha }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Download ORIGINAL complete same-run fleet snapshot diff --git a/.github/workflows/issue311-coordinator-fleet-original.yml b/.github/workflows/issue311-coordinator-fleet-original.yml index 76082384..53a09eec 100644 --- a/.github/workflows/issue311-coordinator-fleet-original.yml +++ b/.github/workflows/issue311-coordinator-fleet-original.yml @@ -38,7 +38,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -59,7 +59,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r04-ambiguous17-source.yml b/.github/workflows/issue311-r04-ambiguous17-source.yml index 75769b98..9ac5e8bf 100644 --- a/.github/workflows/issue311-r04-ambiguous17-source.yml +++ b/.github/workflows/issue311-r04-ambiguous17-source.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r04-ambiguous17-watchdog.yml b/.github/workflows/issue311-r04-ambiguous17-watchdog.yml index 889fcd2d..067573f8 100644 --- a/.github/workflows/issue311-r04-ambiguous17-watchdog.yml +++ b/.github/workflows/issue311-r04-ambiguous17-watchdog.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r04r05-bridge.yml b/.github/workflows/issue311-r04r05-bridge.yml index d328c1d4..3dbc5463 100644 --- a/.github/workflows/issue311-r04r05-bridge.yml +++ b/.github/workflows/issue311-r04r05-bridge.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r04r05-source.yml b/.github/workflows/issue311-r04r05-source.yml index 02fdc631..a13f7356 100644 --- a/.github/workflows/issue311-r04r05-source.yml +++ b/.github/workflows/issue311-r04r05-source.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r04r05-terminal-recovery.yml b/.github/workflows/issue311-r04r05-terminal-recovery.yml index 7ac17868..716e23b2 100644 --- a/.github/workflows/issue311-r04r05-terminal-recovery.yml +++ b/.github/workflows/issue311-r04r05-terminal-recovery.yml @@ -21,7 +21,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-eventgap-source.yml b/.github/workflows/issue311-r05-eventgap-source.yml index f23020d5..1d5f6838 100644 --- a/.github/workflows/issue311-r05-eventgap-source.yml +++ b/.github/workflows/issue311-r05-eventgap-source.yml @@ -28,7 +28,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-eventgap-watchdog.yml b/.github/workflows/issue311-r05-eventgap-watchdog.yml index 1e514e63..c32673b9 100644 --- a/.github/workflows/issue311-r05-eventgap-watchdog.yml +++ b/.github/workflows/issue311-r05-eventgap-watchdog.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-eventgap17-source.yml b/.github/workflows/issue311-r05-eventgap17-source.yml index 12b358c8..bc68c658 100644 --- a/.github/workflows/issue311-r05-eventgap17-source.yml +++ b/.github/workflows/issue311-r05-eventgap17-source.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-eventgap17-watchdog.yml b/.github/workflows/issue311-r05-eventgap17-watchdog.yml index ce9c865e..5d5778e2 100644 --- a/.github/workflows/issue311-r05-eventgap17-watchdog.yml +++ b/.github/workflows/issue311-r05-eventgap17-watchdog.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-finite-watchdog.yml b/.github/workflows/issue311-r05-finite-watchdog.yml index ad98e649..026f4349 100644 --- a/.github/workflows/issue311-r05-finite-watchdog.yml +++ b/.github/workflows/issue311-r05-finite-watchdog.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-httpfault17-source.yml b/.github/workflows/issue311-r05-httpfault17-source.yml index d7a28b0c..6644d895 100644 --- a/.github/workflows/issue311-r05-httpfault17-source.yml +++ b/.github/workflows/issue311-r05-httpfault17-source.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-httpfault17-watchdog.yml b/.github/workflows/issue311-r05-httpfault17-watchdog.yml index 34432e42..c8d316d4 100644 --- a/.github/workflows/issue311-r05-httpfault17-watchdog.yml +++ b/.github/workflows/issue311-r05-httpfault17-watchdog.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-nonpublishing-needs.yml b/.github/workflows/issue311-r05-nonpublishing-needs.yml index 6cbcbb26..e9f724d7 100644 --- a/.github/workflows/issue311-r05-nonpublishing-needs.yml +++ b/.github/workflows/issue311-r05-nonpublishing-needs.yml @@ -29,7 +29,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Install schema validator for isolated read-only declaration test diff --git a/.github/workflows/issue311-r05-original-17repo.yml b/.github/workflows/issue311-r05-original-17repo.yml index 7d102a4c..ba5864b2 100644 --- a/.github/workflows/issue311-r05-original-17repo.yml +++ b/.github/workflows/issue311-r05-original-17repo.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-skip17-source.yml b/.github/workflows/issue311-r05-skip17-source.yml index 1ef25377..58373915 100644 --- a/.github/workflows/issue311-r05-skip17-source.yml +++ b/.github/workflows/issue311-r05-skip17-source.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-skip17-watchdog.yml b/.github/workflows/issue311-r05-skip17-watchdog.yml index 04376762..8e6f30a6 100644 --- a/.github/workflows/issue311-r05-skip17-watchdog.yml +++ b/.github/workflows/issue311-r05-skip17-watchdog.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-timeout17-source.yml b/.github/workflows/issue311-r05-timeout17-source.yml index 7baa8d17..1430357c 100644 --- a/.github/workflows/issue311-r05-timeout17-source.yml +++ b/.github/workflows/issue311-r05-timeout17-source.yml @@ -24,7 +24,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-timeout17-watchdog.yml b/.github/workflows/issue311-r05-timeout17-watchdog.yml index bb03b49f..fdb482ed 100644 --- a/.github/workflows/issue311-r05-timeout17-watchdog.yml +++ b/.github/workflows/issue311-r05-timeout17-watchdog.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-unified17-completion.yml b/.github/workflows/issue311-r05-unified17-completion.yml index d5abce78..ba4cd3a4 100644 --- a/.github/workflows/issue311-r05-unified17-completion.yml +++ b/.github/workflows/issue311-r05-unified17-completion.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-unified17.yml b/.github/workflows/issue311-r05-unified17.yml index f60903ae..db4ee6ee 100644 --- a/.github/workflows/issue311-r05-unified17.yml +++ b/.github/workflows/issue311-r05-unified17.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -70,7 +70,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Install the pinned-major request schema validator on Windows @@ -105,7 +105,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Install original request schema validator for aggregate diff --git a/.github/workflows/issue311-r05-windows-17.yml b/.github/workflows/issue311-r05-windows-17.yml index d1912cc6..8a6b4815 100644 --- a/.github/workflows/issue311-r05-windows-17.yml +++ b/.github/workflows/issue311-r05-windows-17.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -66,7 +66,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Install the pinned-major request schema validator on Windows @@ -101,7 +101,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Strictly aggregate original Windows jobs, original artifact ZIP and digest diff --git a/.github/workflows/issue311-r05-windows-completion-bridge.yml b/.github/workflows/issue311-r05-windows-completion-bridge.yml index f42c755a..13dedce5 100644 --- a/.github/workflows/issue311-r05-windows-completion-bridge.yml +++ b/.github/workflows/issue311-r05-windows-completion-bridge.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r05-windows-negative.yml b/.github/workflows/issue311-r05-windows-negative.yml index 9564bdcd..a6251bb3 100644 --- a/.github/workflows/issue311-r05-windows-negative.yml +++ b/.github/workflows/issue311-r05-windows-negative.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -52,7 +52,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Read actual remote protected main on Windows, inject one controlled failure after GET @@ -84,7 +84,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Original per-job/ZIP digest and negative terminal (expected failed result) diff --git a/.github/workflows/issue311-r05-windows-positive.yml b/.github/workflows/issue311-r05-windows-positive.yml index a74a0630..aca7e132 100644 --- a/.github/workflows/issue311-r05-windows-positive.yml +++ b/.github/workflows/issue311-r05-windows-positive.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -51,7 +51,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Install the pinned-major request schema validator on Windows @@ -86,7 +86,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Strictly aggregate original Windows jobs, original artifact ZIP and digest diff --git a/.github/workflows/issue311-r06-app-fleet-cas-terminal.yml b/.github/workflows/issue311-r06-app-fleet-cas-terminal.yml index 5c9c32ad..821bc114 100644 --- a/.github/workflows/issue311-r06-app-fleet-cas-terminal.yml +++ b/.github/workflows/issue311-r06-app-fleet-cas-terminal.yml @@ -33,7 +33,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -58,7 +58,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -88,7 +88,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-child-join-source.yml b/.github/workflows/issue311-r06-child-join-source.yml index 1d54b1ec..906b63fb 100644 --- a/.github/workflows/issue311-r06-child-join-source.yml +++ b/.github/workflows/issue311-r06-child-join-source.yml @@ -24,7 +24,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-child-join-watchdog.yml b/.github/workflows/issue311-r06-child-join-watchdog.yml index 47a989c7..832f1c00 100644 --- a/.github/workflows/issue311-r06-child-join-watchdog.yml +++ b/.github/workflows/issue311-r06-child-join-watchdog.yml @@ -24,7 +24,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -53,7 +53,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-failed-cas-recovery.yml b/.github/workflows/issue311-r06-failed-cas-recovery.yml index 1c0579d0..9d3884a9 100644 --- a/.github/workflows/issue311-r06-failed-cas-recovery.yml +++ b/.github/workflows/issue311-r06-failed-cas-recovery.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r06-failed-cas-recovery.py @@ -40,7 +40,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Verify original source and failed CAS ZIP then persist QUARANTINED, revoke401 @@ -69,7 +69,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Verify original failed run, state Git blob and durable replay rejection diff --git a/.github/workflows/issue311-r06-hostile17-recovery-source.yml b/.github/workflows/issue311-r06-hostile17-recovery-source.yml index 04abe321..9e49cf22 100644 --- a/.github/workflows/issue311-r06-hostile17-recovery-source.yml +++ b/.github/workflows/issue311-r06-hostile17-recovery-source.yml @@ -23,7 +23,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-hostile17-recovery-terminal.yml b/.github/workflows/issue311-r06-hostile17-recovery-terminal.yml index ee594141..8bc27f14 100644 --- a/.github/workflows/issue311-r06-hostile17-recovery-terminal.yml +++ b/.github/workflows/issue311-r06-hostile17-recovery-terminal.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-hostile17-source.yml b/.github/workflows/issue311-r06-hostile17-source.yml index f13d085d..89e87b97 100644 --- a/.github/workflows/issue311-r06-hostile17-source.yml +++ b/.github/workflows/issue311-r06-hostile17-source.yml @@ -23,7 +23,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-hostile17-terminal.yml b/.github/workflows/issue311-r06-hostile17-terminal.yml index bccef1f3..76f0cbda 100644 --- a/.github/workflows/issue311-r06-hostile17-terminal.yml +++ b/.github/workflows/issue311-r06-hostile17-terminal.yml @@ -23,7 +23,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-local-sourcekind.yml b/.github/workflows/issue311-r06-local-sourcekind.yml index eee4be0d..09dfed49 100644 --- a/.github/workflows/issue311-r06-local-sourcekind.yml +++ b/.github/workflows/issue311-r06-local-sourcekind.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-original-recovery.yml b/.github/workflows/issue311-r06-original-recovery.yml index 54562c6f..91ddaf12 100644 --- a/.github/workflows/issue311-r06-original-recovery.yml +++ b/.github/workflows/issue311-r06-original-recovery.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-parallel-cas-original.yml b/.github/workflows/issue311-r06-parallel-cas-original.yml index 490464e3..11a4a05a 100644 --- a/.github/workflows/issue311-r06-parallel-cas-original.yml +++ b/.github/workflows/issue311-r06-parallel-cas-original.yml @@ -24,7 +24,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r06-parallel-cas-original.py @@ -42,7 +42,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - id: prepare @@ -70,7 +70,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Independently arm same rev1 then one real GitHub PUT @@ -99,7 +99,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Independently arm same rev1 then one real GitHub PUT @@ -130,7 +130,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Verify both original provider ZIP SHA256, State Git bytes and one 409 diff --git a/.github/workflows/issue311-r06-prepare-scan.yml b/.github/workflows/issue311-r06-prepare-scan.yml index 8bd2e1bb..a62081a0 100644 --- a/.github/workflows/issue311-r06-prepare-scan.yml +++ b/.github/workflows/issue311-r06-prepare-scan.yml @@ -26,7 +26,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-request-preflight.yml b/.github/workflows/issue311-r06-request-preflight.yml index dc8f1443..2c50ab19 100644 --- a/.github/workflows/issue311-r06-request-preflight.yml +++ b/.github/workflows/issue311-r06-request-preflight.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-request-scan.yml b/.github/workflows/issue311-r06-request-scan.yml index e7a87da8..5b01202a 100644 --- a/.github/workflows/issue311-r06-request-scan.yml +++ b/.github/workflows/issue311-r06-request-scan.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r06-unattended-finite-guard.yml b/.github/workflows/issue311-r06-unattended-finite-guard.yml index 6fe1a586..c3257cb2 100644 --- a/.github/workflows/issue311-r06-unattended-finite-guard.yml +++ b/.github/workflows/issue311-r06-unattended-finite-guard.yml @@ -30,7 +30,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -48,7 +48,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -82,7 +82,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r08-publisher-deny-pilot.yml b/.github/workflows/issue311-r08-publisher-deny-pilot.yml index cd30c6b2..4853394a 100644 --- a/.github/workflows/issue311-r08-publisher-deny-pilot.yml +++ b/.github/workflows/issue311-r08-publisher-deny-pilot.yml @@ -55,7 +55,7 @@ jobs: with: persist-credentials: false ref: ${{ github.sha }} - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Live independent GitHub GET of protected original App+Sigstore receipt metadata, 17 CAS, separate Publisher identity (NO RELEASE) @@ -93,7 +93,7 @@ jobs: with: persist-credentials: false ref: ${{ github.sha }} - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Repeat independent original source GET before opening Publisher key (NO WRITE) diff --git a/.github/workflows/issue311-r09-private-chain.yml b/.github/workflows/issue311-r09-private-chain.yml index ad8309ed..96ed849c 100644 --- a/.github/workflows/issue311-r09-private-chain.yml +++ b/.github/workflows/issue311-r09-private-chain.yml @@ -48,7 +48,7 @@ jobs: with: persist-credentials: false ref: ${{ github.sha }} - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Repeat real R08 signed source and immutable CAS live original GET diff --git a/.github/workflows/issue311-r10-final-readonly-report.yml b/.github/workflows/issue311-r10-final-readonly-report.yml index 8d09b4b9..0a1b5bf6 100644 --- a/.github/workflows/issue311-r10-final-readonly-report.yml +++ b/.github/workflows/issue311-r10-final-readonly-report.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -49,7 +49,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r10-negative-originals.yml b/.github/workflows/issue311-r10-negative-originals.yml index 90537961..46b052a4 100644 --- a/.github/workflows/issue311-r10-negative-originals.yml +++ b/.github/workflows/issue311-r10-negative-originals.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -41,7 +41,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' @@ -65,7 +65,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python -m pip install --disable-pip-version-check 'jsonschema>=4,<5' diff --git a/.github/workflows/issue311-r10-negative-protected.yml b/.github/workflows/issue311-r10-negative-protected.yml index 4b63f43e..abc03a99 100644 --- a/.github/workflows/issue311-r10-negative-protected.yml +++ b/.github/workflows/issue311-r10-negative-protected.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r10-negative-protected.py @@ -41,7 +41,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r10-negative-protected.py diff --git a/.github/workflows/issue311-r11-migration-inventory.yml b/.github/workflows/issue311-r11-migration-inventory.yml index c4d8b278..151e14dd 100644 --- a/.github/workflows/issue311-r11-migration-inventory.yml +++ b/.github/workflows/issue311-r11-migration-inventory.yml @@ -33,7 +33,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r11-migration-inventory.py @@ -48,7 +48,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r11-migration-inventory.py @@ -86,7 +86,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Retrieve source Runner original JSON using authenticated Actions GET diff --git a/.github/workflows/issue311-r11-overlap-preflight.yml b/.github/workflows/issue311-r11-overlap-preflight.yml index 9c923db2..8aee1175 100644 --- a/.github/workflows/issue311-r11-overlap-preflight.yml +++ b/.github/workflows/issue311-r11-overlap-preflight.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - run: python tests/test-issue311-r11-overlap-preflight.py diff --git a/.github/workflows/operator-update-auto.yml b/.github/workflows/operator-update-auto.yml index 0c44b256..2b107f3f 100644 --- a/.github/workflows/operator-update-auto.yml +++ b/.github/workflows/operator-update-auto.yml @@ -35,7 +35,7 @@ jobs: path: .pgextwin-automation persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Verify central completed/success scan, exact registered fleet, protected main and candidate-only status diff --git a/.github/workflows/operator-update-readonly.yml b/.github/workflows/operator-update-readonly.yml index 669a9bd0..027c274e 100644 --- a/.github/workflows/operator-update-readonly.yml +++ b/.github/workflows/operator-update-readonly.yml @@ -114,7 +114,7 @@ jobs: path: .pgextwin-build persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Check live central fleet watch authorization (read only) diff --git a/.github/workflows/postgresql-update-watch.yml b/.github/workflows/postgresql-update-watch.yml index 861bbc52..0dd85e37 100644 --- a/.github/workflows/postgresql-update-watch.yml +++ b/.github/workflows/postgresql-update-watch.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/publisher-candidate-intake.yml b/.github/workflows/publisher-candidate-intake.yml index a8b65a32..51040c68 100644 --- a/.github/workflows/publisher-candidate-intake.yml +++ b/.github/workflows/publisher-candidate-intake.yml @@ -48,7 +48,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Read-only protected central automatic Publisher opt-in gate @@ -129,7 +129,7 @@ jobs: ref: ${{ matrix.sha }} path: .pgextwin-candidate persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Re-download ORIGINAL signed PG ZIP/SPDX/Grype and two audits (READ ONLY) @@ -228,7 +228,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Require authentic successful same-run proof for each selected repository @@ -284,7 +284,7 @@ jobs: ref: ${{ matrix.sha }} path: .pgextwin-candidate persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Independently download ORIGINAL signed Run bytes (not prior-job authority) diff --git a/.github/workflows/recover-native-pr-candidate.yml b/.github/workflows/recover-native-pr-candidate.yml index 75b2e099..4ce1a24b 100644 --- a/.github/workflows/recover-native-pr-candidate.yml +++ b/.github/workflows/recover-native-pr-candidate.yml @@ -26,7 +26,7 @@ jobs: path: .pgextwin-build persist-credentials: false - name: Python for read-only verifier - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Independently re-fetch original approved CI attempt and required App15368 diff --git a/.github/workflows/recover-native-pr-fleet.yml b/.github/workflows/recover-native-pr-fleet.yml index 55e4342f..f02e0ebe 100644 --- a/.github/workflows/recover-native-pr-fleet.yml +++ b/.github/workflows/recover-native-pr-fleet.yml @@ -30,7 +30,7 @@ jobs: ref: ${{ github.sha }} persist-credentials: false - name: Python for immutable candidate identity and artifact verification - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Independently GET each pending registered native PR CI and rehash original artifacts diff --git a/.github/workflows/requalify-merged-candidate-signed.yml b/.github/workflows/requalify-merged-candidate-signed.yml index 52a97ad6..1a041e47 100644 --- a/.github/workflows/requalify-merged-candidate-signed.yml +++ b/.github/workflows/requalify-merged-candidate-signed.yml @@ -33,7 +33,7 @@ jobs: ref: ${{ job.workflow_sha }} path: .pgextwin-build - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Independently GET central genuine schedule + original bot PR/native CI @@ -92,7 +92,7 @@ jobs: repository: ${{ job.workflow_repository }} ref: ${{ job.workflow_sha }} path: .pgextwin-build - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Download original signing intent from THIS same local schedule run @@ -146,7 +146,7 @@ jobs: repository: ${{ job.workflow_repository }} ref: ${{ job.workflow_sha }} path: .pgextwin-build - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 @@ -197,7 +197,7 @@ jobs: repository: ${{ job.workflow_repository }} ref: ${{ job.workflow_sha }} path: .pgextwin-build - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 9b321bce..749752f9 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/verified-pin-automerge.yml b/.github/workflows/verified-pin-automerge.yml index c9a78d05..b068f582 100644 --- a/.github/workflows/verified-pin-automerge.yml +++ b/.github/workflows/verified-pin-automerge.yml @@ -34,7 +34,7 @@ jobs: persist-credentials: false path: .pgextwin-guard - name: Python 3.13 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - name: Inspect original PR, protected main, independent CI and exact SHA without merging diff --git a/.github/workflows/verify-candidate.yml b/.github/workflows/verify-candidate.yml index f13657eb..c0a97448 100644 --- a/.github/workflows/verify-candidate.yml +++ b/.github/workflows/verify-candidate.yml @@ -21,7 +21,7 @@ jobs: repository: ${{ job.workflow_repository }} ref: ${{ job.workflow_sha }} path: .pgextwin-build - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Verify actual per-major artifact contents diff --git a/.github/workflows/verify-native-pr-candidate.yml b/.github/workflows/verify-native-pr-candidate.yml index 0b1de89c..735b8de7 100644 --- a/.github/workflows/verify-native-pr-candidate.yml +++ b/.github/workflows/verify-native-pr-candidate.yml @@ -40,7 +40,7 @@ jobs: persist-credentials: false - name: Set up Python (auditor only; never executes candidate scripts) - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" diff --git a/.github/workflows/verify-signed-candidate-readonly.yml b/.github/workflows/verify-signed-candidate-readonly.yml index 3f2250c2..3db2dabb 100644 --- a/.github/workflows/verify-signed-candidate-readonly.yml +++ b/.github/workflows/verify-signed-candidate-readonly.yml @@ -32,7 +32,7 @@ jobs: ref: ${{ job.workflow_sha }} path: .pgextwin-build persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Download previously verified original decision @@ -123,7 +123,7 @@ jobs: ref: ${{ job.workflow_sha }} path: .pgextwin-build persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.13" - name: Download first signed audit from prior independent GitHub job