Skip to content

chore(deps): bump the actions group across 1 directory with 8 updates #382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the actions group across 1 directory with 8 updates #382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions .github/workflows/build-jenkins-endpoint-reconciler-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: ./.github/actions/actions-lint
Expand All @@ -47,17 +47,17 @@ jobs:
permissions:
contents: read # explicitly NO id-token
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
# docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with:
# gh api repos/docker/<repo>/git/refs/tags/<tag> --jq .object.sha
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
# A multi-arch manifest cannot be loaded into the daemon, so build + smoke
# each arch single-platform with --load. arm64 runs under QEMU binfmt.
- name: build amd64 (load, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-endpoint-reconciler
platforms: linux/amd64
Expand All @@ -67,7 +67,7 @@ jobs:
- name: smoke amd64 (deps import)
run: docker run --rm --entrypoint python reconciler:pr-amd64-${{ github.sha }} -c "import boto3, kubernetes; print('reconciler ok', __import__('platform').machine())"
- name: build arm64 (load, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-endpoint-reconciler
platforms: linux/arm64
Expand All @@ -93,11 +93,11 @@ jobs:
# Third-party actions pinned by commit SHA below this line (the job holds
# AWS creds after configure-aws-credentials). Resolve/refresh SHAs with:
# gh api repos/<owner>/<repo>/git/refs/tags/<tag> --jq .object.sha
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: compute image tag (<version>-<short-sha>)
id: meta
run: |
Expand All @@ -108,7 +108,7 @@ jobs:
[ -n "$ver" ] || { echo "could not parse version from $VALUES"; exit 1; }
echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
- name: build amd64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-endpoint-reconciler
platforms: linux/amd64
Expand All @@ -118,7 +118,7 @@ jobs:
- name: smoke amd64 BEFORE push (deps import)
run: docker run --rm --entrypoint python reconciler:amd64-${{ github.sha }} -c "import boto3, kubernetes; print('reconciler ok', __import__('platform').machine())"
- name: build arm64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-endpoint-reconciler
platforms: linux/arm64
Expand All @@ -130,16 +130,16 @@ jobs:

# --- AWS creds appear here; everything after is privileged ---
- name: configure AWS credentials (OIDC)
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ secrets.JENKINS_ENDPOINT_RECONCILER_IMAGE_PUSH_ROLE_ARN }}
aws-region: ${{ env.AWS_REGION }}
- name: ECR login
id: ecr
uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
- name: push (multi-arch manifest list) with SBOM + provenance
id: push
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-endpoint-reconciler
platforms: linux/amd64,linux/arm64
Expand Down Expand Up @@ -179,7 +179,7 @@ jobs:
contents: write # createCommitOnBranch on the bump branch
pull-requests: write # gh pr create
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: open bump PR
Expand Down
30 changes: 15 additions & 15 deletions .github/workflows/build-jenkins-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: ./.github/actions/actions-lint
Expand All @@ -46,21 +46,21 @@ jobs:
permissions:
contents: read # explicitly NO id-token
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
# docker/* is not in the repo zizmor ref-pin allowlist (.github/zizmor.yml),
# so its actions are SHA-pinned everywhere. Refresh with:
# gh api repos/docker/<repo>/git/refs/tags/<tag> --jq .object.sha
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: install jq
run: sudo apt-get update && sudo apt-get install -y jq
- name: fetch + verify fork HPIs
working-directory: images/jenkins
run: ./fetch-hpis.sh
- name: build amd64 (load to local daemon, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins
platforms: linux/amd64
Expand All @@ -70,7 +70,7 @@ jobs:
- name: smoke-boot amd64 (empty-home AND restored-home)
run: images/jenkins/smoke-boot.sh jenkins-percona:pr-${{ github.sha }}
- name: build arm64 (load, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins
platforms: linux/arm64
Expand Down Expand Up @@ -106,11 +106,11 @@ jobs:
# AWS creds after configure-aws-credentials). Resolve/refresh the SHAs with:
# gh api repos/<owner>/<repo>/git/refs/tags/<tag> --jq .object.sha
# (dereference annotated-tag objects via .../git/tags/<sha> --jq .object.sha)
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: compute image tag (<lts>-<sha>)
id: meta
run: echo "tag=${JENKINS_LTS}-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
Expand All @@ -120,7 +120,7 @@ jobs:
working-directory: images/jenkins
run: ./fetch-hpis.sh
- name: build amd64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins
platforms: linux/amd64
Expand All @@ -130,7 +130,7 @@ jobs:
- name: smoke-boot amd64 BEFORE push (empty-home AND restored-home)
run: images/jenkins/smoke-boot.sh jenkins-percona:${{ github.sha }}
- name: build arm64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins
platforms: linux/arm64
Expand All @@ -142,16 +142,16 @@ jobs:

# --- AWS creds appear here; everything after is privileged ---
- name: configure AWS credentials (OIDC)
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ secrets.JENKINS_IMAGE_PUSH_ROLE_ARN }}
aws-region: ${{ env.AWS_REGION }}
- name: ECR login
id: ecr
uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
- name: push (multi-arch manifest list) with SBOM + provenance
id: push
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins
platforms: linux/amd64,linux/arm64
Expand Down Expand Up @@ -206,7 +206,7 @@ jobs:
contents: write # createCommitOnBranch on the bump branch
pull-requests: write # gh pr create
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: open bump PR
Expand Down
34 changes: 17 additions & 17 deletions .github/workflows/build-jenkins-mcp-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: ./.github/actions/actions-lint
Expand All @@ -41,10 +41,10 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
- uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
with:
enable-cache: true
- name: sync (frozen)
Expand All @@ -69,18 +69,18 @@ jobs:
permissions:
contents: read # explicitly NO id-token
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
persist-credentials: false
# docker/* is SHA-pinned (not in the repo zizmor ref-pin allowlist). Refresh with:
# gh api repos/docker/<repo>/git/refs/tags/<tag> --jq .object.sha
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
# A multi-arch manifest cannot be loaded into the daemon, so build + smoke each
# arch single-platform with --load. arm64 runs under the QEMU binfmt registered
# by setup-qemu above.
- name: build amd64 (load, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-mcp
platforms: linux/amd64
Expand All @@ -90,7 +90,7 @@ jobs:
- name: smoke amd64 (/healthz)
run: images/jenkins-mcp/smoke.sh jenkins-mcp:pr-amd64-${{ github.sha }}
- name: build arm64 (load, no push)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-mcp
platforms: linux/arm64
Expand All @@ -116,11 +116,11 @@ jobs:
# Third-party actions pinned by commit SHA below this line (the job holds
# AWS creds after configure-aws-credentials). Resolve/refresh SHAs with:
# gh api repos/<owner>/<repo>/git/refs/tags/<tag> --jq .object.sha
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: compute image tag (<version>-<short-sha>)
id: meta
run: |
Expand All @@ -136,7 +136,7 @@ jobs:
esac
echo "tag=${ver}-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
- name: build amd64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-mcp
platforms: linux/amd64
Expand All @@ -146,7 +146,7 @@ jobs:
- name: smoke-boot amd64 BEFORE push (/healthz)
run: images/jenkins-mcp/smoke.sh jenkins-mcp:amd64-${{ github.sha }}
- name: build arm64 (load, NO push yet)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-mcp
platforms: linux/arm64
Expand All @@ -158,16 +158,16 @@ jobs:

# --- AWS creds appear here; everything after is privileged ---
- name: configure AWS credentials (OIDC)
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: ${{ secrets.JENKINS_MCP_IMAGE_PUSH_ROLE_ARN }}
aws-region: ${{ env.AWS_REGION }}
- name: ECR login
id: ecr
uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
- name: push (multi-arch manifest list) with SBOM + provenance
id: push
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: images/jenkins-mcp
platforms: linux/amd64,linux/arm64
Expand Down Expand Up @@ -208,7 +208,7 @@ jobs:
contents: write # createCommitOnBranch on the bump branch
pull-requests: write # gh pr create
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: open bump PR
Expand Down
Loading
Loading