Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 23 additions & 23 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
submodules: false
- &checkout-protected-ci-control
name: Checkout protected CI retry control
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: main
path: artifacts/trusted-ci-control
Expand All @@ -40,12 +40,12 @@ jobs:
persist-credentials: false
submodules: false
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: 24
- run: node artifacts/trusted-ci-control/.github/scripts/npm-ci-with-retry.mjs
- run: npm run build-prod
- uses: actions/upload-artifact@v7
- uses: actions/upload-artifact@v7.0.1
with:
path: out/index.html
retention-days: 1
Expand All @@ -64,7 +64,7 @@ jobs:
# silently uploading a partial artifact the Test job would then
# fail against with a confusing downstream error.
- name: Upload static app shell
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@v7.0.1
with:
name: static-app-shell
path: |
Expand Down Expand Up @@ -135,20 +135,20 @@ jobs:
timeout-minutes: 45
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
submodules: false
- *checkout-protected-ci-control
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: 24
- run: node artifacts/trusted-ci-control/.github/scripts/npm-ci-with-retry.mjs
- name: Install Coworld adapter test dependencies
run: npm ci --ignore-scripts --prefix coworld-adapter
- name: Download static app shell
uses: actions/download-artifact@v7
uses: actions/download-artifact@v8.0.1
with:
name: static-app-shell
path: static
Expand Down Expand Up @@ -176,13 +176,13 @@ jobs:
timeout-minutes: 90
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
submodules: false
- *checkout-protected-ci-control
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: 24
- run: node artifacts/trusted-ci-control/.github/scripts/npm-ci-with-retry.mjs
Expand All @@ -205,18 +205,18 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout repository
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
submodules: false
- *checkout-protected-ci-control
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: 24
- run: node artifacts/trusted-ci-control/.github/scripts/npm-ci-with-retry.mjs
- name: Download static app shell
uses: actions/download-artifact@v7
uses: actions/download-artifact@v8.0.1
with:
name: static-app-shell
path: static
Expand All @@ -227,11 +227,11 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
- *checkout-protected-ci-control
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: "24"
cache: "npm"
Expand All @@ -244,11 +244,11 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
- *checkout-protected-ci-control
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: "24"
cache: "npm"
Expand All @@ -260,15 +260,15 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
- *checkout-protected-ci-control
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: "24"
cache: "npm"
- uses: actions/setup-go@v6
- uses: actions/setup-go@v7
with:
go-version-file: map-generator/go.mod
cache-dependency-path: map-generator/go.sum
Expand All @@ -288,7 +288,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
ref: ${{ inputs.source_sha || github.sha }}
submodules: false
Expand All @@ -311,13 +311,13 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_sha || github.sha }}
fetch-depth: 0
submodules: false
- *checkout-protected-ci-control
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
- name: Run admission and release security tests
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/commander-public-base.yml
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
environment: coworld-production
steps:
- name: Checkout exact protected source
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_sha }}
fetch-depth: 0
Expand Down Expand Up @@ -96,11 +96,11 @@ jobs:
echo "FENCE_REF=$FENCE_REF"
} >> "$GITHUB_ENV"

- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24

- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
- uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
with:
version: "0.8.12"
enable-cache: false
Expand Down Expand Up @@ -400,7 +400,7 @@ jobs:

- name: Retain immutable intent before mutation
if: inputs.recovery_artifact_id == ''
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-public-base-boundary-intent-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-public-base-state/
Expand Down Expand Up @@ -518,7 +518,7 @@ jobs:

- name: Retain immutable GHCR boundary
if: env.RECOVERED_GHCR_BOUNDARY != 'true'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-public-base-boundary-ghcr-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-public-base-state/
Expand Down Expand Up @@ -589,7 +589,7 @@ jobs:

- name: Retain immutable Coworld intent before materialization
if: steps.coworld_intent.outputs.created == 'true'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-public-base-boundary-coworld-intent-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-public-base-state/
Expand Down Expand Up @@ -674,7 +674,7 @@ jobs:

- name: Retain immutable complete or partial Coworld boundary
if: always() && steps.materialization_boundary.outputs.ready == 'true'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-public-base-boundary-${{ steps.materialization_boundary.outputs.stage }}-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-public-base-state/
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/commander-xp-control.yml
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ jobs:
timeout-minutes: 30
steps:
- name: Checkout exact protected source
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_sha }}
fetch-depth: 0
Expand Down Expand Up @@ -215,7 +215,7 @@ jobs:
echo "PREREGISTRATION_FENCE_GIT_REF=$PREREGISTRATION_FENCE_GIT_REF" >> "$GITHUB_ENV"

- name: Setup exact Node runtime
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24

Expand Down Expand Up @@ -320,7 +320,7 @@ jobs:

- name: Upload immutable control packet
id: upload
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-xp-control-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-xp-control/
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/commander-xp-evidence.yml
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ jobs:
environment: coworld-production
steps:
- name: Checkout exact protected source
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ inputs.source_sha }}
fetch-depth: 0
Expand Down Expand Up @@ -301,12 +301,12 @@ jobs:
.github/scripts/commander-xp-source-allowlist-v2.json >/dev/null

- name: Setup exact Node and Coworld 0.1.42 runtimes
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24

- name: Setup exact uv
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
with:
version: "0.8.12"
enable-cache: false
Expand Down Expand Up @@ -822,7 +822,7 @@ jobs:
- name: Upload immutable pre-dispatch fence
if: inputs.phase != 'preregistration' && inputs.recovery_dispatch_artifact_id == ''
id: fence
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ env.FENCE_NAME }}
path: ${{ runner.temp }}/commander-xp-dispatch-fence-v1.json
Expand Down Expand Up @@ -911,7 +911,7 @@ jobs:

- name: Retain immutable sanitized dispatch boundary evidence
if: always() && inputs.phase != 'preregistration'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-xp-dispatch-boundary-${{ inputs.experiment_id }}-${{ inputs.phase }}-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: |
Expand Down Expand Up @@ -949,7 +949,7 @@ jobs:

- name: Retain immutable confirmatory wave-two boundary evidence
if: always() && inputs.phase == 'confirmatory' && steps.dispatch.outcome == 'success'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-xp-dispatch-boundary-final-${{ inputs.experiment_id }}-${{ inputs.phase }}-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: |
Expand Down Expand Up @@ -1072,7 +1072,7 @@ jobs:

- name: Upload immutable sanitized evidence first
id: evidence
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ steps.identity.outputs.artifact_name }}
path: ${{ runner.temp }}/commander-xp-envelope/evidence/
Expand Down Expand Up @@ -1135,7 +1135,7 @@ jobs:

- name: Upload immutable authority request second
id: authority
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-xp-authority-request-${{ inputs.phase }}-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-xp-envelope/authority/
Expand Down Expand Up @@ -1187,7 +1187,7 @@ jobs:

- name: Upload immutable completion-trigger handoff
id: handoff
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: commander-xp-external-seal-handoff-${{ inputs.phase }}-${{ inputs.source_sha }}-${{ github.run_id }}-${{ github.run_attempt }}
path: ${{ runner.temp }}/commander-xp-external-seal-handoff-v1.json
Expand Down
Loading
Loading