From 7382891cc41f1d9576644b557e32af5dbf9d8e47 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 22:36:31 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 6 updates Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/setup-python](https://github.com/actions/setup-python) | `7.0.0` | `7.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.39.1` | Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/5fda3b95a4ea91299a34e894583c3862153e4b97...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `github/codeql-action/init` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.38.2 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/assessment-capacity.yml | 30 +++---- .github/workflows/capacity-certification.yml | 82 +++++++++---------- .../workflows/capacity-safe-verification.yml | 4 +- .github/workflows/ci.yml | 16 ++-- .github/workflows/deploy-production.yml | 2 +- .github/workflows/public-capacity-load.yml | 4 +- .github/workflows/security.yml | 8 +- 7 files changed, 73 insertions(+), 73 deletions(-) diff --git a/.github/workflows/assessment-capacity.yml b/.github/workflows/assessment-capacity.yml index bc32cd0b..db3dd9c7 100644 --- a/.github/workflows/assessment-capacity.yml +++ b/.github/workflows/assessment-capacity.yml @@ -83,7 +83,7 @@ jobs: --arg region "$CLIENT_REGION" --argjson start "$start_epoch" \ '{runId:$run,releaseSha:$sha,clientRegion:$region,startEpoch:$start,administrationId:.administrationId,publicId:.publicId,tileUrl:.tileUrl}' \ artifacts/assessment-capacity/fixture.json > artifacts/assessment-capacity/client-handoff.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-fixture, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -112,7 +112,7 @@ jobs: --release-sha "${{ inputs.release_sha }}" \ --start-epoch "${{ needs.provision-campaign.outputs.start_epoch }}" \ --output artifacts/assessment-capacity/observer.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-observer, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -146,7 +146,7 @@ jobs: export TILE_URL="${BASE_URL}${TILE_PATH}" mkdir -p artifacts/assessment-capacity k6 run tests/load/assessment-500.js - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: assessment-shard-${{ matrix.shard }} @@ -173,7 +173,7 @@ jobs: --public-id "${{ needs.provision-campaign.outputs.public_id }}" --start-epoch "${{ needs.provision-campaign.outputs.start_epoch }}" --output-dir artifacts/assessment-capacity - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-regional-measurements, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -196,7 +196,7 @@ jobs: --base-url "$CAPACITY_BASE_URL" --administration-id "${{ needs.provision-campaign.outputs.administration_id }}" --output-dir artifacts/assessment-capacity - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-campaign-cleanup, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -238,7 +238,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: { ref: "${{ inputs.release_sha }}", persist-credentials: false } - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: { node-version: "24.14.0", cache: pnpm } - run: pnpm install --frozen-lockfile - run: pnpm --dir apps/web exec playwright install --with-deps chromium @@ -249,7 +249,7 @@ jobs: ASSESSMENT_CANARY_ACCESS_CODE: ${{ secrets.ASSESSMENT_CAPACITY_ACCESS_CODE }} ASSESSMENT_CANARY_IDENTIFIER: ${{ needs.provision-canary.outputs.identifier }} run: pnpm --dir apps/web exec playwright test --config playwright.assessment-capacity.config.ts - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-browser-canary, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -262,10 +262,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: { ref: "${{ inputs.release_sha }}", persist-credentials: false } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { name: assessment-browser-canary, path: artifacts/browser } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { name: assessment-campaign-cleanup, path: artifacts/campaign } - name: Materialize fail-closed placeholders without bypassing cleanup @@ -284,7 +284,7 @@ jobs: --browser-evidence artifacts/browser/canaries-browser.json --campaign-validation artifacts/campaign/campaign-validation.json --output-dir artifacts/assessment-capacity - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-final-cleanup, path: artifacts/assessment-capacity/, if-no-files-found: error } @@ -296,16 +296,16 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: { ref: "${{ inputs.release_sha }}", persist-credentials: false } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { pattern: assessment-shard-*, path: artifacts/all, merge-multiple: true } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { name: assessment-observer, path: artifacts/all } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { name: assessment-regional-measurements, path: artifacts/all } - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: { name: assessment-final-cleanup, path: artifacts/all } - name: Close evidence fail-closed @@ -316,7 +316,7 @@ jobs: --artifacts artifacts/all --release-sha "${{ inputs.release_sha }}" --client-region "${{ inputs.client_region || 'github-hosted' }}" --run-id "$GITHUB_RUN_ID" --output artifacts/final/assessment-500-evidence.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: { name: assessment-500-evidence, path: artifacts/final/, if-no-files-found: error } - name: Reject partial, negative or non-evaluable closure diff --git a/.github/workflows/capacity-certification.yml b/.github/workflows/capacity-certification.yml index 5cb46905..da8fe28a 100644 --- a/.github/workflows/capacity-certification.yml +++ b/.github/workflows/capacity-certification.yml @@ -43,7 +43,7 @@ jobs: with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install locked OCI dependencies @@ -129,13 +129,13 @@ jobs: curl --fail --silent --show-error --max-time 15 \ "${CAPACITY_BASE_URL%/}/api/v1/public/slides/${LOAD_TEST_PUBLIC_ID}" >/dev/null rm -f -- "${cookie_jar}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-plan path: ${{ runner.temp }}/capacity-plan.json if-no-files-found: error retention-days: 1 - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-browser-matrix path: ${{ runner.temp }}/browser-matrix.json @@ -213,7 +213,7 @@ jobs: "${RUNNER_TEMP}/capacity-recovery.json" >/dev/null - name: Retain the exact failed-run recovery receipt if: always() && inputs.recovery_run_id != '' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-recovery path: ${{ runner.temp }}/capacity-recovery.json @@ -246,7 +246,7 @@ jobs: .annotationsEnabled == false and (.runtimeManifestDigest | test("^[0-9a-f]{64}$"))' \ "${RUNNER_TEMP}/capacity-runtime-preflight.json" >/dev/null - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-runtime-preflight path: ${{ runner.temp }}/capacity-runtime-preflight.json @@ -325,7 +325,7 @@ jobs: computeOcpus:$ocpus,memoryGb:$memory,storageGb:$storage}' \ > "${RUNNER_TEMP}/capacity-accounting.json" rm -f -- "${RUNNER_TEMP}"/oci-*-private.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-accounting path: ${{ runner.temp }}/capacity-accounting.json @@ -352,10 +352,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: capacity-plan, path: "${{ runner.temp }}/capacity-plan"} - name: Create and encrypt exact run-owned fixtures env: @@ -391,13 +391,13 @@ jobs: prepared:true,encrypted:true,syntheticOnly:true,identifiersIncluded:false, endpointsValidated:4}' > "${RUNNER_TEMP}/capacity-fixture-status.json" trap - ERR INT TERM - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-fixtures-private path: ${{ runner.temp }}/capacity-fixtures.fernet if-no-files-found: error retention-days: 14 - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-fixture-status path: ${{ runner.temp }}/capacity-fixture-status.json @@ -429,10 +429,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {pattern: "capacity-*", path: "${{ runner.temp }}/evidence", merge-multiple: true} - name: Configure pinned OCI access env: @@ -515,7 +515,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - name: Cancel this attempt when a capacity shard cannot succeed env: @@ -549,14 +549,14 @@ jobs: with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: capacity-plan path: ${{ runner.temp }}/capacity-plan - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: capacity-fixtures-private path: ${{ runner.temp }}/capacity-fixtures-private @@ -632,14 +632,14 @@ jobs: done test "$(cat "${RUNNER_TEMP}/capacity-observer.status")" = 0 test -s "${RUNNER_TEMP}/capacity-host-samples.jsonl" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-shard-${{ matrix.shard-index }} path: ${{ runner.temp }}/shard-${{ matrix.shard-index }}.json if-no-files-found: error retention-days: 1 - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() && matrix.shard-index == 0 with: name: capacity-observer @@ -660,11 +660,11 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: capacity-plan, path: "${{ runner.temp }}/capacity-plan"} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: capacity-fixtures-private, path: "${{ runner.temp }}/capacity-fixtures-private"} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - name: Materialize exact run-owned sentinel fixtures @@ -683,7 +683,7 @@ jobs: echo "CAPACITY_SHARE_TARGET_ID=$(jq -er .shareTargetId "${RUNNER_TEMP}/capacity-fixtures/sentinels.json")" >> "${GITHUB_ENV}" echo "CAPACITY_DYNAMIC_PUBLIC_ID=$(jq -er .dynamicPublicId "${RUNNER_TEMP}/capacity-fixtures/sentinels.json")" >> "${GITHUB_ENV}" - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: "24.14.0", cache: pnpm} - run: pnpm install --frozen-lockfile - run: pnpm --dir apps/web exec playwright install --with-deps chromium firefox webkit @@ -709,7 +709,7 @@ jobs: echo "::add-mask::${CAPACITY_CLASSROOM_SESSION_ID}" printf '{}\n' > "${CAPACITY_SENTINEL_RESULT}" bash deploy/scripts/run-capacity-sentinels.sh "${RUNNER_TEMP}/capacity-plan/capacity-plan.json" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-sentinels @@ -728,11 +728,11 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: capacity-plan, path: "${{ runner.temp }}/capacity-plan"} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {name: capacity-fixtures-private, path: "${{ runner.temp }}/capacity-fixtures-private"} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - name: Materialize exact run-owned recovery fixture @@ -770,7 +770,7 @@ jobs: export CAPACITY_CLASSROOM_SESSION_ID="$(jq -er '."recovery-1200".sessionId' "${RUNNER_TEMP}/stage-manifest.json")" echo "::add-mask::${CAPACITY_CLASSROOM_SESSION_ID}" bash deploy/scripts/run-capacity-fault-recovery.sh "${RUNNER_TEMP}/capacity-plan/capacity-plan.json" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-fault @@ -790,9 +790,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {pattern: "capacity-*", path: "${{ runner.temp }}/evidence", merge-multiple: true} - name: Require and merge every shard before selecting a tier id: merge @@ -850,7 +850,7 @@ jobs: --signature-output "${RUNNER_TEMP}/capacity-decision.json.sig" fi rm -f -- "${key}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-decision @@ -870,10 +870,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {pattern: "capacity-*", path: "${{ runner.temp }}/evidence", merge-multiple: true} - name: Configure pinned OCI access env: @@ -905,7 +905,7 @@ jobs: "${RUNNER_TEMP}/evidence/capacity-decision.json" \ "${RUNNER_TEMP}/evidence/capacity-decision.json.sig" \ "${RUNNER_TEMP}/evidence/capacity-sentinel.json" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-cleanup @@ -927,10 +927,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - run: pip install --require-hashes -r deploy/oci-cli-requirements.txt - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: {pattern: "capacity-*", path: "${{ runner.temp }}/evidence", merge-multiple: true} - name: Configure pinned OCI access env: @@ -999,7 +999,7 @@ jobs: test "$(jq -r .finalCapacity "${RUNNER_TEMP}/capacity-postflight.json")" = 300 test "$(jq -r .annotationsEnabled "${RUNNER_TEMP}/capacity-postflight.json")" = false python tests/load/validate_postflight_evidence.py "${RUNNER_TEMP}/capacity-postflight.json" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: {name: capacity-postflight, path: "${{ runner.temp }}/capacity-postflight.json", if-no-files-found: error, retention-days: 1} - if: always() @@ -1015,9 +1015,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: {python-version: "3.12"} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: capacity-* path: ${{ runner.temp }}/evidence @@ -1097,7 +1097,7 @@ jobs: --output-json "${RUNNER_TEMP}/capacity-certification.json" \ --output-markdown "${RUNNER_TEMP}/capacity-certification.md" rm -f -- "${key}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: capacity-certification-${{ github.sha }} path: | @@ -1115,7 +1115,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: {ref: "${{ github.sha }}", persist-credentials: false} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: {pattern: "capacity-*", path: "${{ runner.temp }}/evidence", merge-multiple: true} - name: Write compact terminal status @@ -1134,7 +1134,7 @@ jobs: jq '{state,releaseSha,failureCode,restorationState,fixtureCount, runOwnedBastionCount,progressCounters}' "${RUNNER_TEMP}/capacity-status.json" \ >> "${GITHUB_STEP_SUMMARY}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-terminal-status diff --git a/.github/workflows/capacity-safe-verification.yml b/.github/workflows/capacity-safe-verification.yml index beab8d36..17c0bd70 100644 --- a/.github/workflows/capacity-safe-verification.yml +++ b/.github/workflows/capacity-safe-verification.yml @@ -50,7 +50,7 @@ jobs: with: ref: ${{ github.sha }} persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Install locked verification dependencies @@ -95,7 +95,7 @@ jobs: OCI_TARGET_PRIVATE_IP: ${{ vars.OCI_TARGET_PRIVATE_IP }} OCI_KNOWN_HOSTS_FILE: /home/runner/.ssh/known_hosts run: bash deploy/scripts/run-capacity-safe-verification.sh - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: capacity-safe-${{ inputs.mode }}-${{ github.run_id }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index eb3d2c56..16878d05 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ jobs: with: persist-credentials: false fetch-depth: 0 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: { python-version: "3.12" } - name: Check public repository content and new history env: @@ -153,7 +153,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: { python-version: "3.12" } - name: Install tests with the production SQLAlchemy version run: pip install -e .[dev] "$(sed -n 's/^\(sqlalchemy==[0-9.]*\).*/\1/p' deploy/backend-requirements.txt)" @@ -269,7 +269,7 @@ jobs: persist-credentials: false fetch-depth: 0 - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: { node-version: "24.14.0", cache: pnpm } - run: pnpm install --frozen-lockfile - run: pnpm --dir apps/web lint @@ -329,7 +329,7 @@ jobs: with: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: { node-version: "24.14.0", cache: pnpm } - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: @@ -362,7 +362,7 @@ jobs: --workers=2 - name: Retain browser failure diagnostics if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: browser-failure-diagnostics path: apps/web/test-results/ @@ -376,10 +376,10 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: { python-version: "3.12" } - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: { node-version: "24.14.0", cache: pnpm } - name: Install native test services at repository runtime versions run: | @@ -397,7 +397,7 @@ jobs: run: python scripts/run_fullstack_tests.py --report-dir "${RUNNER_TEMP}/fullstack-evidence" - name: Retain synthetic full-stack diagnostics if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: fullstack-synthetic-diagnostics path: ${{ runner.temp }}/fullstack-evidence/ diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 95574d69..86bb6b93 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -58,7 +58,7 @@ jobs: fi done - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" diff --git a/.github/workflows/public-capacity-load.yml b/.github/workflows/public-capacity-load.yml index d2232e8c..d9fda19a 100644 --- a/.github/workflows/public-capacity-load.yml +++ b/.github/workflows/public-capacity-load.yml @@ -41,7 +41,7 @@ jobs: echo "::add-mask::${MASK_PRODUCTION_BASE_URL}" fi - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" @@ -111,7 +111,7 @@ jobs: - name: Upload sanitized load evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: public-capacity-load-${{ github.sha }} path: ${{ env.EVIDENCE_DIR }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c0622b2d..243f644a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" - name: Check public repository content @@ -39,7 +39,7 @@ jobs: pip-audit --strict --progress-spinner off . pip-audit --strict --progress-spinner off --disable-pip --require-hashes -r deploy/oci-cli-requirements.txt - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24.14.0" cache: pnpm @@ -61,8 +61,8 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: languages: ${{ matrix.language }} build-mode: none - - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4