From 5c467fc051b23283b8c14c4540b2c9ee2273416d Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Tue, 28 Jul 2026 08:48:48 +0100 Subject: [PATCH] chore(deps): bump checkout, setup-go, attest in workflows and templates Dependabot bumped actions/checkout 7.0.0->7.0.1, actions/setup-go 6->7.0.0, and actions/attest 4.1.1->4.2.0 (PRs #159/#160/#161), but edits only the live workflows. TestSelfScaffoldParity requires the committed release.yml/auto-release.yml to be byte-identical to the scaffold templates (itd-93 Branch A), so a live-only bump breaks the build. This bumps both the live workflows and the scaffold templates together, keeping parity. Supersedes #159, #160, #161. Assisted-by: Claude:claude-fable-5 --- .github/workflows/auto-release.yml | 4 ++-- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/release.yml | 14 +++++++------- .../scaffold/templates/auto-release.yml.tmpl | 4 ++-- .../launch/scaffold/templates/release.yml.tmpl | 14 +++++++------- 5 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 171f3af0..ac46c1ea 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -48,7 +48,7 @@ jobs: release_ref: ${{ steps.detect.outputs.release_ref }} steps: - name: Check out the pushed commit (full history + tags) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch-depth: 0 pulls every tag so the existence check below is # authoritative; a shallow clone would omit tags and mis-report. @@ -122,7 +122,7 @@ jobs: contents: write # push the new tag ref steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha = this main push's HEAD, the immutable commit to tag. ref: ${{ github.sha }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb2e4dbd..cbe480c5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,12 +27,12 @@ jobs: os: [ubuntu-latest, macos-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.25' @@ -86,7 +86,7 @@ jobs: env: GITLEAKS_VERSION: 8.24.3 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -112,7 +112,7 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Audit workflows @@ -131,7 +131,7 @@ jobs: timeout-minutes: 5 runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -147,11 +147,11 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.25' - name: Smoke every command diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f7f650cc..7aa1e0c1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -75,7 +75,7 @@ jobs: contents: read steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha, not the tag ref: checkout re-resolves a NAMED ref at each # job's start, so a tag moved after the push could differ here. The sha is @@ -90,7 +90,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.25' # cache: false — this workflow is tag-triggered; module caching in a @@ -148,7 +148,7 @@ jobs: attestations: write # publish the build-provenance attestations (public repo) steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha (the commit the pushed tag pointed at), not the tag NAME and # not the default-branch tip, so the binaries below are built from the exact @@ -178,7 +178,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.25' cache: false @@ -245,7 +245,7 @@ jobs: - name: Attest the semantic-gate receipts (signed release provenance) if: ${{ !github.event.repository.private }} - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: .abcd/work/reviews/${{ env.CONTENT_SHA }}/*.json predicate-type: https://abcd.dev/attestations/semantic-release-gate/v1 @@ -371,7 +371,7 @@ jobs: contents: read steps: - name: Check out (full history) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full history so the content-commit resolution below can walk parents, # exactly as release.yml's semantic gate does. @@ -379,7 +379,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.25' cache: false diff --git a/internal/core/launch/scaffold/templates/auto-release.yml.tmpl b/internal/core/launch/scaffold/templates/auto-release.yml.tmpl index 1754245a..8ae65b52 100644 --- a/internal/core/launch/scaffold/templates/auto-release.yml.tmpl +++ b/internal/core/launch/scaffold/templates/auto-release.yml.tmpl @@ -48,7 +48,7 @@ jobs: release_ref: ${{ steps.detect.outputs.release_ref }} steps: - name: Check out the pushed commit (full history + tags) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # fetch-depth: 0 pulls every tag so the existence check below is # authoritative; a shallow clone would omit tags and mis-report. @@ -122,7 +122,7 @@ jobs: contents: write # push the new tag ref steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha = this main push's HEAD, the immutable commit to tag. ref: ${{ github.sha }} diff --git a/internal/core/launch/scaffold/templates/release.yml.tmpl b/internal/core/launch/scaffold/templates/release.yml.tmpl index bb990db5..2c6d3014 100644 --- a/internal/core/launch/scaffold/templates/release.yml.tmpl +++ b/internal/core/launch/scaffold/templates/release.yml.tmpl @@ -92,7 +92,7 @@ jobs: contents: read steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha, not the tag ref: checkout re-resolves a NAMED ref at each # job's start, so a tag moved after the push could differ here. The sha is @@ -111,7 +111,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '<% .GoVersion %>' # cache: false — this workflow is tag-triggered; module caching in a @@ -166,7 +166,7 @@ jobs: <%- end %> steps: - name: Check out the pushed commit - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # github.sha (the commit the pushed tag pointed at), not the tag NAME and # not the default-branch tip, so the binaries below are built from the exact @@ -200,7 +200,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '<% .GoVersion %>' cache: false @@ -267,7 +267,7 @@ jobs: - name: Attest the semantic-gate receipts (signed release provenance) if: ${{ !github.event.repository.private }} - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: .abcd/work/reviews/${{ env.CONTENT_SHA }}/*.json predicate-type: https://abcd.dev/attestations/semantic-release-gate/v1 @@ -407,7 +407,7 @@ jobs: contents: read steps: - name: Check out (full history) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full history so the content-commit resolution below can walk parents, # exactly as release.yml's semantic gate does. @@ -415,7 +415,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '<% .GoVersion %>' cache: false