From 752da6f1f1324931d5dc79dce1fb525a0503b6e3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 11:31:10 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions group across 1 directory with 8 updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3117.0` | `12.3119.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.37.8` | | [NDDev-OpenNetwork/github-actions/actions/tool-cache](https://github.com/nddev-opennetwork/github-actions) | `1.0.1` | `1.2.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.7` | `4.37.8` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.7` | `4.37.8` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.7` | `4.37.8` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.86.2` | `2.86.7` | Updates `bridgecrewio/checkov-action` from 12.3117.0 to 12.3119.0 - [Release notes](https://github.com/bridgecrewio/checkov-action/releases) - [Commits](https://github.com/bridgecrewio/checkov-action/compare/1246d92f57abae29d5db5f9aeeed2a9813e52d7d...59b9d7edfcad5b87fbe3f473a9a134a721ad03f8) Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) Updates `NDDev-OpenNetwork/github-actions/actions/tool-cache` from 1.0.1 to 1.2.0 - [Release notes](https://github.com/nddev-opennetwork/github-actions/releases) - [Changelog](https://github.com/NDDev-OpenNetwork/github-actions/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-opennetwork/github-actions/compare/470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad...468af475a08210020502f74588b2c98ba4c01696) Updates `github/codeql-action/init` from 4.37.7 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) Updates `github/codeql-action/autobuild` from 4.37.7 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) Updates `github/codeql-action/analyze` from 4.37.7 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) Updates `taiki-e/install-action` from 2.86.2 to 2.86.7 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/b6b84cf49ebfe0176417bdce007c624f0db37f20...b6ff580856c41316412a0b9b60540fbc6f8c82cc) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: bridgecrewio/checkov-action dependency-version: 12.3119.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: NDDev-OpenNetwork/github-actions/actions/tool-cache dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.86.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/iac-scan.yml | 2 +- .github/workflows/java-ci.yml | 2 +- .github/workflows/kotlin-android-ci.yml | 2 +- .github/workflows/nddev-security-bundle.yml | 2 +- .github/workflows/private-security-bundle-free.yml | 8 ++++---- .github/workflows/public-codeql.yml | 10 +++++----- .github/workflows/public-scorecard.yml | 2 +- .github/workflows/runtime-fixtures-languages.yml | 2 +- .github/workflows/rust-supply-chain.yml | 4 ++-- .github/workflows/zizmor-sarif.yml | 2 +- 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml index aa9aafe..4d2cd4c 100644 --- a/.github/workflows/iac-scan.yml +++ b/.github/workflows/iac-scan.yml @@ -48,7 +48,7 @@ jobs: persist-credentials: false - name: Checkov - uses: bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d # v12.3117.0 + uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8 # v12.3119.0 with: directory: ${{ inputs.directory }} framework: ${{ inputs.framework }} diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml index 017f2ad..8403287 100644 --- a/.github/workflows/java-ci.yml +++ b/.github/workflows/java-ci.yml @@ -64,7 +64,7 @@ jobs: - name: Set up Java if: ${{ !inputs.use_preinstalled_toolchain }} - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.distribution }} diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml index fcf4a35..2264487 100644 --- a/.github/workflows/kotlin-android-ci.yml +++ b/.github/workflows/kotlin-android-ci.yml @@ -74,7 +74,7 @@ jobs: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.java_distribution }} diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml index f224222..524b554 100644 --- a/.github/workflows/nddev-security-bundle.yml +++ b/.github/workflows/nddev-security-bundle.yml @@ -170,7 +170,7 @@ jobs: - name: Upload zizmor SARIF if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }} - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif category: zizmor diff --git a/.github/workflows/private-security-bundle-free.yml b/.github/workflows/private-security-bundle-free.yml index a2133b3..980438d 100644 --- a/.github/workflows/private-security-bundle-free.yml +++ b/.github/workflows/private-security-bundle-free.yml @@ -137,7 +137,7 @@ jobs: - name: Restore pinned uv archive if: ${{ steps.baked-uv.outputs.available != 'true' }} id: uv-archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68 @@ -160,7 +160,7 @@ jobs: printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH" - name: Restore actionlint archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 @@ -168,7 +168,7 @@ jobs: max-bytes: '16777216' - name: Restore OSV-Scanner binary - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64 sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c @@ -176,7 +176,7 @@ jobs: max-bytes: '268435456' - name: Restore gitleaks archive - uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad # v1.0.1 + uses: NDDev-OpenNetwork/github-actions/actions/tool-cache@468af475a08210020502f74588b2c98ba4c01696 # v1.2.0 with: url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml index 06d5724..6dc7bf0 100644 --- a/.github/workflows/public-codeql.yml +++ b/.github/workflows/public-codeql.yml @@ -115,21 +115,21 @@ jobs: - name: Initialize CodeQL if: ${{ inputs.config_file == '' }} - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} - name: Initialize CodeQL with config if: ${{ inputs.config_file != '' }} - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} config-file: ${{ inputs.config_file }} - name: Autobuild if: ${{ inputs.autobuild && inputs.build_command == '' }} - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - name: Custom build if: ${{ inputs.build_command != '' }} @@ -139,13 +139,13 @@ jobs: - name: Analyze if: ${{ inputs.output_directory == '' }} - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: category: "/language:${{ matrix.language }}" - name: Analyze with output directory if: ${{ inputs.output_directory != '' }} - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: category: "/language:${{ matrix.language }}" output: ${{ inputs.output_directory }} diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml index e31c420..8428166 100644 --- a/.github/workflows/public-scorecard.yml +++ b/.github/workflows/public-scorecard.yml @@ -165,7 +165,7 @@ jobs: - name: Upload SARIF to code scanning id: upload-sarif if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }} - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: results.sarif category: ${{ inputs.sarif_category }} diff --git a/.github/workflows/runtime-fixtures-languages.yml b/.github/workflows/runtime-fixtures-languages.yml index 0906288..07d40b4 100644 --- a/.github/workflows/runtime-fixtures-languages.yml +++ b/.github/workflows/runtime-fixtures-languages.yml @@ -586,7 +586,7 @@ jobs: with: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: '21' distribution: temurin diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml index 81c6d5a..d6382f9 100644 --- a/.github/workflows/rust-supply-chain.yml +++ b/.github/workflows/rust-supply-chain.yml @@ -97,7 +97,7 @@ jobs: with: persist-credentials: false - name: Install cargo-audit - uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20 # v2.86.2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: cargo-audit@${{ inputs.cargo_audit_version }} - name: Run cargo-audit @@ -116,7 +116,7 @@ jobs: with: persist-credentials: false - name: Install cargo-machete - uses: taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20 # v2.86.2 + uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2.86.7 with: tool: cargo-machete@${{ inputs.cargo_machete_version }} - name: Run cargo-machete diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml index 74bb015..9635a29 100644 --- a/.github/workflows/zizmor-sarif.yml +++ b/.github/workflows/zizmor-sarif.yml @@ -82,7 +82,7 @@ jobs: "${ZIZMOR_TARGET}" > zizmor.sarif - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: zizmor.sarif category: zizmor From 73598dc1c06c8b08d1852c5e4d52eefeb551685d Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 1 Sep 2026 13:05:25 +0500 Subject: [PATCH 2/2] chore(catalog): the pin registry moves with the bump Dependabot moved eight actions and the tool registry, the catalog pins and the scorecard authority link stayed behind, which is exactly what the tool-registry, catalog and scorecard-evidence validators are for. The five registry entries follow the workflows byte-for-byte, the codeql-action authority blob link moves to the pinned commit, and generated docs follow. The updater owing this automatically stays on the estate ledger. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF --- catalog/scorecard-evidence.yml | 2 +- catalog/tools.yml | 30 +++++++++++++++--------------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/catalog/scorecard-evidence.yml b/catalog/scorecard-evidence.yml index d70f7f7..fa84c71 100644 --- a/catalog/scorecard-evidence.yml +++ b/catalog/scorecard-evidence.yml @@ -66,7 +66,7 @@ category_contract: guid: null source_urls: - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go - - https://github.com/github/codeql-action/blob/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd/src/upload-lib.ts + - https://github.com/github/codeql-action/blob/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28/src/upload-lib.ts - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning attempts: - attempt: 1 diff --git a/catalog/tools.yml b/catalog/tools.yml index 382fe96..4c55fba 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -114,14 +114,14 @@ tools: name: github/codeql-action homepage: "https://github.com/github/codeql-action" kind: action - current_version: "v4.37.7" - pin: "github/codeql-action@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" + current_version: "v4.37.8" + pin: "github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28" used_by: - .github/workflows/nddev-security-bundle.yml - .github/workflows/public-codeql.yml - .github/workflows/public-scorecard.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-07-12" + last_verified: "2026-09-01" - id: dependency-review-action name: actions/dependency-review-action @@ -458,11 +458,11 @@ tools: name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3117.0" - pin: "bridgecrewio/checkov-action@1246d92f57abae29d5db5f9aeeed2a9813e52d7d" + current_version: "v12.3119.0" + pin: "bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8" used_by: - .github/workflows/iac-scan.yml - last_verified: "2026-07-25" + last_verified: "2026-09-01" - id: github-action-benchmark name: benchmark-action/github-action-benchmark @@ -524,11 +524,11 @@ tools: name: NDDev-OpenNetwork/github-actions/actions/tool-cache homepage: "https://github.com/NDDev-OpenNetwork/github-actions/tree/main/actions/tool-cache" kind: action - current_version: "v1.0.1" - pin: "NDDev-OpenNetwork/github-actions@470c95c3e7cd1f9a0d763f3f6d7f43024f8451ad" + current_version: "v1.2.0" + pin: "NDDev-OpenNetwork/github-actions@468af475a08210020502f74588b2c98ba4c01696" used_by: - .github/workflows/private-security-bundle-free.yml - last_verified: "2026-08-23" + last_verified: "2026-09-01" notes: >- Signed tag v1.0.1 resolves to the exact pinned repository commit and mirrors structured fetch evidence into the runner diagnostic bundle. @@ -589,13 +589,13 @@ tools: name: actions/setup-java homepage: "https://github.com/actions/setup-java" kind: action - current_version: "v5.7.0" - pin: "actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961" + current_version: "v6.0.0" + pin: "actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c" used_by: - .github/workflows/java-ci.yml - .github/workflows/kotlin-android-ci.yml - .github/workflows/runtime-fixtures-languages.yml - last_verified: "2026-07-25" + last_verified: "2026-09-01" - id: setup-terraform name: hashicorp/setup-terraform @@ -636,11 +636,11 @@ tools: name: taiki-e/install-action homepage: "https://github.com/taiki-e/install-action" kind: action - current_version: "v2.86.2" - pin: "taiki-e/install-action@b6b84cf49ebfe0176417bdce007c624f0db37f20" + current_version: "v2.86.7" + pin: "taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc" used_by: - .github/workflows/rust-supply-chain.yml - last_verified: "2026-08-12" + last_verified: "2026-09-01" # Upstream tags no release, so the pin comment carries the commit date rather # than a version. Bump it by picking a newer commit deliberately, not by