From 0ea4603f1cdc05416d7a2421461b9159799c7391 Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Fri, 7 Aug 2026 22:51:49 -0700 Subject: [PATCH] ci: Update all GHA actions to latest versions Signed-off-by: Larry Gritz --- .github/workflows/analysis.yml | 6 +++--- .github/workflows/build-steps.yml | 14 +++++++------- .github/workflows/release-notice.yml | 2 +- .github/workflows/release-sign.yml | 4 ++-- .github/workflows/scorecards.yml | 8 ++++---- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index fab91a2ef0..5f0657b071 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -101,10 +101,10 @@ jobs: # positives, every time we download a dependency. We should use it only # on CI runs where we are producing artifacts that users might rely on. # - name: Harden Runner - # uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813 # v1.4.3 + # uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 # with: # egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: '0' - name: Prepare ccache timestamp @@ -112,7 +112,7 @@ jobs: run: echo "::set-output name=date::`date -u +'%Y-%m-%dT%H:%M:%SZ'`" - name: ccache id: ccache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /tmp/ccache key: ${{github.job}}-${{matrix.nametag}}-${{steps.ccache_cache_keys.outputs.date}} diff --git a/.github/workflows/build-steps.yml b/.github/workflows/build-steps.yml index 6e9615e7ea..891cb3dbd2 100644 --- a/.github/workflows/build-steps.yml +++ b/.github/workflows/build-steps.yml @@ -158,7 +158,7 @@ jobs: curl --silent https://unofficial-builds.nodejs.org/download/release/v20.18.1/node-v20.18.1-linux-x64-glibc-217.tar.xz | tar -xJ --strip-components 1 -C /node20217 -f - - name: Checkout repo if: inputs.old_node != '1' - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout repo-OLD if: inputs.old_node == '1' # Must use an old checkout action for old containers @@ -180,7 +180,7 @@ jobs: - name: ccache-restore if: inputs.old_node != '1' id: ccache-restore - uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ env.CCACHE_DIR }} key: ${{inputs.nametag}}-${{steps.ccache_cache_keys.outputs.date}} @@ -203,7 +203,7 @@ jobs: sudo apt-get install -y g++-${{inputs.gcc_action_ver}} - name: Install python if: inputs.python_action_ver != '' - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python_action_ver }} - name: Dependencies @@ -227,14 +227,14 @@ jobs: fi - name: Install sonar-scanner and build-wrapper if: inputs.sonar == '1' - uses: sonarsource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0 + uses: sonarsource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 - name: Build if: inputs.skip_build != '1' shell: bash run: src/build-scripts/ci-build.bash - name: Check out ABI standard if: inputs.abi_check != '' - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{inputs.abi_check}} path: abi_standard @@ -249,7 +249,7 @@ jobs: - name: ccache-save if: inputs.old_node != '1' id: ccache-save - uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ env.CCACHE_DIR }} key: ${{inputs.nametag}}-${{steps.ccache_cache_keys.outputs.date}} @@ -303,7 +303,7 @@ jobs: time make doxygen time make sphinx - name: Upload testsuite debugging artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: ${{ inputs.old_node != '1' && (failure() || inputs.build_docs == '1' || inputs.benchmark == '1' || inputs.abi_check != '') }} with: name: osl-${{github.job}}-${{inputs.nametag}} diff --git a/.github/workflows/release-notice.yml b/.github/workflows/release-notice.yml index 35dfa90858..097c045ecb 100644 --- a/.github/workflows/release-notice.yml +++ b/.github/workflows/release-notice.yml @@ -23,4 +23,4 @@ jobs: slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }} slack_channel: "#release-announcements" project_logo: "https://artwork.aswf.io/projects/open-shading-language/icon/color/open-shading-language-icon-color.png" - uses: jmertic/slack-release-notifier@main + uses: jmertic/slack-release-notifier@9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a # 20260406 diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml index c21e94526e..c80268d403 100644 --- a/.github/workflows/release-sign.yml +++ b/.github/workflows/release-sign.yml @@ -49,13 +49,13 @@ jobs: shell: bash - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create archive run: git archive --format=tar.gz -o ${OSL_TARBALL} --prefix ${OSL_PREFIX} ${TAG} - name: Sign archive with Sigstore - uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0 + uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0 with: inputs: ${{ env.OSL_TARBALL }} upload-signing-artifacts: false diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 8118f8fcce..5bccdbc78e 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -37,12 +37,12 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # v1.1.1 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif @@ -61,7 +61,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v3.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif @@ -69,6 +69,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: results.sarif