diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 1a8be20..6203b6f 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -10,7 +10,7 @@ workflows: - 'google/clusterfuzzlite@v1' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.37.3' + - 'github/codeql-action@v4.37.7' '.github/workflows/deno-ci.yml': [] '.github/workflows/governance.yml': [] '.github/workflows/hypatia-scan.yml': [] @@ -24,10 +24,10 @@ workflows: '.github/workflows/proofs.yml': - 'actions/checkout@v7.0.1' '.github/workflows/publish-container.yml': - - 'actions/attest-build-provenance@v4.1.1' + - 'actions/attest-build-provenance@v4.2.2' - 'actions/checkout@v7.0.1' - 'docker/build-push-action@v7.3.0' - - 'docker/login-action@v4.5.2' + - 'docker/login-action@v4.6.0' - 'docker/metadata-action@v6.2.0' '.github/workflows/push-email-notify.yml': - 'dawidd6/action-send-mail@v3.12.0' @@ -35,16 +35,16 @@ workflows: '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] dependencies: - 'actions/attest-build-provenance@v4.1.1': - ref: 'v4.1.1' - commit: 'sha1-0f67c3f4856b2e3261c31976d6725780e5e4c373' + 'actions/attest-build-provenance@v4.2.2': + ref: 'v4.2.2' + commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' owner_id: 44036562 repo_id: 760702757 uses: - - 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763' - 'actions/attest@a1948c3f048ba23858d222213b7c278aabede763': - ref: 'v4.1.1' - commit: 'sha1-a1948c3f048ba23858d222213b7c278aabede763' + - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d' + 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d': + ref: 'v4.2.1' + commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d' owner_id: 44036562 repo_id: 760701061 'actions/checkout@v7.0.1': @@ -71,7 +71,7 @@ dependencies: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' 'dawidd6/action-send-mail@v3.12.0': ref: 'v3.12.0' - commit: 'sha1-12335b969ae3fb71bee5f2c6b829744261aec34c' + commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59' owner_id: 9713907 repo_id: 222439721 'docker/build-push-action@v7.3.0': @@ -79,9 +79,9 @@ dependencies: commit: 'sha1-53b7df96c91f9c12dcc8a07bcb9ccacbed38856a' owner_id: 5429470 repo_id: 241092383 - 'docker/login-action@v4.5.2': - ref: 'v4.5.2' - commit: 'sha1-371161bbe7024a29a25c5e19bfcbc0804fe9ad2c' + 'docker/login-action@v4.6.0': + ref: 'v4.6.0' + commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f' owner_id: 5429470 repo_id: 287743349 'docker/metadata-action@v6.2.0': @@ -89,9 +89,9 @@ dependencies: commit: 'sha1-dc802804100637a589fabce1cb79ff13a1411302' owner_id: 5429470 repo_id: 306769011 - 'github/codeql-action@v4.37.3': - ref: 'v4.37.3' - commit: 'sha1-e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81' + 'github/codeql-action@v4.37.7': + ref: 'v4.37.7' + commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd' owner_id: 9919 repo_id: 259445878 'google/clusterfuzzlite@v1': diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 1620ada..fd7ba8b 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: ClusterFuzzLite batch fuzzing on: schedule: diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index b984ca3..0fbc400 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: ClusterFuzzLite PR fuzzing on: pull_request: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 17cbb0e..55de233 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: CodeQL Security Analysis on: diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml index 29e191c..d61757d 100644 --- a/.github/workflows/deno-ci.yml +++ b/.github/workflows/deno-ci.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Thin wrapper around the estate-wide reusable Deno CI bundle. # See: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml name: Deno CI @@ -14,6 +15,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index d821f0d..b8c7dca 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # governance.yml — single wrapper calling the shared estate governance bundle # in hyperpolymath/standards instead of carrying per-repo copies. # diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index d96e21a..88c40c3 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. # See standards#191 for the reusable's purpose and design. diff --git a/.github/workflows/language-policy.yml b/.github/workflows/language-policy.yml index 93434ae..9ec93ba 100644 --- a/.github/workflows/language-policy.yml +++ b/.github/workflows/language-policy.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Language Policy Enforcement on: push: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 5a1be21..a4020d7 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Mirror to Git Forges on: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 3be681d..f80f5cb 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml index f59609b..b1cc6cb 100644 --- a/.github/workflows/proofs.yml +++ b/.github/workflows/proofs.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Copyright (c) Jonathan D.A. Jewell # # Proof verification CI. Runs the LIGHTWEIGHT provers that are fast and reliable diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 02811a8..68a2468 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Publish Container on: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index fb48724..4f733f4 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by @@ -16,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send push notification email - uses: dawidd6/action-send-mail@v18 + uses: dawidd6/action-send-mail@v3.12.0 with: server_address: ${{ secrets.SMTP_HOST }} server_port: ${{ secrets.SMTP_PORT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 8d0b54c..89678a2 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. # Rust CI — thin wrapper calling the shared estate reusable in # hyperpolymath/standards. Configure once, propagate everywhere. # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards. @@ -11,6 +12,7 @@ on: pull_request: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index aa03a60..d7790fc 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Scorecards supply-chain security on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 913e4d2..99f8570 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,5 +1,6 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Secret Scanner on: @@ -12,6 +13,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: