From fb262e487f8d7a560c903aff9037e9f6a0631944 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 13:12:56 +0000 Subject: [PATCH] ci(deps): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` | | [NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.20.0` | | [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.0` | | [NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml](https://github.com/nddev-it-com/ci-workflows) | `0.5.1` | `0.12.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | Updates `NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `step-security/harden-runner` from 2.19.4 to 2.20.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920) Updates `actions/attest` from 4.1.1 to 4.2.0 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) Updates `NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml` from 0.5.1 to 0.12.0 - [Release notes](https://github.com/nddev-it-com/ci-workflows/releases) - [Changelog](https://github.com/NDDev-it-com/ci-workflows/blob/main/CHANGELOG.md) - [Commits](https://github.com/nddev-it-com/ci-workflows/compare/ac4d1f469f5974741c7449305ffcbd5f05a5a47f...2ccb80e96f5771b6a6b4eae63a4f47e232906dc7) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: step-security/harden-runner dependency-version: 2.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/actionlint.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/cross-platform.yml | 2 +- .github/workflows/dependency-check.yml | 4 ++-- .github/workflows/dependency-review.yml | 2 +- .github/workflows/instruction-docs-check.yml | 6 +++--- .github/workflows/lint.yml | 4 ++-- .github/workflows/opencode-runtime.yml | 4 ++-- .github/workflows/release.yml | 10 +++++----- .github/workflows/sbom.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scan.yml | 2 +- .github/workflows/typecheck-plugins.yml | 4 ++-- .github/workflows/validate.yml | 8 ++++---- 14 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index a52e9723..c5bf510f 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -24,6 +24,6 @@ jobs: name: actionlint permissions: contents: read - uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: post_command: python3 scripts/check_action_pins.py .github/workflows diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 702b2690..4fd9cdf5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,7 +40,7 @@ jobs: matrix: os: [ubuntu-latest] language: ["javascript-typescript", "python"] - uses: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/public-codeql.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: runner: ${{ matrix.os }} languages: '["${{ matrix.language }}"]' diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml index 96256498..8267f659 100644 --- a/.github/workflows/cross-platform.yml +++ b/.github/workflows/cross-platform.yml @@ -30,7 +30,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-latest, windows-latest, macos-latest] - uses: NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/cross-platform-smoke.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: os_list: '["${{ matrix.os }}"]' timeout_minutes: 10 diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml index a3fc4306..ec0efc79 100644 --- a/.github/workflows/dependency-check.yml +++ b/.github/workflows/dependency-check.yml @@ -25,10 +25,10 @@ jobs: steps: # Actions pinned to commit SHA — see validate.yml header for rationale. - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index b76af674..0317cd94 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -21,7 +21,7 @@ jobs: permissions: contents: read pull-requests: write - uses: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/public-dependency-review.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: fail_on_severity: moderate comment_summary_in_pr: on-failure diff --git a/.github/workflows/instruction-docs-check.yml b/.github/workflows/instruction-docs-check.yml index 832fcc5a..29299e4a 100644 --- a/.github/workflows/instruction-docs-check.yml +++ b/.github/workflows/instruction-docs-check.yml @@ -43,15 +43,15 @@ jobs: timeout-minutes: 8 steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - name: Validate instruction docs diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d4a0772d..aa14fa42 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -33,9 +33,9 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - name: Install ruff (pinned) diff --git a/.github/workflows/opencode-runtime.yml b/.github/workflows/opencode-runtime.yml index d4684ea5..046c15af 100644 --- a/.github/workflows/opencode-runtime.yml +++ b/.github/workflows/opencode-runtime.yml @@ -55,7 +55,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Bun uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 @@ -82,7 +82,7 @@ jobs: grep -q '"moonshotai/kimi-k2.7-code"' /tmp/opencode-debug-config.txt - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6f4a23d6..f21417d3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,11 +31,11 @@ jobs: attestations: write steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -98,7 +98,7 @@ jobs: printf 'tag=%s\n' "$release_version" >> "$GITHUB_OUTPUT" printf 'version=%s\n' "$current" >> "$GITHUB_OUTPUT" - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - name: Set up Bun @@ -171,12 +171,12 @@ jobs: retention-days: 30 - name: Attest release evidence bundle if: matrix.os == 'ubuntu-latest' - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: release-evidence.tgz - name: Attest generated SBOM if: matrix.os == 'ubuntu-latest' - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: sbom.json - name: Publish GitHub Release diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index db21499e..7ccb21d7 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -18,11 +18,11 @@ jobs: timeout-minutes: 10 steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Bun diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b551a59b..67ac2039 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,6 +20,6 @@ jobs: id-token: write contents: read actions: read - uses: NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/public-scorecard-json.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: publish_results: false diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index e957ffff..b1636ea9 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -21,6 +21,6 @@ jobs: name: gitleaks permissions: contents: read - uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 + uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@2ccb80e96f5771b6a6b4eae63a4f47e232906dc7 # 0.12.0 with: gitleaks_config_path: .gitleaks.toml diff --git a/.github/workflows/typecheck-plugins.yml b/.github/workflows/typecheck-plugins.yml index 2dde236c..676badc6 100644 --- a/.github/workflows/typecheck-plugins.yml +++ b/.github/workflows/typecheck-plugins.yml @@ -33,9 +33,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" - name: Set up Bun diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index b34d217e..f43cc214 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -33,9 +33,9 @@ jobs: # tag hijack on the action repository). Update SHAs in lockstep when # bumping the major version; verify via `gh api repos/actions//git/refs/tags/`. - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" @@ -109,9 +109,9 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - name: Verify shell strictness contract