From 3d6a5820ddd58f309f2f345b25ba9ee0a5ca69c7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 16:53:35 +0000 Subject: [PATCH] chore(deps): bump the github-actions group across 1 directory with 15 updates Bumps the github-actions group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [attested-delivery/.github/.github/actions/plugin-catalog-update](https://github.com/attested-delivery/.github) | `0.1.1` | `0.1.2` | | [attested-delivery/.github/.github/workflows/pin-check.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-actionlint.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-sca-osv.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-trivy.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-scorecard.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-shellcheck.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-semgrep.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-secrets.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-manifest-review.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.1.1` | | [attested-delivery/.github/.github/workflows/reusable-attest-scan.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | | [attested-delivery/.github/.github/workflows/reusable-vex.yml](https://github.com/attested-delivery/.github) | `0.1.0` | `0.1.2` | Updates `attested-delivery/.github/.github/actions/plugin-catalog-update` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/36cdbd7d75865b88e8beec4813c1d3587fa98644...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/pin-check.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-actionlint.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-sca-osv.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-trivy.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-scorecard.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-shellcheck.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-semgrep.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-secrets.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-manifest-review.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32...0f67c3f4856b2e3261c31976d6725780e5e4c373) Updates `attested-delivery/.github/.github/workflows/reusable-attest-scan.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) Updates `attested-delivery/.github/.github/workflows/reusable-vex.yml` from 0.1.0 to 0.1.2 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/compare/f211de97395ced798da52e28d89d79c22b3020ee...508aa7a385d3f6776feb175e40b3a0e9f08402c4) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/actions/plugin-catalog-update dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/pin-check.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-actionlint.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-manifest-review.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-sca-osv.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-scorecard.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-secrets.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-semgrep.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-shellcheck.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-trivy.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-vex.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/catalog-admission.yml | 2 +- .github/workflows/ci.yml | 4 +-- .github/workflows/quality-gates.yml | 16 ++++++------ .github/workflows/release.yml | 34 ++++++++++++------------- 4 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/catalog-admission.yml b/.github/workflows/catalog-admission.yml index 12ca9a2..62fca87 100644 --- a/.github/workflows/catalog-admission.yml +++ b/.github/workflows/catalog-admission.yml @@ -126,7 +126,7 @@ jobs: # with the central catalog-updater hub so "what must verify for an external # entry" lives in one place. - name: Verify external entries' attestations (shared, fail-closed) - uses: attested-delivery/.github/.github/actions/plugin-catalog-update@36cdbd7d75865b88e8beec4813c1d3587fa98644 # engine url-source fix (post v0.1.0) + uses: attested-delivery/.github/.github/actions/plugin-catalog-update@508aa7a385d3f6776feb175e40b3a0e9f08402c4 # engine url-source fix (post v0.1.0) with: mode: verify repo: ${{ github.repository }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2095d15..99c1faa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,11 +26,11 @@ jobs: permissions: contents: read uses: >- - attested-delivery/.github/.github/workflows/pin-check.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/pin-check.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 # Centralized, verified actionlint fetch. # attested-delivery/.github @ b314c29 (#6 — in-step PATH fix) validate-workflows: permissions: contents: read uses: >- - attested-delivery/.github/.github/workflows/reusable-actionlint.yml@f211de97395ced798da52e28d89d79c22b3020ee \ No newline at end of file + attested-delivery/.github/.github/workflows/reusable-actionlint.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 \ No newline at end of file diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index e3ce55d..b293bce 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -40,7 +40,7 @@ jobs: actions: read packages: read uses: >- - attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: languages: actions build-mode: none @@ -52,7 +52,7 @@ jobs: security-events: write pull-requests: write uses: >- - attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: fail-on-severity: high @@ -63,7 +63,7 @@ jobs: actions: read packages: read uses: >- - attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-trivy.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: scan-iac: true @@ -75,7 +75,7 @@ jobs: contents: read actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-scorecard.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-scorecard.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: publish-results: false @@ -85,14 +85,14 @@ jobs: contents: read security-events: write uses: >- - attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 semgrep: permissions: contents: read security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-semgrep.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: directory: . @@ -102,7 +102,7 @@ jobs: security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-secrets.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: directory: . @@ -112,7 +112,7 @@ jobs: security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: directory: . diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 98b79e1..643b3e7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -86,7 +86,7 @@ jobs: echo "name=${FILE}" >> "$GITHUB_OUTPUT" echo "digest=sha256:${DIGEST}" >> "$GITHUB_OUTPUT" - name: Attest build provenance - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: dist/* - name: Upload build artifact @@ -137,46 +137,46 @@ jobs: needs: [meta] permissions: { security-events: write, contents: read, actions: read, packages: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: { languages: actions, build-mode: none } gate-sca: needs: [meta] permissions: { actions: read, contents: read, security-events: write, pull-requests: write } uses: >- - attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: { fail-on-severity: high } gate-trivy: needs: [meta] permissions: { contents: read, security-events: write, actions: read, packages: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-trivy.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: { scan-iac: true } gate-shellcheck: needs: [meta] permissions: { contents: read, security-events: write } uses: >- - attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 gate-semgrep: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-semgrep.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 gate-secrets: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-secrets.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 gate-manifest: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 # --- seam attestations: bind each verdict to the tarball digest ------------- attest-sast: needs: [meta, build, gate-sast] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -187,7 +187,7 @@ jobs: needs: [meta, build, gate-sca] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -198,7 +198,7 @@ jobs: needs: [meta, build, gate-trivy] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -209,7 +209,7 @@ jobs: needs: [meta, build, gate-shellcheck] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -220,7 +220,7 @@ jobs: needs: [meta, build, gate-semgrep] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -231,7 +231,7 @@ jobs: needs: [meta, build, gate-secrets] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -242,7 +242,7 @@ jobs: needs: [meta, build, gate-manifest] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -255,7 +255,7 @@ jobs: needs: [meta] permissions: { id-token: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: blob-path: .claude-plugin/marketplace.json @@ -264,7 +264,7 @@ jobs: needs: [meta, build] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-vex.yml@f211de97395ced798da52e28d89d79c22b3020ee + attested-delivery/.github/.github/workflows/reusable-vex.yml@508aa7a385d3f6776feb175e40b3a0e9f08402c4 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }}