From 350230cd07db5dd956e527032190d4987c8b7443 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 18:44:18 +0200 Subject: [PATCH] deps(actions): bump the github-actions group with 9 updates (#354) Bumps the github-actions group with 9 updates: | Package | From | To | | --- | --- | --- | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.1` | `2.82.5` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` | | [r-lib/actions/setup-r](https://github.com/r-lib/actions) | `2.12.0` | `2.12.1` | | [r-lib/actions/setup-r-dependencies](https://github.com/r-lib/actions) | `2.12.0` | `2.12.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.3.0` | `5.4.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.1.1` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.6` | `0.5.7` | Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) Updates `taiki-e/install-action` from 2.82.1 to 2.82.5 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/8b3c737da4b541bf0fb5a3e0488ff20535badac9...bffeee26d4db9be238a4ea78d8826604ebcb594d) Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16) Updates `r-lib/actions/setup-r` from 2.12.0 to 2.12.1 - [Release notes](https://github.com/r-lib/actions/releases) - [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md) - [Commits](https://github.com/r-lib/actions/compare/a51a8012b0aab7c32ef9d19bf54da93f3254335e...d3c5be51b12e724e68f33216ca3c148b66d5f0b6) Updates `r-lib/actions/setup-r-dependencies` from 2.12.0 to 2.12.1 - [Release notes](https://github.com/r-lib/actions/releases) - [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md) - [Commits](https://github.com/r-lib/actions/compare/a51a8012b0aab7c32ef9d19bf54da93f3254335e...d3c5be51b12e724e68f33216ca3c148b66d5f0b6) Updates `actions/setup-java` from 5.3.0 to 5.4.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/ad2b38190b15e4d6bdf0c97fb4fca8412226d287...1bcf9fb12cf4aa7d266a90ae39939e61372fe520) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32...0f67c3f4856b2e3261c31976d6725780e5e4c373) Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.82.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: r-lib/actions/setup-r dependency-version: 2.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: r-lib/actions/setup-r-dependencies dependency-version: 2.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/bench.yml | 4 ++-- .github/workflows/ci.yml | 34 ++++++++++++++--------------- .github/workflows/release.yml | 12 +++++----- .github/workflows/sync-metadata.yml | 2 +- .github/workflows/zizmor.yml | 2 +- 5 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 755a9c5c..1c208811 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -61,7 +61,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" cache: pip @@ -76,7 +76,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" cache: pip diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 91dd8c49..26eaac15 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -134,7 +134,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -147,7 +147,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -209,7 +209,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -222,7 +222,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" @@ -345,7 +345,7 @@ jobs: timeout-minutes: 6 - name: Install cargo-llvm-cov - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-llvm-cov @@ -415,7 +415,7 @@ jobs: # attributes the modern nightly compiler rejects, so the install # never gets off the ground. The prebuilt binary avoids the entire # transitive-dep compile. - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-fuzz @@ -470,7 +470,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -485,7 +485,7 @@ jobs: - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} cache: pip @@ -549,7 +549,7 @@ jobs: # same taiki-e prebuilt-binary installer we already use for # cargo-llvm-cov and cargo-fuzz; it tracks the latest wasm-pack # release, which has `--features` as a top-level flag (since 0.12). - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: wasm-pack @@ -676,7 +676,7 @@ jobs: timeout-minutes: 6 - name: Install cbindgen - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cbindgen @@ -735,7 +735,7 @@ jobs: # local store instead of hitting nuget.org every run. No packages.lock.json # exists, so key on the project files; never block the job on a slow restore. - name: Cache NuGet packages - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 continue-on-error: true timeout-minutes: 6 with: @@ -802,7 +802,7 @@ jobs: - name: Set up Go id: setup-go continue-on-error: true - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "stable" cache: false @@ -816,7 +816,7 @@ jobs: - name: Set up Go (retry) if: steps.setup-go.outcome == 'failure' - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: "stable" cache: false @@ -937,7 +937,7 @@ jobs: run: cargo build -p wickra-c --release - name: Set up R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: r-version: "release" use-public-rspm: true @@ -947,7 +947,7 @@ jobs: # compiling testthat / knitr and their deps from source — the slow, flaky # path that previously blew past the job timeout on the ubuntu runner. - name: Install R dependencies (cached binaries) - uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2 + uses: r-lib/actions/setup-r-dependencies@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 with: working-directory: bindings/r extra-packages: | @@ -1052,7 +1052,7 @@ jobs: - name: Set up JDK 25 id: setup-java continue-on-error: true - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" @@ -1067,7 +1067,7 @@ jobs: - name: Set up JDK 25 (retry) if: steps.setup-java.outcome == 'failure' - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 149f8232..1d161226 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -111,7 +111,7 @@ jobs: # consumers can audit the published dependency tree without # re-resolving Cargo.lock. - name: Install cargo-cyclonedx - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: cargo-cyclonedx @@ -165,7 +165,7 @@ jobs: - name: Set up Python id: setup_python continue-on-error: true - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Wait before Python retry @@ -176,7 +176,7 @@ jobs: sleep 30 - name: Set up Python (retry) if: steps.setup_python.outcome == 'failure' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" - name: Sync root README into bindings/python so it ships with the wheel @@ -548,7 +548,7 @@ jobs: - name: Install wasm-pack (latest, via prebuilt binary) # See the matching note in ci.yml: jetli's default installs an old # 0.10.x wasm-pack whose build subcommand rejects --features. - uses: taiki-e/install-action@8b3c737da4b541bf0fb5a3e0488ff20535badac9 # v2.82.1 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2.82.5 timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job with: tool: wasm-pack @@ -804,7 +804,7 @@ jobs: # setup-java writes a settings.xml with the 'central' server credentials # (mapped from the env vars below) and imports the GPG signing key. - name: Set up JDK 25 + Maven Central credentials + GPG - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0 + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 with: distribution: temurin java-version: "25" @@ -1076,7 +1076,7 @@ jobs: merge-multiple: true - name: Attest build provenance id: attest - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: subject-path: | artifacts/crates/*.crate diff --git a/.github/workflows/sync-metadata.yml b/.github/workflows/sync-metadata.yml index 35a6a0a9..7fc64cdc 100644 --- a/.github/workflows/sync-metadata.yml +++ b/.github/workflows/sync-metadata.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Audit repo-metadata.toml drift diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 8cd149e7..abf18b60 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -37,4 +37,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7