diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 755a9c5c..1c208811 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -61,7 +61,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" cache: pip @@ -76,7 +76,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" cache: pip diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91dd8c49..26eaac15 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -134,7 +134,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -147,7 +147,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -209,7 +209,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -222,7 +222,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -345,7 +345,7 @@ jobs: timeout-minutes: 6 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-llvm-cov @@ -415,7 +415,7 @@ jobs: # attributes the modern nightly compiler rejects, so the install # never gets off the ground. The prebuilt binary avoids the entire # transitive-dep compile. - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-fuzz @@ -470,7 +470,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -485,7 +485,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -549,7 +549,7 @@ jobs: # same taiki-e prebuilt-binary installer we already use for # cargo-llvm-cov and cargo-fuzz; it tracks the latest wasm-pack # release, which has `--features` as a top-level flag (since 0.12). - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: wasm-pack @@ -676,7 +676,7 @@ jobs: timeout-minutes: 6 - name: Install cbindgen - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cbindgen @@ -735,7 +735,7 @@ jobs: # local store instead of hitting nuget.org every run. No packages.lock.json # exists, so key on the project files; never block the job on a slow restore. - name: Cache NuGet packages - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 continue-on-error: true timeout-minutes: 6 with: @@ -802,7 +802,7 @@ jobs: - name: Set up Go id: setup-go continue-on-error: true - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "stable" cache: false @@ -816,7 +816,7 @@ jobs: - name: Set up Go (retry) if: steps.setup-go.outcome == 'failure' - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "stable" cache: false @@ -937,7 +937,7 @@ jobs: run: cargo build -p wickra-c --release - name: Set up R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: r-version: "release" use-public-rspm: true @@ -947,7 +947,7 @@ jobs: # compiling testthat / knitr and their deps from source — the slow, flaky # path that previously blew past the job timeout on the ubuntu runner. - name: Install R dependencies (cached binaries) - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: working-directory: bindings/r extra-packages: | @@ -1052,7 +1052,7 @@ jobs: - name: Set up JDK 25 id: setup-java continue-on-error: true - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" @@ -1067,7 +1067,7 @@ jobs: - name: Set up JDK 25 (retry) if: steps.setup-java.outcome == 'failure' - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 149f8232..1d161226 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -111,7 +111,7 @@ jobs: # consumers can audit the published dependency tree without # re-resolving Cargo.lock. - name: Install cargo-cyclonedx - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-cyclonedx @@ -165,7 +165,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Wait before Python retry @@ -176,7 +176,7 @@ jobs: sleep 30 - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Sync root README into bindings/python so it ships with the wheel @@ -548,7 +548,7 @@ jobs: - name: Install wasm-pack (latest, via prebuilt binary) # See the matching note in ci.yml: jetli's default installs an old # 0.10.x wasm-pack whose build subcommand rejects --features. - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: wasm-pack @@ -804,7 +804,7 @@ jobs: # setup-java writes a settings.xml with the 'central' server credentials # (mapped from the env vars below) and imports the GPG signing key. - name: Set up JDK 25 + Maven Central credentials + GPG - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" @@ -1076,7 +1076,7 @@ jobs: merge-multiple: true - name: Attest build provenance id: attest - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: | artifacts/crates/*.crate diff --git a/.github/workflows/sync-metadata.yml b/.github/workflows/sync-metadata.yml index 35a6a0a9..7fc64cdc 100644 --- a/.github/workflows/sync-metadata.yml +++ b/.github/workflows/sync-metadata.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Audit repo-metadata.toml drift diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 8cd149e7..abf18b60 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -37,4 +37,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7