From 1b26723326b4a6987e5de6f478238213b73d4bd1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 11:19:33 +0000 Subject: [PATCH] chore(ci): bump the github-actions-all group across 1 directory with 5 updates Bumps the github-actions-all group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...68559e99cc807c1eb7e9238fd43a15bba460eec2) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all ... Signed-off-by: dependabot[bot] --- .github/workflows/apac-mas-compliance.yml | 2 +- .github/workflows/ci-integration.yml | 4 +- .github/workflows/ci-partner-integration.yml | 6 +- .github/workflows/ci.yml | 58 ++++++++++---------- .github/workflows/compliance-matrix.yml | 6 +- .github/workflows/eu-ecb-compliance.yml | 2 +- .github/workflows/license_guard.yml | 4 +- .github/workflows/locust-nightly.yml | 6 +- .github/workflows/lula2-pr-compliance.yml | 2 +- .github/workflows/poam-drift.yml | 2 +- .github/workflows/policy_compile.yml | 6 +- .github/workflows/publish-client-sdk.yml | 4 +- .github/workflows/regional-posture.yml | 4 +- .github/workflows/sbom.yml | 2 +- .github/workflows/security-scan.yml | 28 +++++----- .github/workflows/test-hermetic.yml | 2 +- .github/workflows/tlc-model-check.yml | 4 +- 17 files changed, 71 insertions(+), 71 deletions(-) mode change 100755 => 100644 .github/workflows/apac-mas-compliance.yml mode change 100755 => 100644 .github/workflows/ci-integration.yml mode change 100755 => 100644 .github/workflows/ci-partner-integration.yml mode change 100755 => 100644 .github/workflows/ci.yml mode change 100755 => 100644 .github/workflows/compliance-matrix.yml mode change 100755 => 100644 .github/workflows/eu-ecb-compliance.yml mode change 100755 => 100644 .github/workflows/license_guard.yml mode change 100755 => 100644 .github/workflows/locust-nightly.yml mode change 100755 => 100644 .github/workflows/lula2-pr-compliance.yml mode change 100755 => 100644 .github/workflows/poam-drift.yml mode change 100755 => 100644 .github/workflows/policy_compile.yml mode change 100755 => 100644 .github/workflows/publish-client-sdk.yml mode change 100755 => 100644 .github/workflows/regional-posture.yml mode change 100755 => 100644 .github/workflows/sbom.yml mode change 100755 => 100644 .github/workflows/security-scan.yml mode change 100755 => 100644 .github/workflows/test-hermetic.yml mode change 100755 => 100644 .github/workflows/tlc-model-check.yml diff --git a/.github/workflows/apac-mas-compliance.yml b/.github/workflows/apac-mas-compliance.yml old mode 100755 new mode 100644 index aa85100..3aabd59 --- a/.github/workflows/apac-mas-compliance.yml +++ b/.github/workflows/apac-mas-compliance.yml @@ -53,7 +53,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" diff --git a/.github/workflows/ci-integration.yml b/.github/workflows/ci-integration.yml old mode 100755 new mode 100644 index e8abfe7..ecfbabd --- a/.github/workflows/ci-integration.yml +++ b/.github/workflows/ci-integration.yml @@ -52,7 +52,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' - name: Install uv @@ -91,7 +91,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' - name: Install uv diff --git a/.github/workflows/ci-partner-integration.yml b/.github/workflows/ci-partner-integration.yml old mode 100755 new mode 100644 index 2fb7398..e6967bb --- a/.github/workflows/ci-partner-integration.yml +++ b/.github/workflows/ci-partner-integration.yml @@ -53,12 +53,12 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true @@ -124,7 +124,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: partner-integration-results path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml old mode 100755 new mode 100644 index 921cb54..63043ca --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -141,11 +141,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies @@ -183,11 +183,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies @@ -223,11 +223,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Check lockfile integrity @@ -292,7 +292,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "latest" - name: Install bare dependencies (no cloud extras) @@ -313,7 +313,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "latest" - name: Install dependencies @@ -333,11 +333,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies @@ -354,7 +354,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Install dependencies @@ -371,7 +371,7 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Check nemo-rails-configmap actions.py snapshot is current @@ -448,10 +448,10 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies @@ -470,7 +470,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Langfuse posture dry-run check @@ -503,7 +503,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Install PyYAML @@ -534,7 +534,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Install cyclonedx-py @@ -551,7 +551,7 @@ jobs: print(f'SBOM validated: {d.get(\"bomFormat\")} v{d.get(\"specVersion\")}') " - name: Upload SBOM artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sbom-${{ github.sha }} path: sbom.json @@ -573,11 +573,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies @@ -607,11 +607,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies @@ -642,7 +642,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Validate CBRN keyword list @@ -673,11 +673,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies @@ -705,11 +705,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies @@ -729,11 +729,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies diff --git a/.github/workflows/compliance-matrix.yml b/.github/workflows/compliance-matrix.yml old mode 100755 new mode 100644 index 510b39d..2d4040f --- a/.github/workflows/compliance-matrix.yml +++ b/.github/workflows/compliance-matrix.yml @@ -75,7 +75,7 @@ jobs: fetch-depth: 0 - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: ${{ env.PYTHON_VERSION }} cache: pip @@ -171,7 +171,7 @@ jobs: fetch-depth: 0 - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: ${{ env.PYTHON_VERSION }} cache: pip @@ -230,7 +230,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: compliance-results-${{ matrix.region }}-${{ matrix.environment }} path: | diff --git a/.github/workflows/eu-ecb-compliance.yml b/.github/workflows/eu-ecb-compliance.yml old mode 100755 new mode 100644 index 01cb56b..e504bc0 --- a/.github/workflows/eu-ecb-compliance.yml +++ b/.github/workflows/eu-ecb-compliance.yml @@ -53,7 +53,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" diff --git a/.github/workflows/license_guard.yml b/.github/workflows/license_guard.yml old mode 100755 new mode 100644 index fbcde33..59fe8cd --- a/.github/workflows/license_guard.yml +++ b/.github/workflows/license_guard.yml @@ -47,13 +47,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true cache-dependency-glob: "uv.lock" - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version-file: "pyproject.toml" diff --git a/.github/workflows/locust-nightly.yml b/.github/workflows/locust-nightly.yml old mode 100755 new mode 100644 index cadb52e..ad31a07 --- a/.github/workflows/locust-nightly.yml +++ b/.github/workflows/locust-nightly.yml @@ -53,11 +53,11 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies @@ -132,7 +132,7 @@ jobs: --p95-baseline-ms 2000 - name: Upload Locust report and gateway log if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: locust-report-${{ github.sha }} path: | diff --git a/.github/workflows/lula2-pr-compliance.yml b/.github/workflows/lula2-pr-compliance.yml old mode 100755 new mode 100644 index 7239a26..aedd0bd --- a/.github/workflows/lula2-pr-compliance.yml +++ b/.github/workflows/lula2-pr-compliance.yml @@ -55,7 +55,7 @@ jobs: fetch-depth: 0 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 with: node-version: "22" diff --git a/.github/workflows/poam-drift.yml b/.github/workflows/poam-drift.yml old mode 100755 new mode 100644 index b9d2426..6f1d19e --- a/.github/workflows/poam-drift.yml +++ b/.github/workflows/poam-drift.yml @@ -45,7 +45,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' - name: Run POAM drift check diff --git a/.github/workflows/policy_compile.yml b/.github/workflows/policy_compile.yml old mode 100755 new mode 100644 index 78a97cb..494c508 --- a/.github/workflows/policy_compile.yml +++ b/.github/workflows/policy_compile.yml @@ -57,12 +57,12 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "latest" @@ -129,7 +129,7 @@ jobs: continue-on-error: true - name: Upload generated artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: stpa-compiled-artifacts diff --git a/.github/workflows/publish-client-sdk.yml b/.github/workflows/publish-client-sdk.yml old mode 100755 new mode 100644 index a318b5a..f431f42 --- a/.github/workflows/publish-client-sdk.yml +++ b/.github/workflows/publish-client-sdk.yml @@ -35,12 +35,12 @@ jobs: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "latest" - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" diff --git a/.github/workflows/regional-posture.yml b/.github/workflows/regional-posture.yml old mode 100755 new mode 100644 index 1dfb65c..772a2da --- a/.github/workflows/regional-posture.yml +++ b/.github/workflows/regional-posture.yml @@ -60,10 +60,10 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install dependencies diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml old mode 100755 new mode 100644 index dfcde76..bf22ff0 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -169,7 +169,7 @@ jobs: STEPS_TAG_OUTPUTS_IMAGE_REF: ${{ steps.tag.outputs.IMAGE_REF }} - name: Upload SBOM as GitHub Artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sbom-${{ matrix.service.name }}-${{ github.sha }} path: sbom-${{ matrix.service.name }}.cdx.json diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml old mode 100755 new mode 100644 index d4820c7..54f6df2 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -63,12 +63,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" @@ -118,7 +118,7 @@ jobs: --output pip-audit-compliance-bridge.json || true - name: Upload pip-audit results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: pip-audit-results @@ -171,7 +171,7 @@ jobs: exit-code: "0" - name: Upload Trivy SARIF to GitHub Security - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 if: always() continue-on-error: true # Fixed: Code scanning not enabled on this private repo with: @@ -188,7 +188,7 @@ jobs: output: "sbom-${{ strategy.job-index }}.cdx.json" - name: Upload SBOM artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: sbom-${{ strategy.job-index }} @@ -264,7 +264,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" @@ -300,7 +300,7 @@ jobs: || echo "::warning::Syft dir scan encountered issues — check SBOM output" - name: Upload SBOM artifacts (90-day retention — POAM-006 evidence) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: sbom-${{ github.sha }} @@ -343,12 +343,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true @@ -387,7 +387,7 @@ jobs: wc -l dependency-snapshot.txt - name: Upload dependency snapshot artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: dependency-snapshot @@ -473,12 +473,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" @@ -497,12 +497,12 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: "3.11" diff --git a/.github/workflows/test-hermetic.yml b/.github/workflows/test-hermetic.yml old mode 100755 new mode 100644 index 1f79c32..d8ceb13 --- a/.github/workflows/test-hermetic.yml +++ b/.github/workflows/test-hermetic.yml @@ -48,7 +48,7 @@ jobs: persist-credentials: false - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' diff --git a/.github/workflows/tlc-model-check.yml b/.github/workflows/tlc-model-check.yml old mode 100755 new mode 100644 index 1cbaa73..bc28416 --- a/.github/workflows/tlc-model-check.yml +++ b/.github/workflows/tlc-model-check.yml @@ -40,10 +40,10 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: enable-cache: true - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version-file: "pyproject.toml" - name: Install Dependencies