diff --git a/.github/workflows/application-matrix-builds.yml b/.github/workflows/application-matrix-builds.yml index c9a5e91b..a5a72bdb 100644 --- a/.github/workflows/application-matrix-builds.yml +++ b/.github/workflows/application-matrix-builds.yml @@ -591,7 +591,7 @@ jobs: if-no-files-found: ignore - name: Upload SARIF security results - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 if: always() && needs.parse-configuration.outputs.enableSecurityScan == 'true' with: sarif_file: ${{ github.workspace }}/security-reports diff --git a/.github/workflows/cluster-test-terraform.yml b/.github/workflows/cluster-test-terraform.yml index 0d8553cc..c682293e 100644 --- a/.github/workflows/cluster-test-terraform.yml +++ b/.github/workflows/cluster-test-terraform.yml @@ -176,7 +176,7 @@ jobs: fi - name: Azure Login - uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1 + uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0 with: creds: ${{ secrets.AZURE_CREDENTIALS }} enable-AzPSSession: true diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f122c699..66fc8636 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -58,7 +58,7 @@ jobs: fetch-depth: 0 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: none @@ -69,10 +69,10 @@ jobs: # queries: security-extended,security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml index 5dba30cf..309033ab 100644 --- a/.github/workflows/pages-deploy.yml +++ b/.github/workflows/pages-deploy.yml @@ -123,7 +123,7 @@ jobs: sparse-checkout-cone-mode: false - name: Generate SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: artifact-name: documentation-sbom-${{ github.run_number }} output-file: documentation-sbom.spdx.json @@ -152,7 +152,7 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 - name: Verify deployment run: | diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index d31bbbed..6990cbaf 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -69,16 +69,16 @@ jobs: fetch-depth: 0 - name: Initialize CodeQL - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: languages: ${{ matrix.language }} build-mode: none - name: Autobuild - uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 00a46ada..72647369 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -31,7 +31,7 @@ jobs: client-id: ${{ vars.RELEASE_APP_CLIENT_ID }} private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - - uses: chainguard-dev/actions/setup-gitsign@0ffab11a71c1b7bd68ddf94665a8ec88b116223d # v1.6.33 + - uses: chainguard-dev/actions/setup-gitsign@142d22e4cec7c824db396585b9bc86f76f7c1732 # v1.6.35 - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 id: release @@ -103,7 +103,7 @@ jobs: ref: ${{ needs.release-please.outputs.tag_name }} fetch-depth: 1 - - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: format: spdx-json output-file: dep-sbom.spdx.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 63b9259b..6b3fd4e9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -36,7 +36,7 @@ jobs: publish_results: true - name: Upload SARIF results - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: results.sarif category: openssf-scorecard diff --git a/.github/workflows/security-comprehensive.yml b/.github/workflows/security-comprehensive.yml index 7722924e..123d53f4 100644 --- a/.github/workflows/security-comprehensive.yml +++ b/.github/workflows/security-comprehensive.yml @@ -231,7 +231,7 @@ jobs: - name: Upload SARIF results to GitHub Security if: always() - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/security-deployment.yml b/.github/workflows/security-deployment.yml index cf9eccd8..3e914bd0 100644 --- a/.github/workflows/security-deployment.yml +++ b/.github/workflows/security-deployment.yml @@ -156,7 +156,7 @@ jobs: - name: Upload SARIF results to GitHub Security if: always() - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: scorecard-results.sarif diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index db448387..05c14153 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -129,7 +129,7 @@ jobs: - name: Upload SARIF to GitHub Security if: always() - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: security-results/ continue-on-error: true diff --git a/.github/workflows/verify-tag-signature.yml b/.github/workflows/verify-tag-signature.yml index a72bcb38..904d2609 100644 --- a/.github/workflows/verify-tag-signature.yml +++ b/.github/workflows/verify-tag-signature.yml @@ -31,7 +31,7 @@ jobs: fetch-depth: 0 fetch-tags: true - - uses: chainguard-dev/actions/setup-gitsign@0ffab11a71c1b7bd68ddf94665a8ec88b116223d # v1.6.33 + - uses: chainguard-dev/actions/setup-gitsign@142d22e4cec7c824db396585b9bc86f76f7c1732 # v1.6.35 - name: Verify gitsign tag signature run: | diff --git a/.github/workflows/workflow-permissions-scan.yml b/.github/workflows/workflow-permissions-scan.yml index a01e4cf9..ba15f8d5 100644 --- a/.github/workflows/workflow-permissions-scan.yml +++ b/.github/workflows/workflow-permissions-scan.yml @@ -116,7 +116,7 @@ jobs: - name: Upload SARIF results if: ${{ always() && (inputs.upload-sarif != false) && ((github.event_name == 'schedule') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) }} - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 with: sarif_file: logs/workflow-permissions-results.sarif category: workflow-permissions