diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 597725d..94b8dbe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: workflow-lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - run: | curl --fail --location --retry 3 --output actionlint.tgz https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 actionlint.tgz" | sha256sum --check --strict @@ -26,7 +26,7 @@ jobs: matrix: os: [ubuntu-22.04, ubuntu-24.04, windows-2025, macos-15-intel, macos-14] steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - uses: ./.github/actions/setup-native - if: runner.os != 'Windows' run: cmake --preset dev @@ -42,7 +42,7 @@ jobs: sanitizers: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - uses: ./.github/actions/setup-native - run: cmake --preset asan - run: cmake --build --preset asan --parallel 3 diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 41e41c4..b701776 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -46,14 +46,14 @@ jobs: if: github.event_name != 'release' runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build and validate against the latest published release run: python3 scripts/build-site.py env: GH_TOKEN: ${{ github.token }} - name: Check JavaScript syntax run: node --check site/app.js - - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0 + - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 if: github.event_name != 'pull_request' with: path: build/pages @@ -69,6 +69,6 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 + - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 id: deployment diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 24d8b13..3642697 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: outputs: version: ${{ steps.version.outputs.version }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - id: version run: echo "version=$(python3 scripts/version.py)" >> "$GITHUB_OUTPUT" - name: Create draft at this commit @@ -48,7 +48,7 @@ jobs: VERSION: ${{ needs.stage.outputs.version }} QT_QPA_PLATFORM: offscreen steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - uses: ./.github/actions/setup-native - if: runner.os != 'Windows' run: cmake --preset release -DTODOBENCH_BUILD_TESTS=ON @@ -83,7 +83,7 @@ jobs: run: python scripts/verify-packages.py dist - name: Retain native startup diagnostics if: always() && runner.os == 'macOS' - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: startup-diagnostics-${{ matrix.platform }} path: build/package-diagnostics/ @@ -97,7 +97,7 @@ jobs: GH_TOKEN: ${{ github.token }} RELEASE_PLATFORM: ${{ matrix.platform }} run: python scripts/upload-release.py dist - - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: screenshots-${{ matrix.platform }} path: build/screenshots/ @@ -113,8 +113,8 @@ jobs: GH_TOKEN: ${{ github.token }} VERSION: ${{ needs.stage.outputs.version }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.12' - name: Install runtime test tools (no Qt SDK) @@ -128,7 +128,7 @@ jobs: python3 scripts/check-appimage-update.py candidates/*.AppImage xvfb-run -a python3 scripts/check-linux-package.py candidates - if: always() - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: linux-compatibility-${{ matrix.os }} path: build/linux-evidence/ @@ -143,13 +143,13 @@ jobs: IS_PULLREQUEST: 'true' STRICT: 'true' steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Download exact candidate run: | gh release download "v$VERSION" --pattern '*AppImage' --dir candidates sha256sum candidates/* > candidate-sha256.txt - name: Check out pinned upstream catalog worker - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: repository: AppImage/appimage.github.io ref: f1249e9e1ff840dd53a6218aec3451ebd6bf476d @@ -176,7 +176,7 @@ jobs: timeout --kill-after=30 600 bash -e code/worker.sh "$PWD/data/TodoBench" 2>&1 | tee ../catalog.log cmp BeingTested.AppImage "../candidates/TodoBench-$VERSION-x86_64.AppImage" - if: always() - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: appimage-catalog-evidence path: | @@ -196,7 +196,7 @@ jobs: GH_TOKEN: ${{ github.token }} VERSION: ${{ needs.stage.outputs.version }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Download and verify all staged artifacts run: | gh release download "v$VERSION" --dir release-assets diff --git a/.github/workflows/verify-staged-release.yml b/.github/workflows/verify-staged-release.yml index dc75034..abb751b 100644 --- a/.github/workflows/verify-staged-release.yml +++ b/.github/workflows/verify-staged-release.yml @@ -22,7 +22,7 @@ jobs: version: ${{ steps.build.outputs.version }} commit: ${{ steps.build.outputs.commit }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - id: build env: GH_TOKEN: ${{ github.token }} @@ -40,8 +40,8 @@ jobs: VERSION: ${{ needs.stage.outputs.version }} SOURCE_COMMIT: ${{ needs.stage.outputs.commit }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 - - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.12' - name: Install runtime test tools (no Qt SDK) @@ -55,7 +55,7 @@ jobs: python3 scripts/check-appimage-update.py candidates/*.AppImage xvfb-run -a python3 scripts/check-linux-package.py candidates - if: always() - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: linux-compatibility-${{ matrix.os }} path: build/linux-evidence/ @@ -71,13 +71,13 @@ jobs: IS_PULLREQUEST: 'true' STRICT: 'true' steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Download exact candidate run: | gh release download "v$VERSION" --pattern '*AppImage' --dir candidates sha256sum candidates/* > candidate-sha256.txt - name: Check out pinned upstream catalog worker - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: repository: AppImage/appimage.github.io ref: f1249e9e1ff840dd53a6218aec3451ebd6bf476d @@ -104,7 +104,7 @@ jobs: timeout --kill-after=30 600 bash -e code/worker.sh "$PWD/data/TodoBench" 2>&1 | tee ../catalog.log cmp BeingTested.AppImage "../candidates/TodoBench-$VERSION-x86_64.AppImage" - if: always() - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: appimage-catalog-evidence path: | @@ -125,7 +125,7 @@ jobs: VERSION: ${{ needs.stage.outputs.version }} SOURCE_COMMIT: ${{ needs.stage.outputs.commit }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Download and verify all staged artifacts run: | gh release download "v$VERSION" --dir release-assets