From 15dcef9afe7d98b9061e3afd421ff1b0e0967350 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 00:37:43 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 8 updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6` | `7` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.6.0` | `4.2.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.3.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.2.3` | | [aws-actions/amazon-ecr-login](https://github.com/aws-actions/amazon-ecr-login) | `2.1.5` | `2.1.7` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.6.0` | `10.0.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `6` | `7` | Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `docker/setup-qemu-action` from 3.6.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/29109295f81e9208d7d86ff1c6c12d2833863392...96fe6ef7f33517b61c61be40b68a1882f3264fb8) Updates `docker/setup-buildx-action` from 4.1.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...37fe631027851001ddb9b187196cc803df7f5f0e) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.3 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/e7f100cf4c008499ea8adda475de1042d6975c7b...e6de054238d6b7531b4efff3b6587d9aade6a06c) Updates `aws-actions/amazon-ecr-login` from 2.1.5 to 2.1.7 - [Release notes](https://github.com/aws-actions/amazon-ecr-login/releases) - [Changelog](https://github.com/aws-actions/amazon-ecr-login/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/amazon-ecr-login/compare/fa648b43de3d4d023bcb3f89ed6940096949c419...03f1aad4c6c7ffd436567f42f9384779290529bd) Updates `astral-sh/setup-uv` from 7.6.0 to 10.0.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/37802adc94f370d6bfd71619e3f0bf239e1f3b78...20cfd1bf945f4377ade1205e4dbc17946fc9a30d) Updates `actions/setup-python` from 6 to 7 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: aws-actions/amazon-ecr-login dependency-version: 2.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- ...uild-jenkins-endpoint-reconciler-image.yml | 30 ++++++++-------- .github/workflows/build-jenkins-image.yml | 30 ++++++++-------- .github/workflows/build-jenkins-mcp-image.yml | 34 +++++++++---------- .github/workflows/build-mtr-ingest-image.yml | 34 +++++++++---------- .../workflows/build-snapscheduler-image.yml | 30 ++++++++-------- .github/workflows/ci.yml | 20 +++++------ .github/workflows/refresh-fork-locks.yml | 8 ++--- 7 files changed, 93 insertions(+), 93 deletions(-) diff --git a/.github/workflows/build-jenkins-endpoint-reconciler-image.yml b/.github/workflows/build-jenkins-endpoint-reconciler-image.yml index 209d2524..cc5a57eb 100644 --- a/.github/workflows/build-jenkins-endpoint-reconciler-image.yml +++ b/.github/workflows/build-jenkins-endpoint-reconciler-image.yml @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -47,17 +47,17 @@ jobs: permissions: contents: read # explicitly NO id-token steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false # docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with: # gh api repos/docker//git/refs/tags/ --jq .object.sha - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 # A multi-arch manifest cannot be loaded into the daemon, so build + smoke # each arch single-platform with --load. arm64 runs under QEMU binfmt. - name: build amd64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-endpoint-reconciler platforms: linux/amd64 @@ -67,7 +67,7 @@ jobs: - name: smoke amd64 (deps import) run: docker run --rm --entrypoint python reconciler:pr-amd64-${{ github.sha }} -c "import boto3, kubernetes; print('reconciler ok', __import__('platform').machine())" - name: build arm64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-endpoint-reconciler platforms: linux/arm64 @@ -93,11 +93,11 @@ jobs: # Third-party actions pinned by commit SHA below this line (the job holds # AWS creds after configure-aws-credentials). Resolve/refresh SHAs with: # gh api repos///git/refs/tags/ --jq .object.sha - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: compute image tag (-) id: meta run: | @@ -108,7 +108,7 @@ jobs: [ -n "$ver" ] || { echo "could not parse version from $VALUES"; exit 1; } echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT" - name: build amd64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-endpoint-reconciler platforms: linux/amd64 @@ -118,7 +118,7 @@ jobs: - name: smoke amd64 BEFORE push (deps import) run: docker run --rm --entrypoint python reconciler:amd64-${{ github.sha }} -c "import boto3, kubernetes; print('reconciler ok', __import__('platform').machine())" - name: build arm64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-endpoint-reconciler platforms: linux/arm64 @@ -130,16 +130,16 @@ jobs: # --- AWS creds appear here; everything after is privileged --- - name: configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.JENKINS_ENDPOINT_RECONCILER_IMAGE_PUSH_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: ECR login id: ecr - uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: push (multi-arch manifest list) with SBOM + provenance id: push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-endpoint-reconciler platforms: linux/amd64,linux/arm64 @@ -179,7 +179,7 @@ jobs: contents: write # createCommitOnBranch on the bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: open bump PR diff --git a/.github/workflows/build-jenkins-image.yml b/.github/workflows/build-jenkins-image.yml index 66b424f2..1383fcf2 100644 --- a/.github/workflows/build-jenkins-image.yml +++ b/.github/workflows/build-jenkins-image.yml @@ -31,7 +31,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -46,21 +46,21 @@ jobs: permissions: contents: read # explicitly NO id-token steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false # docker/* is not in the repo zizmor ref-pin allowlist (.github/zizmor.yml), # so its actions are SHA-pinned everywhere. Refresh with: # gh api repos/docker//git/refs/tags/ --jq .object.sha - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: install jq run: sudo apt-get update && sudo apt-get install -y jq - name: fetch + verify fork HPIs working-directory: images/jenkins run: ./fetch-hpis.sh - name: build amd64 (load to local daemon, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/amd64 @@ -70,7 +70,7 @@ jobs: - name: smoke-boot amd64 (empty-home AND restored-home) run: images/jenkins/smoke-boot.sh jenkins-percona:pr-${{ github.sha }} - name: build arm64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/arm64 @@ -106,11 +106,11 @@ jobs: # AWS creds after configure-aws-credentials). Resolve/refresh the SHAs with: # gh api repos///git/refs/tags/ --jq .object.sha # (dereference annotated-tag objects via .../git/tags/ --jq .object.sha) - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: compute image tag (-) id: meta run: echo "tag=${JENKINS_LTS}-${GITHUB_SHA}" >> "$GITHUB_OUTPUT" @@ -120,7 +120,7 @@ jobs: working-directory: images/jenkins run: ./fetch-hpis.sh - name: build amd64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/amd64 @@ -130,7 +130,7 @@ jobs: - name: smoke-boot amd64 BEFORE push (empty-home AND restored-home) run: images/jenkins/smoke-boot.sh jenkins-percona:${{ github.sha }} - name: build arm64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/arm64 @@ -142,16 +142,16 @@ jobs: # --- AWS creds appear here; everything after is privileged --- - name: configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.JENKINS_IMAGE_PUSH_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: ECR login id: ecr - uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: push (multi-arch manifest list) with SBOM + provenance id: push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/amd64,linux/arm64 @@ -206,7 +206,7 @@ jobs: contents: write # createCommitOnBranch on the bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: open bump PR diff --git a/.github/workflows/build-jenkins-mcp-image.yml b/.github/workflows/build-jenkins-mcp-image.yml index 65087db4..5ead79cf 100644 --- a/.github/workflows/build-jenkins-mcp-image.yml +++ b/.github/workflows/build-jenkins-mcp-image.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -41,10 +41,10 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - name: sync (frozen) @@ -69,18 +69,18 @@ jobs: permissions: contents: read # explicitly NO id-token steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false # docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with: # gh api repos/docker//git/refs/tags/ --jq .object.sha - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 # A multi-arch manifest cannot be loaded into the daemon, so build + smoke each # arch single-platform with --load. arm64 runs under the QEMU binfmt registered # by setup-qemu above. - name: build amd64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-mcp platforms: linux/amd64 @@ -90,7 +90,7 @@ jobs: - name: smoke amd64 (/healthz) run: images/jenkins-mcp/smoke.sh jenkins-mcp:pr-amd64-${{ github.sha }} - name: build arm64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-mcp platforms: linux/arm64 @@ -116,11 +116,11 @@ jobs: # Third-party actions pinned by commit SHA below this line (the job holds # AWS creds after configure-aws-credentials). Resolve/refresh SHAs with: # gh api repos///git/refs/tags/ --jq .object.sha - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: compute image tag (-) id: meta run: | @@ -136,7 +136,7 @@ jobs: esac echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT" - name: build amd64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-mcp platforms: linux/amd64 @@ -146,7 +146,7 @@ jobs: - name: smoke-boot amd64 BEFORE push (/healthz) run: images/jenkins-mcp/smoke.sh jenkins-mcp:amd64-${{ github.sha }} - name: build arm64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-mcp platforms: linux/arm64 @@ -158,16 +158,16 @@ jobs: # --- AWS creds appear here; everything after is privileged --- - name: configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.JENKINS_MCP_IMAGE_PUSH_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: ECR login id: ecr - uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: push (multi-arch manifest list) with SBOM + provenance id: push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins-mcp platforms: linux/amd64,linux/arm64 @@ -208,7 +208,7 @@ jobs: contents: write # createCommitOnBranch on the bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: open bump PR diff --git a/.github/workflows/build-mtr-ingest-image.yml b/.github/workflows/build-mtr-ingest-image.yml index 706bfe14..ed1710ac 100644 --- a/.github/workflows/build-mtr-ingest-image.yml +++ b/.github/workflows/build-mtr-ingest-image.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -41,10 +41,10 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - name: pytest @@ -64,17 +64,17 @@ jobs: permissions: contents: read # explicitly NO id-token steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false # docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with: # gh api repos/docker//git/refs/tags/ --jq .object.sha - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 # A multi-arch manifest cannot be loaded into the daemon, so build + smoke # each arch single-platform with --load. arm64 runs under QEMU binfmt. - name: build amd64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/mtr-ingest platforms: linux/amd64 @@ -84,7 +84,7 @@ jobs: - name: smoke amd64 (CLI runs) run: docker run --rm mtr-ingest:pr-amd64-${{ github.sha }} --help - name: build arm64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/mtr-ingest platforms: linux/arm64 @@ -110,11 +110,11 @@ jobs: # Third-party actions pinned by commit SHA below this line (the job holds # AWS creds after configure-aws-credentials). Resolve/refresh SHAs with: # gh api repos///git/refs/tags/ --jq .object.sha - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: compute image tag (-) id: meta run: | @@ -131,7 +131,7 @@ jobs: esac echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT" - name: build amd64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/mtr-ingest platforms: linux/amd64 @@ -141,7 +141,7 @@ jobs: - name: smoke amd64 BEFORE push (CLI runs) run: docker run --rm mtr-ingest:amd64-${{ github.sha }} --help - name: build arm64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/mtr-ingest platforms: linux/arm64 @@ -153,16 +153,16 @@ jobs: # --- AWS creds appear here; everything after is privileged --- - name: configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.MTR_INGEST_IMAGE_PUSH_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: ECR login id: ecr - uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 - name: push (multi-arch manifest list) with SBOM + provenance id: push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/mtr-ingest platforms: linux/amd64,linux/arm64 @@ -202,7 +202,7 @@ jobs: contents: write # createCommitOnBranch on the bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: open bump PR diff --git a/.github/workflows/build-snapscheduler-image.yml b/.github/workflows/build-snapscheduler-image.yml index a682d491..8ddc2dbc 100644 --- a/.github/workflows/build-snapscheduler-image.yml +++ b/.github/workflows/build-snapscheduler-image.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -51,15 +51,15 @@ jobs: permissions: contents: read # explicitly NO id-token steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false # docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with: # gh api repos/docker//git/refs/tags/ --jq .object.sha - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: build amd64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/snapscheduler platforms: linux/amd64 @@ -75,7 +75,7 @@ jobs: out="$(docker run --rm snapscheduler:pr-amd64-${{ github.sha }} --help 2>&1 || true)" echo "$out" | grep -q 'Usage of /manager' || { echo "amd64 binary did not run"; exit 1; } - name: build arm64 (load, no push) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/snapscheduler platforms: linux/arm64 @@ -104,11 +104,11 @@ jobs: # Third-party actions pinned by commit SHA below this line (the job holds # AWS creds after configure-aws-credentials). Resolve/refresh SHAs with: # gh api repos///git/refs/tags/ --jq .object.sha - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: compute image tag (-) id: meta run: | @@ -118,7 +118,7 @@ jobs: [ -n "$ver" ] || { echo "could not parse SNAPSCHEDULER_VERSION from Dockerfile"; exit 1; } echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT" - name: build amd64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/snapscheduler platforms: linux/amd64 @@ -131,7 +131,7 @@ jobs: out="$(docker run --rm snapscheduler:amd64-${{ github.sha }} --help 2>&1 || true)" echo "$out" | grep -q 'Usage of /manager' || { echo "amd64 binary did not run"; exit 1; } - name: build arm64 (load, NO push yet) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/snapscheduler platforms: linux/arm64 @@ -146,13 +146,13 @@ jobs: # --- AWS creds appear here; everything after is privileged --- - name: configure AWS credentials (OIDC) - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: role-to-assume: ${{ secrets.SNAPSCHEDULER_IMAGE_PUSH_ROLE_ARN }} aws-region: ${{ env.AWS_REGION }} - name: ECR login id: ecr - uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2 + uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2 # The repo is tag-IMMUTABLE: a workflow_dispatch re-run at the same commit # would compute the same - tag and the push would fail # opaquely. Fail early with a clear message instead. @@ -170,7 +170,7 @@ jobs: fi - name: push (multi-arch manifest list) with SBOM + provenance id: push - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/snapscheduler platforms: linux/amd64,linux/arm64 @@ -220,7 +220,7 @@ jobs: contents: write # createCommitOnBranch on the bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: open bump PR diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 92840c3b..8f47d8db 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -38,7 +38,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2 @@ -71,7 +71,7 @@ jobs: # The config scan is static (no tofu init needed); skip the vendored module # cache and the local plan snapshot. steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 @@ -89,10 +89,10 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: '3.12' - name: pip install yamllint + pyyaml @@ -137,10 +137,10 @@ jobs: # no YAML anchors/aliases (JCasC SnakeYAML caps aliases at 50 -- the reload # fails above that). steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: '3.12' - name: pip install pyyaml @@ -153,7 +153,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - name: install helm (pinned + sha-verified) @@ -175,10 +175,10 @@ jobs: # Pure-Python + moto, no AWS credentials. Uses setup-python + pip to match # the `yaml` job (astral-sh/setup-uv is not in the zizmor ref-pin allowlist). steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v7 with: python-version: '3.14' # match the Lambda runtime cache: 'pip' diff --git a/.github/workflows/refresh-fork-locks.yml b/.github/workflows/refresh-fork-locks.yml index 6c401170..0364fec3 100644 --- a/.github/workflows/refresh-fork-locks.yml +++ b/.github/workflows/refresh-fork-locks.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: ./.github/actions/actions-lint @@ -50,7 +50,7 @@ jobs: contents: write # createCommitOnBranch on a bump branch pull-requests: write # gh pr create steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -73,14 +73,14 @@ jobs: # ---- prove the new pin actually builds + boots BEFORE opening the PR ---- - name: setup buildx if: steps.refresh.outputs.changed == 'true' - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: fetch + verify fork HPIs (new lock) if: steps.refresh.outputs.changed == 'true' working-directory: images/jenkins run: ./fetch-hpis.sh - name: build (amd64, load, no push) if: steps.refresh.outputs.changed == 'true' - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: images/jenkins platforms: linux/amd64