From d8e52b1f607c8a9e6ab68357eea3a245dc4f95bc Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Sat, 27 Jun 2026 15:47:05 -0400 Subject: [PATCH] build(deps): bump actions/checkout to v7.0.0 and github-script to v9.0.0 Signed-off-by: Joshua Temple --- .github/workflows/auto-promote.yaml | 2 +- .github/workflows/build-cli.yaml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/docs-deploy.yaml | 2 +- .github/workflows/drift-comment.yaml | 2 +- .github/workflows/e2e.yaml | 4 ++-- .github/workflows/fleet-e2e.yaml | 8 ++++---- .github/workflows/fleet-reconcile.yaml | 2 +- .github/workflows/hotfix.yaml | 8 ++++---- .github/workflows/nightly-release.yaml | 4 ++-- .github/workflows/orchestrate.yaml | 4 ++-- .github/workflows/pr.yaml | 8 ++++---- .github/workflows/promote.yaml | 6 +++--- .github/workflows/release.yaml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/validate.yaml | 4 ++-- e2e/scenarios/35-action-pins-sha-mode.yaml | 8 ++++---- e2e/scenarios/36-action-pins-default-tag.yaml | 6 +++--- e2e/scenarios/39-action-pins-override.yaml | 6 +++--- internal/generate/action_pins.yaml | 4 ++-- internal/generate/action_pins_manifest_test.go | 4 ++-- internal/generate/drift_check_test.go | 2 +- internal/generate/hotfix_test.go | 2 +- internal/generate/merge_queue_test.go | 2 +- internal/generate/pr_preview_test.go | 4 ++-- internal/generate/validate_check_test.go | 2 +- 26 files changed, 53 insertions(+), 53 deletions(-) diff --git a/.github/workflows/auto-promote.yaml b/.github/workflows/auto-promote.yaml index 8dd20adc..70a6ec4c 100644 --- a/.github/workflows/auto-promote.yaml +++ b/.github/workflows/auto-promote.yaml @@ -152,7 +152,7 @@ jobs: contents: write actions: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml index 2c752381..2653a59a 100644 --- a/.github/workflows/build-cli.yaml +++ b/.github/workflows/build-cli.yaml @@ -23,7 +23,7 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -52,7 +52,7 @@ jobs: # install, and container teardown. timeout-minutes: 70 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 80693727..018602c8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -21,7 +21,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Initialize CodeQL uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/docs-deploy.yaml b/.github/workflows/docs-deploy.yaml index ace68da3..842dcc73 100644 --- a/.github/workflows/docs-deploy.yaml +++ b/.github/workflows/docs-deploy.yaml @@ -35,7 +35,7 @@ jobs: run: working-directory: docs steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "22" diff --git a/.github/workflows/drift-comment.yaml b/.github/workflows/drift-comment.yaml index 4ae2a6d0..34ae5efc 100644 --- a/.github/workflows/drift-comment.yaml +++ b/.github/workflows/drift-comment.yaml @@ -42,7 +42,7 @@ jobs: - name: Post or update sticky comment if: steps.download.outcome == 'success' - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const fs = require('fs'); diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index b428ab12..90435397 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -55,7 +55,7 @@ jobs: outputs: code: ${{ steps.compute.outputs.code }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - id: filter if: github.event_name == 'pull_request' @@ -83,7 +83,7 @@ jobs: if: needs.changes.outputs.code == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # workflow_dispatch: honour the explicit ref input. # All other triggers (push:tags, merge_group): use the exact SHA diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml index 66d7b66d..ce47d9d0 100644 --- a/.github/workflows/fleet-e2e.yaml +++ b/.github/workflows/fleet-e2e.yaml @@ -532,7 +532,7 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Dispatch and watch primary uses: ./.github/actions/dispatch-suite with: @@ -557,7 +557,7 @@ jobs: matrix: repo: ${{ fromJSON(needs.plan.outputs.dependents_repos) }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Dispatch and watch uses: ./.github/actions/dispatch-suite with: @@ -578,7 +578,7 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Dispatch and watch 4env uses: ./.github/actions/dispatch-suite with: @@ -603,7 +603,7 @@ jobs: matrix: repo: ${{ fromJSON(needs.plan.outputs.remainder_repos) }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Dispatch and watch uses: ./.github/actions/dispatch-suite with: diff --git a/.github/workflows/fleet-reconcile.yaml b/.github/workflows/fleet-reconcile.yaml index 00631ba6..90cb6047 100644 --- a/.github/workflows/fleet-reconcile.yaml +++ b/.github/workflows/fleet-reconcile.yaml @@ -110,7 +110,7 @@ jobs: # is referenced at a ref by the caller; we re-check-out cascade at that # same ref (or an override) so the Go core matches the gate version. - name: Check out cascade (reconcile core) - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: stablekernel/cascade ref: ${{ inputs.cascade-ref || github.workflow_sha }} diff --git a/.github/workflows/hotfix.yaml b/.github/workflows/hotfix.yaml index f678dd97..c67aebb7 100644 --- a/.github/workflows/hotfix.yaml +++ b/.github/workflows/hotfix.yaml @@ -73,7 +73,7 @@ jobs: deploy_names: ${{ steps.names.outputs.deploy_names }} steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.hotfix_branch }} fetch-depth: 0 @@ -186,7 +186,7 @@ jobs: fail-fast: true steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.hotfix_branch }} @@ -235,7 +235,7 @@ jobs: max-parallel: 3 steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.hotfix_branch }} @@ -275,7 +275,7 @@ jobs: release_url: ${{ steps.release.outputs.html_url }} steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ inputs.hotfix_branch }} fetch-depth: 0 diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml index dde7ab5f..240ac1c7 100644 --- a/.github/workflows/nightly-release.yaml +++ b/.github/workflows/nightly-release.yaml @@ -51,7 +51,7 @@ jobs: outputs: run: ${{ steps.decide.outputs.run }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # Full history + tags so the last-release ref and the diff resolve. fetch-depth: 0 @@ -195,7 +195,7 @@ jobs: # The tag is the only carrier that survives the workflow_run boundaries: # Release builds it, the (broadened) fleet validates it, and auto-promote's # unchanged -rc.-only gate rejects it, so nothing publishes by construction. - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 if: github.event.inputs.dry_run == 'true' with: fetch-depth: 0 diff --git a/.github/workflows/orchestrate.yaml b/.github/workflows/orchestrate.yaml index b52d9355..e2dc4d35 100644 --- a/.github/workflows/orchestrate.yaml +++ b/.github/workflows/orchestrate.yaml @@ -32,7 +32,7 @@ jobs: changelog_base_sha: ${{ steps.setup.outputs.changelog_base_sha }} base_build_cli: ${{ steps.setup.outputs.base_build_cli }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup CLI @@ -74,7 +74,7 @@ jobs: cli_result: ${{ needs.build-cli.outputs.result }} validate_result: ${{ needs.validate.outputs.result }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Generate Summary diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 63c1adc1..8e34a70d 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -27,7 +27,7 @@ jobs: outputs: code: ${{ steps.filter.outputs.code }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - id: filter uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 @@ -49,7 +49,7 @@ jobs: if: needs.changes.outputs.code == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -73,7 +73,7 @@ jobs: if: needs.changes.outputs.code == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -95,7 +95,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml index d2f858e0..0648b3bc 100644 --- a/.github/workflows/promote.yaml +++ b/.github/workflows/promote.yaml @@ -89,7 +89,7 @@ jobs: can_proceed: ${{ steps.preflight.outputs.can_proceed }} promotion_result: ${{ steps.preflight.outputs.promotion_result }} steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup CLI @@ -126,7 +126,7 @@ jobs: if: ${{ github.event.inputs.dry_run != 'true' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup CLI uses: stablekernel/cascade/.github/actions/setup-cli@9dc69a1f66753a3865c38c34eca5a931f677c803 # v0.1.0 with: @@ -151,7 +151,7 @@ jobs: contents: write actions: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - name: Setup CLI diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index aa3ecd40..7638b8c9 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -39,7 +39,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 @@ -61,7 +61,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 73d9584b..5edbd976 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 7017bb7d..53e19e79 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -37,7 +37,7 @@ jobs: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: @@ -57,7 +57,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: diff --git a/e2e/scenarios/35-action-pins-sha-mode.yaml b/e2e/scenarios/35-action-pins-sha-mode.yaml index 72eaadd5..d604d00c 100644 --- a/e2e/scenarios/35-action-pins-sha-mode.yaml +++ b/e2e/scenarios/35-action-pins-sha-mode.yaml @@ -5,8 +5,8 @@ description: | major tag (#327). Covers: - - pin_mode: sha emits actions/checkout@<40hex> # v6.0.3 - - the default mutable major tag (v6) no longer appears once sha-pinned + - pin_mode: sha emits actions/checkout@<40hex> # v7.0.0 + - the default mutable major tag (v7) no longer appears once sha-pinned Generator-output verification only. @@ -34,7 +34,7 @@ steps: - path: ".github/workflows/orchestrate.yaml" contains: # sha mode pins checkout to its 40-hex SHA with a version comment. - - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3" + - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0" not_contains: # the mutable major tag must not appear once sha-pinned. - - "uses: actions/checkout@v6\n" + - "uses: actions/checkout@v7\n" diff --git a/e2e/scenarios/36-action-pins-default-tag.yaml b/e2e/scenarios/36-action-pins-default-tag.yaml index 1f1682c6..0f73206c 100644 --- a/e2e/scenarios/36-action-pins-default-tag.yaml +++ b/e2e/scenarios/36-action-pins-default-tag.yaml @@ -6,7 +6,7 @@ description: | against. Covers: - - the default emits actions/checkout@v6 with no sha comment + - the default emits actions/checkout@v7 with no sha comment - no 40-hex sha pin is emitted for checkout when pin_mode is unset Generator-output verification only. @@ -34,7 +34,7 @@ steps: - path: ".github/workflows/orchestrate.yaml" contains: # default behavior emits the built-in mutable major tag, no sha comment. - - "uses: actions/checkout@v6\n" + - "uses: actions/checkout@v7\n" not_contains: # without pin_mode: sha, no 40-hex sha pin for checkout is emitted. - - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" + - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" diff --git a/e2e/scenarios/39-action-pins-override.yaml b/e2e/scenarios/39-action-pins-override.yaml index c585f5f0..b8a09617 100644 --- a/e2e/scenarios/39-action-pins-override.yaml +++ b/e2e/scenarios/39-action-pins-override.yaml @@ -21,7 +21,7 @@ config: deploys: [] pin_mode: sha action_pins: - actions/checkout: "v6" + actions/checkout: "v7" steps: - name: "Initial commit; assert the override ref wins over the sha pin" @@ -37,7 +37,7 @@ steps: - path: ".github/workflows/orchestrate.yaml" contains: # the override ref is emitted verbatim, as a mutable-ref opt-in. - - "uses: actions/checkout@v6\n" + - "uses: actions/checkout@v7\n" not_contains: # the built-in sha pin must not appear when overridden. - - "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" + - "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" diff --git a/internal/generate/action_pins.yaml b/internal/generate/action_pins.yaml index d044e18e..396ee005 100644 --- a/internal/generate/action_pins.yaml +++ b/internal/generate/action_pins.yaml @@ -10,8 +10,8 @@ # sha is the 40-hex commit the tag/version resolves to. version is the precise # release the sha corresponds to, carried as the trailing uses: comment. actions: - actions/checkout: { tag: v6, sha: df4cb1c069e1874edd31b4311f1884172cec0e10, version: v6.0.3, emit: true } - actions/github-script: { tag: v7, sha: f28e40c7f34bde8b3046d885e986cb6290c5673b, version: v7.1.0, emit: true } + actions/checkout: { tag: v7, sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, version: v7.0.0, emit: true } + actions/github-script: { tag: v9, sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3, version: v9.0.0, emit: true } actions/download-artifact: { tag: v8, sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c, version: v8.0.1, emit: true } actions/upload-artifact: { tag: v7, sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a, version: v7.0.1, emit: true } actions/create-github-app-token: { tag: v3, sha: bcd2ba49218906704ab6c1aa796996da409d3eb1, version: v3.2.0, emit: true } diff --git a/internal/generate/action_pins_manifest_test.go b/internal/generate/action_pins_manifest_test.go index eaf927e9..9153c9d0 100644 --- a/internal/generate/action_pins_manifest_test.go +++ b/internal/generate/action_pins_manifest_test.go @@ -16,8 +16,8 @@ import ( // intentional bump (a later PR) changes them. func TestDefaultActionPins_MatchesPriorHardcodedTable(t *testing.T) { priorHardcodedTable := map[string]actionPin{ - actionCheckout: {tag: "v6", sha: "df4cb1c069e1874edd31b4311f1884172cec0e10", shaVersion: "v6.0.3"}, - actionGithubScript: {tag: "v7", sha: "f28e40c7f34bde8b3046d885e986cb6290c5673b", shaVersion: "v7.1.0"}, + actionCheckout: {tag: "v7", sha: "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", shaVersion: "v7.0.0"}, + actionGithubScript: {tag: "v9", sha: "3a2844b7e9c422d3c10d287c895573f7108da1b3", shaVersion: "v9.0.0"}, actionDownloadArtifact: {tag: "v8", sha: "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", shaVersion: "v8.0.1"}, actionUploadArtifact: {tag: "v7", sha: "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", shaVersion: "v7.0.1"}, actionCreateAppToken: {tag: "v3", sha: "bcd2ba49218906704ab6c1aa796996da409d3eb1", shaVersion: "v3.2.0"}, diff --git a/internal/generate/drift_check_test.go b/internal/generate/drift_check_test.go index 447f64f8..7dac818a 100644 --- a/internal/generate/drift_check_test.go +++ b/internal/generate/drift_check_test.go @@ -158,7 +158,7 @@ func TestDriftCheckGenerator_PinModeSHA(t *testing.T) { comment, err := g.GenerateComment() require.NoError(t, err) assert.Contains(t, comment, "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c") - assert.Contains(t, comment, "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b") + assert.Contains(t, comment, "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3") } // TestDriftCheckGenerator_Actionlint runs actionlint over both generated files. diff --git a/internal/generate/hotfix_test.go b/internal/generate/hotfix_test.go index 4c783bf9..7abb9035 100644 --- a/internal/generate/hotfix_test.go +++ b/internal/generate/hotfix_test.go @@ -474,7 +474,7 @@ func TestHotfixGenerator_PinModeSHA(t *testing.T) { content, err := gen.Generate() require.NoError(t, err) - assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") + assert.Contains(t, content, "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0") assert.NotContains(t, content, "uses: actions/checkout@v4") } diff --git a/internal/generate/merge_queue_test.go b/internal/generate/merge_queue_test.go index ad254813..aaa6966b 100644 --- a/internal/generate/merge_queue_test.go +++ b/internal/generate/merge_queue_test.go @@ -100,7 +100,7 @@ func TestMergeQueueGenerator_PinModeSHA(t *testing.T) { content, err := gen.Generate() require.NoError(t, err) - assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") + assert.Contains(t, content, "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0") assert.NotContains(t, content, "uses: actions/checkout@v4") } diff --git a/internal/generate/pr_preview_test.go b/internal/generate/pr_preview_test.go index a58011e4..5dd34385 100644 --- a/internal/generate/pr_preview_test.go +++ b/internal/generate/pr_preview_test.go @@ -203,8 +203,8 @@ func TestPRPreviewGenerator_ActionRefsPinUnderSHAMode(t *testing.T) { assert.Contains(t, content, "actions/github-script@"+script.sha+" # "+script.shaVersion) // No bare major-tag refs for these actions under sha mode. - assert.NotContains(t, content, "actions/checkout@v4\n") - assert.NotContains(t, content, "actions/github-script@v7\n") + assert.NotContains(t, content, "actions/checkout@v7\n") + assert.NotContains(t, content, "actions/github-script@v9\n") } func TestPRPreviewGenerator_ValidYAML(t *testing.T) { diff --git a/internal/generate/validate_check_test.go b/internal/generate/validate_check_test.go index 98a3c86c..d78663dc 100644 --- a/internal/generate/validate_check_test.go +++ b/internal/generate/validate_check_test.go @@ -100,7 +100,7 @@ func TestValidateCheckGenerator_PinModeSHA(t *testing.T) { content, err := gen.Generate() require.NoError(t, err) - assert.Contains(t, content, "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") + assert.Contains(t, content, "uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0") assert.NotContains(t, content, "uses: actions/checkout@v4") }