From 434b878d04f1a6166a4114ee09d9a8aca246d6a7 Mon Sep 17 00:00:00 2001 From: GitHub Security Bot <88103841+github-security-bot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:28:18 -0400 Subject: [PATCH 1/4] Pin GitHub Actions to commit SHAs --- .github/workflows/fetch-licenses.yaml | 4 ++-- .github/workflows/lint.yaml | 4 ++-- .github/workflows/test.yaml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/fetch-licenses.yaml b/.github/workflows/fetch-licenses.yaml index 60e4e40..7af8c48 100644 --- a/.github/workflows/fetch-licenses.yaml +++ b/.github/workflows/fetch-licenses.yaml @@ -24,10 +24,10 @@ jobs: git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Checkout this repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Checkout official SPDX Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: repository: spdx/license-list-data path: official-spdx-licenses # creates a tmp dir to hold the SPDX licenses from the official repo diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 6d14e1a..c07331f 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -13,8 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.24.7" diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index c5957c6..8fc55d5 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -14,8 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "1.24.7" From b9e4ffe4091b899d25c47146185c0b7e16c5eee5 Mon Sep 17 00:00:00 2001 From: "E. Lynette Rayle" Date: Tue, 6 Oct 2026 09:47:36 -0400 Subject: [PATCH 2/4] Update checkout action to version 7.0.1 --- .github/workflows/fetch-licenses.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/fetch-licenses.yaml b/.github/workflows/fetch-licenses.yaml index 7af8c48..226ae9a 100644 --- a/.github/workflows/fetch-licenses.yaml +++ b/.github/workflows/fetch-licenses.yaml @@ -24,10 +24,10 @@ jobs: git config --global user.email "github-actions[bot]@users.noreply.github.com" - name: Checkout this repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout official SPDX Repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: spdx/license-list-data path: official-spdx-licenses # creates a tmp dir to hold the SPDX licenses from the official repo From d9743b35e4a40c2f11e5168d2775a2673c9e7f41 Mon Sep 17 00:00:00 2001 From: "E. Lynette Rayle" Date: Tue, 6 Oct 2026 09:51:15 -0400 Subject: [PATCH 3/4] Upgrade actions/checkout and actions/setup-go versions Updated action versions for checkout and setup-go. --- .github/workflows/lint.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index c07331f..6c84780 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -13,8 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.24.7" From ec76d7247f754119b06bd73367f8b34da2df2045 Mon Sep 17 00:00:00 2001 From: "E. Lynette Rayle" Date: Tue, 6 Oct 2026 09:51:40 -0400 Subject: [PATCH 4/4] Update GitHub Actions to use newer action versions --- .github/workflows/test.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 8fc55d5..d7a9860 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -14,8 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.24.7"