From 5d0490e94d0fb26d07746969c50f756fb7af0f50 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 2 Aug 2026 11:13:55 +0000 Subject: [PATCH] chore(deps): update GitHub Actions --- .github/workflows/ci.yml | 4 ++-- .github/workflows/cifuzzy.yml | 6 +++--- .github/workflows/codecov.yml | 4 ++-- .github/workflows/codeql.yml | 12 ++++++------ .github/workflows/coverage.yml | 2 +- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/docs.yml | 2 +- .github/workflows/fips-compatibility.yml | 12 ++++++------ .github/workflows/pr-title.yml | 2 +- .github/workflows/pr-validation.yml | 18 +++++++++--------- .github/workflows/publish-pypi.yml | 2 +- .github/workflows/python-compatibility.yml | 2 +- .github/workflows/qlty.yml | 2 +- .github/workflows/release-sign.yml | 4 ++-- .github/workflows/release.yml | 2 +- .github/workflows/reuse.yml | 4 ++-- .github/workflows/sbom.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/security-analysis.yml | 2 +- .github/workflows/slsa-provenance.yml | 12 ++++++------ .github/workflows/sonarcloud.yml | 10 +++++----- .github/workflows/validate-cruft.yml | 6 +++--- 22 files changed, 58 insertions(+), 58 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b563acf..57c44a3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ permissions: jobs: ci: name: CI Pipeline - uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' coverage-threshold: 80 @@ -54,7 +54,7 @@ jobs: timeout-minutes: 5 steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: '' diff --git a/.github/workflows/cifuzzy.yml b/.github/workflows/cifuzzy.yml index 5196a49..7b18153 100644 --- a/.github/workflows/cifuzzy.yml +++ b/.github/workflows/cifuzzy.yml @@ -43,12 +43,12 @@ jobs: steps: - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Build Fuzzers id: build @@ -69,7 +69,7 @@ jobs: - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: sarif_file: results.sarif category: fuzzing-${{ matrix.sanitizer }} diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml index 8f01ca2..def7a59 100644 --- a/.github/workflows/codecov.yml +++ b/.github/workflows/codecov.yml @@ -24,7 +24,7 @@ jobs: name: Upload Coverage # Only run on successful CI completion if: ${{ github.event.workflow_run.conclusion == 'success' }} - uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: artifact-name: 'coverage-reports' coverage-files: '*.xml' @@ -41,7 +41,7 @@ jobs: if: ${{ github.event.workflow_run.conclusion == 'failure' }} steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # NOTE: tighten to block after 2026-06-30 (cross-workflow egress migration). diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 653fbf5..07050c2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,22 +37,22 @@ jobs: steps: - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: enable-cache: true @@ -60,13 +60,13 @@ jobs: run: uv sync --no-dev - name: Initialize CodeQL - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: languages: python build-mode: none queries: security-extended,security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: category: "/language:python" diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 4ffcf88..94a1f7b 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -23,7 +23,7 @@ jobs: upload-coverage: name: Upload Coverage to Qlty if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} - uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: coverage-artifact-name: coverage-reports coverage-file-path: coverage.xml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index ba60481..51e3600 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -28,7 +28,7 @@ jobs: timeout-minutes: 10 steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # NOTE: tighten to block after 2026-06-30 (cross-workflow egress migration). @@ -38,7 +38,7 @@ jobs: # api.github.com:443 # github.com:443 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index bf8c494..e71d047 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -33,7 +33,7 @@ concurrency: jobs: docs: name: Build & Deploy Docs - uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' deploy-to-pages: >- diff --git a/.github/workflows/fips-compatibility.yml b/.github/workflows/fips-compatibility.yml index 875c3f3..b7784f7 100644 --- a/.github/workflows/fips-compatibility.yml +++ b/.github/workflows/fips-compatibility.yml @@ -56,17 +56,17 @@ jobs: steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO: tighten to block after 2026-06-30 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: enable-cache: true @@ -210,17 +210,17 @@ jobs: steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO: tighten to block after 2026-06-30 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: enable-cache: true diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 16a6f02..fa75bdb 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -29,7 +29,7 @@ jobs: timeout-minutes: 5 steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index d4219cd..8883cc6 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -34,7 +34,7 @@ jobs: contents: read pull-requests: write checks: write - uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' coverage-threshold: 80 @@ -51,20 +51,20 @@ jobs: timeout-minutes: 15 steps: - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # uv sync needs PyPI + Python.org + GitHub; audit catches needed endpoints. TODO: tighten to block with allowed-endpoints after 2026-06-30 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Install UV - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -93,15 +93,15 @@ jobs: timeout-minutes: 15 steps: - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # lychee validates external doc URLs across many hosts; block mode is incompatible - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Check documentation links - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 with: args: >- --verbose @@ -130,7 +130,7 @@ jobs: if: always() steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 49f2903..e90792e 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -26,7 +26,7 @@ jobs: # was silently ignored. Environment scoping for OIDC trusted publishing # must be applied INSIDE the reusable's publish job; tracked as an # upstream enhancement against ByronWilliamsCPA/.github. - uses: ByronWilliamsCPA/.github/.github/workflows/python-publish-pypi.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-publish-pypi.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' package-name: 'audio-processor' diff --git a/.github/workflows/python-compatibility.yml b/.github/workflows/python-compatibility.yml index f29071c..e00f370 100644 --- a/.github/workflows/python-compatibility.yml +++ b/.github/workflows/python-compatibility.yml @@ -36,7 +36,7 @@ permissions: jobs: compatibility: name: Python Compatibility Matrix - uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-versions: '["3.11", "3.12", "3.13"]' include-windows: true diff --git a/.github/workflows/qlty.yml b/.github/workflows/qlty.yml index 12be88f..daf1fbf 100644 --- a/.github/workflows/qlty.yml +++ b/.github/workflows/qlty.yml @@ -27,7 +27,7 @@ jobs: # Coverage upload: runs after CI workflow completes successfully. qlty: if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' - uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main permissions: contents: read actions: read diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml index 3a9e14a..315974e 100644 --- a/.github/workflows/release-sign.yml +++ b/.github/workflows/release-sign.yml @@ -17,12 +17,12 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e6a0ffa..04c3c79 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: if: >- (github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'master')) || github.event.workflow_run.conclusion == 'success' - uses: ByronWilliamsCPA/.github/.github/workflows/python-release.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-release.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' coverage-threshold: 80 diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index a275165..9bb961f 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -30,7 +30,7 @@ concurrency: jobs: reuse: name: REUSE Compliance Check - uses: ByronWilliamsCPA/.github/.github/workflows/python-reuse.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-reuse.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: generate-spdx: true fail-on-missing: true @@ -48,7 +48,7 @@ jobs: timeout-minutes: 5 steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: '' diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index a557839..100942f 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -41,7 +41,7 @@ concurrency: jobs: sbom: name: SBOM & Security - uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: python-version: '3.12' fail-on-vulnerabilities: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f24cd65..478942a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -26,7 +26,7 @@ permissions: jobs: scorecard: name: Scorecard Analysis - uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-scorecard.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: publish-results: true upload-sarif: true diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml index 35a89cc..5e869ad 100644 --- a/.github/workflows/security-analysis.yml +++ b/.github/workflows/security-analysis.yml @@ -34,7 +34,7 @@ permissions: jobs: security: name: Security Analysis - uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: source-directory: 'src' python-version: '3.12' diff --git a/.github/workflows/slsa-provenance.yml b/.github/workflows/slsa-provenance.yml index 0fcb890..0c32bbf 100644 --- a/.github/workflows/slsa-provenance.yml +++ b/.github/workflows/slsa-provenance.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: # The SLSA build job runs in block mode for reproducibility. # The allowed-endpoints list covers: @@ -60,17 +60,17 @@ jobs: astral.sh:443 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Install UV - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: enable-cache: true @@ -102,7 +102,7 @@ jobs: retention-days: 90 - name: Generate artifact attestation - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: 'dist/*' @@ -112,7 +112,7 @@ jobs: slsa: name: SLSA Level 3 needs: [build] - uses: ByronWilliamsCPA/.github/.github/workflows/python-slsa.yml@799ebd63e16aba0236ceded915f5c1cac20823b3 # main + uses: ByronWilliamsCPA/.github/.github/workflows/python-slsa.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main with: base64-subjects: ${{ needs.build.outputs.hashes }} upload-assets: true diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 58139ba..2320ba8 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -52,7 +52,7 @@ jobs: has-token: ${{ steps.check.outputs.has-token }} steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO: tighten to block after 2026-06-30 @@ -80,18 +80,18 @@ jobs: steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO: tighten to block after 2026-06-30 - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 # Disable shallow clone for better analysis persist-credentials: false - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' # No `cache: 'pip'`: this project uses uv, which handles its own caching @@ -130,7 +130,7 @@ jobs: fi - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0 + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed for PR decoration SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # SonarCloud authentication diff --git a/.github/workflows/validate-cruft.yml b/.github/workflows/validate-cruft.yml index 8dfcfd8..10ed6db 100644 --- a/.github/workflows/validate-cruft.yml +++ b/.github/workflows/validate-cruft.yml @@ -35,17 +35,17 @@ jobs: timeout-minutes: 10 steps: - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # NOTE: tighten to block after 2026-06-30 as part of the cross-workflow # audit->block egress migration (per-workflow allowed-endpoints required). - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12'