diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml index aa9aafe..4d2cd4c 100644 --- a/.github/workflows/iac-scan.yml +++ b/.github/workflows/iac-scan.yml @@ -48,7 +48,7 @@ jobs: persist-credentials: false - name: Checkov - uses: bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d # v12.3117.0 + uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8 # v12.3119.0 with: directory: ${{ inputs.directory }} framework: ${{ inputs.framework }} diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml index 017f2ad..8403287 100644 --- a/.github/workflows/java-ci.yml +++ b/.github/workflows/java-ci.yml @@ -64,7 +64,7 @@ jobs: - name: Set up Java if: ${{ !inputs.use_preinstalled_toolchain }} - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.distribution }} diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml index fcf4a35..2264487 100644 --- a/.github/workflows/kotlin-android-ci.yml +++ b/.github/workflows/kotlin-android-ci.yml @@ -74,7 +74,7 @@ jobs: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.java_distribution }} diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml index f224222..524b554 100644 --- a/.github/workflows/nddev-security-bundle.yml +++ b/.github/workflows/nddev-security-bundle.yml @@ -170,7 +170,7 @@ jobs: - name: Upload zizmor SARIF if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }} - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif category: zizmor diff --git a/.github/workflows/private-security-bundle-free.yml b/.github/workflows/private-security-bundle-free.yml index a2133b3..980438d 100644 --- a/.github/workflows/private-security-bundle-free.yml +++ b/.github/workflows/private-security-bundle-free.yml @@ -137,7 +137,7 @@ jobs: - name: Restore pinned uv archive if: ${{ steps.baked-uv.outputs.available != 'true' }} id: uv-archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68 @@ -160,7 +160,7 @@ jobs: printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH" - name: Restore actionlint archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 @@ -168,7 +168,7 @@ jobs: max-bytes: '16777216' - name: Restore OSV-Scanner binary - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64 sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c @@ -176,7 +176,7 @@ jobs: max-bytes: '268435456' - name: Restore gitleaks archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml index 06d5724..6dc7bf0 100644 --- a/.github/workflows/public-codeql.yml +++ b/.github/workflows/public-codeql.yml @@ -115,21 +115,21 @@ jobs: - name: Initialize CodeQL if: ${{ inputs.config_file == '' }} - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} - name: Initialize CodeQL with config if: ${{ inputs.config_file != '' }} - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} config-file: ${{ inputs.config_file }} - name: Autobuild if: ${{ inputs.autobuild && inputs.build_command == '' }} - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - name: Custom build if: ${{ inputs.build_command != '' }} @@ -139,13 +139,13 @@ jobs: - name: Analyze if: ${{ inputs.output_directory == '' }} - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: category: "/language:${{ matrix.language }}" - name: Analyze with output directory if: ${{ inputs.output_directory != '' }} - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: category: "/language:${{ matrix.language }}" output: ${{ inputs.output_directory }} diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml index e31c420..8428166 100644 --- a/.github/workflows/public-scorecard.yml +++ b/.github/workflows/public-scorecard.yml @@ -165,7 +165,7 @@ jobs: - name: Upload SARIF to code scanning id: upload-sarif if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }} - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif category: ${{ inputs.sarif_category }} diff --git a/.github/workflows/runtime-fixtures-languages.yml b/.github/workflows/runtime-fixtures-languages.yml index 0906288..07d40b4 100644 --- a/.github/workflows/runtime-fixtures-languages.yml +++ b/.github/workflows/runtime-fixtures-languages.yml @@ -586,7 +586,7 @@ jobs: with: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: '21' distribution: temurin diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml index 81c6d5a..d6382f9 100644 --- a/.github/workflows/rust-supply-chain.yml +++ b/.github/workflows/rust-supply-chain.yml @@ -97,7 +97,7 @@ jobs: with: persist-credentials: false - name: Install cargo-audit - uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20 # v2.86.2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: cargo-audit@${{ inputs.cargo_audit_version }} - name: Run cargo-audit @@ -116,7 +116,7 @@ jobs: with: persist-credentials: false - name: Install cargo-machete - uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20 # v2.86.2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: cargo-machete@${{ inputs.cargo_machete_version }} - name: Run cargo-machete diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml index 74bb015..9635a29 100644 --- a/.github/workflows/zizmor-sarif.yml +++ b/.github/workflows/zizmor-sarif.yml @@ -82,7 +82,7 @@ jobs: "${ZIZMOR_TARGET}" > zizmor.sarif - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: zizmor.sarif category: zizmor diff --git a/catalog/scorecard-evidence.yml b/catalog/scorecard-evidence.yml index d70f7f7..fa84c71 100644 --- a/catalog/scorecard-evidence.yml +++ b/catalog/scorecard-evidence.yml @@ -66,7 +66,7 @@ category_contract: guid: null source_urls: - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go - - https://github.com/github/codeql-action/blob/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd/src/upload-lib.ts + - https://github.com/github/codeql-action/blob/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28/src/upload-lib.ts - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning attempts: - attempt: 1 diff --git a/catalog/tools.yml b/catalog/tools.yml index 382fe96..4c55fba 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -114,14 +114,14 @@ tools: name: github/codeql-action homepage: "https://github.com/github/codeql-action" kind: action - current_version: "v4.37.7" - pin: "github/codeql-action@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" + current_version: "v4.37.8" + pin: "github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28" used_by: - .github/workflows/nddev-security-bundle.yml - .github/workflows/public-codeql.yml - .github/workflows/public-scorecard.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-07-12" + last_verified: "2026-09-01" - id: dependency-review-action name: actions/dependency-review-action @@ -458,11 +458,11 @@ tools: name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3117.0" - pin: "bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d" + current_version: "v12.3119.0" + pin: "bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8" used_by: - .github/workflows/iac-scan.yml - last_verified: "2026-07-25" + last_verified: "2026-09-01" - id: github-action-benchmark name: benchmark-action/github-action-benchmark @@ -524,11 +524,11 @@ tools: name: NDDev-OpenNetwork/github-actions/actions/tool-cache homepage: "https://github.com/NDDev-OpenNetwork/github-actions/tree/main/actions/tool-cache" kind: action - current_version: "v1.0.1" - pin: "NDDev-OpenNetwork/github-actions@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad" + current_version: "v1.2.0" + pin: "NDDev-OpenNetwork/github-actions@468af475a08210020502f74588b2c98ba4c01696" used_by: - .github/workflows/private-security-bundle-free.yml - last_verified: "2026-08-23" + last_verified: "2026-09-01" notes: >- Signed tag v1.0.1 resolves to the exact pinned repository commit and mirrors structured fetch evidence into the runner diagnostic bundle. @@ -589,13 +589,13 @@ tools: name: actions/setup-java homepage: "https://github.com/actions/setup-java" kind: action - current_version: "v5.7.0" - pin: "actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961" + current_version: "v6.0.0" + pin: "actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c" used_by: - .github/workflows/java-ci.yml - .github/workflows/kotlin-android-ci.yml - .github/workflows/runtime-fixtures-languages.yml - last_verified: "2026-07-25" + last_verified: "2026-09-01" - id: setup-terraform name: hashicorp/setup-terraform @@ -636,11 +636,11 @@ tools: name: taiki-e/install-action homepage: "https://github.com/taiki-e/install-action" kind: action - current_version: "v2.86.2" - pin: "taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20" + current_version: "v2.86.7" + pin: "taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc" used_by: - .github/workflows/rust-supply-chain.yml - last_verified: "2026-08-12" + last_verified: "2026-09-01" # Upstream tags no release, so the pin comment carries the commit date rather # than a version. Bump it by picking a newer commit deliberately, not by