From 33a95a38de80e762fb029d6c98619947dfb2dc92 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 09:53:55 +0000 Subject: [PATCH] deps(actions): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `3.37.5` | `4.37.9` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `3.37.5` | `4.37.9` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.7.3` | `5.0.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `6.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` | | [actions/attest](https://github.com/actions/attest) | `4.2.1` | `4.2.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `3.37.5` | `4.37.9` | Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `github/codeql-action/init` from 3.37.5 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3.37.5...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 3.37.5 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3.37.5...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `actions/setup-python` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `actions/dependency-review-action` from 4.7.3 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/595b5aeba73380359d98a5e087f648dbb0edce1b...a1d282b36b6f3519aa1f3fc636f609c47dddb294) Updates `actions/setup-dotnet` from 4.3.1 to 6.0.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](https://github.com/actions/setup-dotnet/compare/v4.3.1...a98b56852c35b8e3190ac28c8c2271da59106c68) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `actions/attest` from 4.2.1 to 4.2.2 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/508db95dd578ae2727ebd6217d5ba78e4fbda05d...1e69f48acb82d1966a394da916b4c1698aa569d6) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4.3.0...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `github/codeql-action/autobuild` from 3.37.5 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e60ea984bd3baa95954f2856bcf24f9eaba46637...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/attest dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 6 +-- .github/workflows/credential-scan.yml | 4 +- .github/workflows/dependency-review.yml | 4 +- .../dotnet-agent-framework-compatibility.yml | 8 ++-- .github/workflows/dotnet-integration.yml | 4 +- .github/workflows/dotnet-quality.yml | 18 ++++----- .../workflows/dotnet-release-attestation.yml | 22 +++++----- .github/workflows/dotnet-release.yml | 4 +- .github/workflows/dotnet-sbom-provenance.yml | 8 ++-- .github/workflows/dotnet-security.yml | 16 ++++---- .../python-agent-framework-compatibility.yml | 12 +++--- .github/workflows/python-quality.yml | 10 ++--- .../workflows/python-vulnerability-scan.yml | 4 +- .github/workflows/release-python.yml | 40 +++++++++---------- 14 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 59a5f0b..55b6b3e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,12 +33,12 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # github/codeql-action v3.37.6 + - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # github/codeql-action v4.37.9 with: languages: python - - uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # github/codeql-action v3.37.6 + - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # github/codeql-action v4.37.9 with: category: "/language:python" diff --git a/.github/workflows/credential-scan.yml b/.github/workflows/credential-scan.yml index 64382af..3a8653c 100644 --- a/.github/workflows/credential-scan.yml +++ b/.github/workflows/credential-scan.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" - run: python scripts/scan_credentials.py diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 1b325c0..fb3fe2d 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # actions/dependency-review-action v4 + - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # actions/dependency-review-action v4 diff --git a/.github/workflows/dotnet-agent-framework-compatibility.yml b/.github/workflows/dotnet-agent-framework-compatibility.yml index 796aff8..c09b0a8 100644 --- a/.github/workflows/dotnet-agent-framework-compatibility.yml +++ b/.github/workflows/dotnet-agent-framework-compatibility.yml @@ -19,8 +19,8 @@ jobs: outputs: matrix: ${{ steps.resolve.outputs.matrix }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Resolve latest stable, latest preview, and optional exact version @@ -44,8 +44,8 @@ jobs: matrix: version: ${{ fromJSON(needs.resolve.outputs.matrix) }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x diff --git a/.github/workflows/dotnet-integration.yml b/.github/workflows/dotnet-integration.yml index 357f6d0..1dc12f7 100644 --- a/.github/workflows/dotnet-integration.yml +++ b/.github/workflows/dotnet-integration.yml @@ -63,10 +63,10 @@ jobs: category: integration-persistence steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x diff --git a/.github/workflows/dotnet-quality.yml b/.github/workflows/dotnet-quality.yml index b314e31..1279baa 100644 --- a/.github/workflows/dotnet-quality.yml +++ b/.github/workflows/dotnet-quality.yml @@ -45,10 +45,10 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -135,9 +135,9 @@ jobs: matrix: ${{ steps.resolve.outputs.matrix }} steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Resolve common listed stable matrix bounds within the declared supported range @@ -175,10 +175,10 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -213,7 +213,7 @@ jobs: contents: read steps: - name: Check out exact build-branch commit - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 @@ -229,7 +229,7 @@ jobs: -CompatibilityResult $env:COMPATIBILITY_RESULT - name: Set up .NET SDKs - uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -242,7 +242,7 @@ jobs: - name: Upload manifest readiness report if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dotnet-build-release-readiness-${{ github.sha }} path: dotnet/artifacts/build-release-readiness/ diff --git a/.github/workflows/dotnet-release-attestation.yml b/.github/workflows/dotnet-release-attestation.yml index 4fffc27..5cebf17 100644 --- a/.github/workflows/dotnet-release-attestation.yml +++ b/.github/workflows/dotnet-release-attestation.yml @@ -118,7 +118,7 @@ jobs: # regardless of what triggered the upstream `sbom` run. `fetch-depth: 0` (full history, not the default # shallow clone) makes `origin/main` and every tag object available locally for the checks below. - name: Checkout trusted main - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main fetch-depth: 0 @@ -209,12 +209,12 @@ jobs: matrix: ${{ steps.resolve.outputs.matrix }} steps: - name: Checkout validated release commit - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.validate-attestation-eligibility.outputs.validated-sha }} persist-credentials: false - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Resolve latest and previous common listed stable versions @@ -235,12 +235,12 @@ jobs: contents: read steps: - name: Checkout validated release commit - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.validate-attestation-eligibility.outputs.validated-sha }} persist-credentials: false - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -279,13 +279,13 @@ jobs: # reachable from `origin/main`, its content is, by definition, already-reviewed/merged history -- identical # in trust to building any other ordinary, reviewed commit in this repository. - name: Checkout the validated commit - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.validate-attestation-eligibility.outputs.validated-sha }} persist-credentials: false - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -309,7 +309,7 @@ jobs: run: ./scripts/verify-package.ps1 -Configuration Release - name: Generate release SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: dotnet/artifacts/packages format: spdx-json @@ -317,7 +317,7 @@ jobs: upload-artifact: false - name: Generate release CycloneDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: dotnet/artifacts/packages format: cyclonedx-json @@ -398,7 +398,7 @@ jobs: # (workflow_run guarantees this file's own content is always sourced from main). - name: Attest custom release provenance (binds validated commit, never the stock auto-provenance mode) id: attest - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: | dotnet/artifacts/packages/*.nupkg @@ -469,7 +469,7 @@ jobs: pattern: release-compatibility-* path: compatibility-evidence - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Validate canonical NuGet source before exposing publishing secret diff --git a/.github/workflows/dotnet-release.yml b/.github/workflows/dotnet-release.yml index f585664..11363c4 100644 --- a/.github/workflows/dotnet-release.yml +++ b/.github/workflows/dotnet-release.yml @@ -32,12 +32,12 @@ jobs: actions: write steps: - name: Checkout main with tags - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 - name: Setup .NET for canonical NuGet version parsing - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: 10.0.x - name: Validate main reachability and derive manifest tag diff --git a/.github/workflows/dotnet-sbom-provenance.yml b/.github/workflows/dotnet-sbom-provenance.yml index 4e6e131..f74139b 100644 --- a/.github/workflows/dotnet-sbom-provenance.yml +++ b/.github/workflows/dotnet-sbom-provenance.yml @@ -74,12 +74,12 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.release_sha || github.sha }} - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -179,7 +179,7 @@ jobs: ./scripts/verify-release-tag.ps1 -NupkgPath $nupkg -RefName $env:RELEASE_TAG - name: Generate SPDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: dotnet/artifacts/packages format: spdx-json @@ -187,7 +187,7 @@ jobs: upload-artifact: false - name: Generate CycloneDX SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: dotnet/artifacts/packages format: cyclonedx-json diff --git a/.github/workflows/dotnet-security.yml b/.github/workflows/dotnet-security.yml index 6b07a8e..532b05e 100644 --- a/.github/workflows/dotnet-security.yml +++ b/.github/workflows/dotnet-security.yml @@ -32,10 +32,10 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -68,7 +68,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Proves the scanner itself still detects a real secret shape and still respects its documented # SENTINEL-SECRET- test-fixture exclusion, using disposable scratch git repos so no secret-shaped @@ -98,10 +98,10 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: | 8.0.x @@ -109,14 +109,14 @@ jobs: 10.0.x - name: Initialize CodeQL - uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: csharp - name: Build (autobuild) - uses: github/codeql-action/autobuild@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 + uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3.37.5 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:csharp" diff --git a/.github/workflows/python-agent-framework-compatibility.yml b/.github/workflows/python-agent-framework-compatibility.yml index 8bddca2..ed90c74 100644 --- a/.github/workflows/python-agent-framework-compatibility.yml +++ b/.github/workflows/python-agent-framework-compatibility.yml @@ -42,10 +42,10 @@ jobs: outputs: matrix: ${{ steps.versions.outputs.matrix }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" - name: Install ecosystem version parser @@ -68,7 +68,7 @@ jobs: --json-output compatibility-reports/resolution.json \ --markdown-output compatibility-reports/resolution.md cat compatibility-reports/resolution.md >> "$GITHUB_STEP_SUMMARY" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 with: name: python-framework-version-resolution path: python/compatibility-reports/ @@ -89,10 +89,10 @@ jobs: FRAMEWORK_VERSION: ${{ matrix.version }} REPORT_DIR: compatibility-reports/${{ matrix.label }}-${{ matrix.version }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip @@ -106,7 +106,7 @@ jobs: --label "${{ matrix.label }}" \ --channel "${{ matrix.channel }}" \ --report-dir "$REPORT_DIR" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 if: always() with: name: python-framework-${{ matrix.label }}-${{ matrix.version }} diff --git a/.github/workflows/python-quality.yml b/.github/workflows/python-quality.yml index 5035825..8b35cbc 100644 --- a/.github/workflows/python-quality.yml +++ b/.github/workflows/python-quality.yml @@ -37,11 +37,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip @@ -78,10 +78,10 @@ jobs: run: working-directory: python steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip @@ -145,7 +145,7 @@ jobs: run: | sha256sum dist/* > dist/SHA256SUMS python scripts/verify_artifacts.py --supplemental dist/*.sbom.cdx.json dist/SHA256SUMS - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 with: name: python-package-${{ github.sha }} path: python/dist/ diff --git a/.github/workflows/python-vulnerability-scan.yml b/.github/workflows/python-vulnerability-scan.yml index c9051e4..81d2e49 100644 --- a/.github/workflows/python-vulnerability-scan.yml +++ b/.github/workflows/python-vulnerability-scan.yml @@ -34,10 +34,10 @@ jobs: run: working-directory: python steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml index f989221..8038f61 100644 --- a/.github/workflows/release-python.yml +++ b/.github/workflows/release-python.yml @@ -42,12 +42,12 @@ jobs: env: DISPATCH_REF: ${{ github.ref_name }} run: test "$DISPATCH_REF" = main - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: ref: ${{ github.event_name == 'push' && github.sha || inputs.commit }} fetch-depth: 0 persist-credentials: true - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" - name: Validate main ancestry, version, and release tag @@ -86,11 +86,11 @@ jobs: outputs: matrix: ${{ steps.versions.outputs.matrix }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: ref: ${{ needs.tag.outputs.sha }} persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" - name: Resolve stable compatibility versions @@ -116,11 +116,11 @@ jobs: FRAMEWORK_VERSION: ${{ matrix.version }} REPORT_DIR: compatibility-reports/${{ matrix.label }}-${{ matrix.version }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: ref: ${{ needs.tag.outputs.sha }} persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip @@ -134,7 +134,7 @@ jobs: --label "${{ matrix.label }}" \ --channel "${{ matrix.channel }}" \ --report-dir "$REPORT_DIR" - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 if: always() with: name: python-release-compatibility-${{ matrix.label }}-${{ matrix.version }} @@ -152,12 +152,12 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: ref: ${{ needs.tag.outputs.sha }} fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" cache: pip @@ -239,7 +239,7 @@ jobs: printf '# Release gate\n\nCommit: `%s`\n\n- Setup: **%s**\n- Gate: **%s**\n- Package: **%s**\n' \ "$RELEASE_SHA" "$SETUP_OUTCOME" "$GATE_OUTCOME" "$PACKAGE_OUTCOME" \ > dist/reports/release-gate.md - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 if: always() with: name: python-release-${{ needs.tag.outputs.tag }} @@ -267,7 +267,7 @@ jobs: attestations: write contents: read steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: name: python-release-${{ needs.tag.outputs.tag }} path: dist @@ -341,14 +341,14 @@ jobs: PY - name: Attest exact distributions id: attest - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # actions/attest v4.2.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # actions/attest v4.2.2 with: subject-path: | dist/packages/*.whl dist/packages/*.tar.gz predicate-type: https://slsa.dev/provenance/v1 predicate-path: dist/release-provenance-predicate.json - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact v4.6.2 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact v7.0.1 with: name: python-release-provenance-${{ needs.tag.outputs.tag }} path: ${{ steps.attest.outputs.bundle-path }} @@ -372,7 +372,7 @@ jobs: id-token: write contents: read steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: name: python-release-${{ needs.tag.outputs.tag }} path: dist @@ -390,14 +390,14 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # actions/checkout v4.4.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # actions/checkout v7.0.1 with: ref: ${{ needs.tag.outputs.sha }} persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # actions/setup-python v5 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # actions/setup-python v7.0.0 with: python-version: "3.10" - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: name: python-release-${{ needs.tag.outputs.tag }} path: dist @@ -434,15 +434,15 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: name: python-release-${{ needs.tag.outputs.tag }} path: release-assets - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: name: python-release-provenance-${{ needs.tag.outputs.tag }} path: release-assets/provenance - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # actions/download-artifact v4.3.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # actions/download-artifact v8.0.1 with: pattern: python-release-compatibility-* path: compatibility