diff --git a/.github/workflows/codeql-dynamic.yml b/.github/workflows/codeql-dynamic.yml index 6e54c32..e4c379d 100644 --- a/.github/workflows/codeql-dynamic.yml +++ b/.github/workflows/codeql-dynamic.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/codeql-iac.yml b/.github/workflows/codeql-iac.yml index e62a6d0..4fe55c2 100644 --- a/.github/workflows/codeql-iac.yml +++ b/.github/workflows/codeql-iac.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Initialize and Analyze IaC id: codeql_iac diff --git a/.github/workflows/codeql-packs.yml b/.github/workflows/codeql-packs.yml index b79bf2b..1f38f00 100644 --- a/.github/workflows/codeql-packs.yml +++ b/.github/workflows/codeql-packs.yml @@ -17,7 +17,7 @@ jobs: steps: - name: "Set Matrix" id: set-matrix - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: script: | const packs = '${{ inputs.packs }}'.split(','); @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Build and Publish CodeQL Packs" env: diff --git a/.github/workflows/codeql-ql.yml b/.github/workflows/codeql-ql.yml index 02cf7cf..d61b247 100644 --- a/.github/workflows/codeql-ql.yml +++ b/.github/workflows/codeql-ql.yml @@ -18,16 +18,16 @@ jobs: steps: - name: "Checkout repository" - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Set up Rust" - uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0 # v1.85.1 + uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1.85.1 with: toolchain: stable - name: "Restore cached Cargo" id: cache-restore - uses: actions/cache/restore@v4 + uses: actions/cache/restore@v6 with: path: | ~/.cargo/bin/ @@ -119,7 +119,7 @@ jobs: - name: Save Cargo / Rust Cache id: cache-save if: ${{ github.event_name == 'push' }} - uses: actions/cache/save@v4 + uses: actions/cache/save@v6 with: path: | ~/.cargo/bin/ diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml index ec9227d..a09b20b 100644 --- a/.github/workflows/container-publish.yml +++ b/.github/workflows/container-publish.yml @@ -45,20 +45,20 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to the Container registry - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set Container Metadata - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 id: meta with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -72,7 +72,7 @@ jobs: type=semver,pattern=v{{major}}.{{minor}},value=${{ inputs.version }} - name: Build & Publish Container ${{ env.IMAGE_NAME }} - uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 id: build with: file: "${{ inputs.container-file }}" @@ -85,20 +85,20 @@ jobs: # Upload Software Bill of Materials (SBOM) to GitHub - name: Upload SBOM - uses: advanced-security/spdx-dependency-submission-action@5530bab9ee4bbe66420ce8280624036c77f89746 # v0.1.1 + uses: advanced-security/spdx-dependency-submission-action@169d22427d74f3faf93504e70b03eede8dab272a # v0.2.0 with: filePath: '.' filePattern: '*.spdx.json' # Build provenance attestations - name: Attest Container Image - uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true # - name: Attest Container SBOM - # uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3 + # uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 # with: # subject-path:: '*.spdx.json' diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml index cfdd8fa..37859e6 100644 --- a/.github/workflows/container-security.yml +++ b/.github/workflows/container-security.yml @@ -40,13 +40,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build Initial Container - uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 id: build with: file: "${{ inputs.container-file }}" @@ -57,7 +57,7 @@ jobs: # Scan the image for vulnerabilities - name: Run the Anchore / Grype scan action - uses: anchore/scan-action@7c05671ae9be166aeb155bad2d7df9121823df32 # v6.1.0 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 id: scan with: image: localbuild/testimage:latest @@ -65,7 +65,7 @@ jobs: fail-build: ${{ inputs.scanning-block }} - name: Upload SARIF artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: sarif path: ${{ steps.scan.outputs.sarif }} diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 80e9539..bbf70f6 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -63,7 +63,7 @@ jobs: steps: - name: "Checkout" - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Get and Set version" id: set-version env: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 58a2f6b..9f85bcc 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v4 + uses: actions/checkout@v7 # [optional] This setup isn't required but if your repository have a configuration, # we use that versus the centralised config. @@ -43,7 +43,7 @@ jobs: fi - name: 'Dependency Review' - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@v5 with: # this value can also be hardcoded to a remote repository # Example: advanced-security/reusable-workflows/.github/dependency-review.yml@v0.1.0 diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 4370233..9fe4b94 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Check if the .github/labeler.yml file exists - name: Check for labeler configuration @@ -46,7 +46,7 @@ jobs: fi - - uses: "actions/labeler@v5" + - uses: "actions/labeler@v7" with: repo-token: "${{ secrets.GITHUB_TOKEN }}" configuration-path: "${{ steps.labeler-config.outputs.config }}" diff --git a/.github/workflows/language-detection-and-assignment.yml b/.github/workflows/language-detection-and-assignment.yml index 99e8f44..d8c6018 100644 --- a/.github/workflows/language-detection-and-assignment.yml +++ b/.github/workflows/language-detection-and-assignment.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Detect languages id: detect-languages diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml index 0f08e9a..76e6239 100644 --- a/.github/workflows/markdown-lint.yml +++ b/.github/workflows/markdown-lint.yml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Filter Changes" - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d id: changes with: filters: | diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml index 7e9af6a..1f8a1b2 100644 --- a/.github/workflows/python-build.yml +++ b/.github/workflows/python-build.yml @@ -39,10 +39,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/python-linting.yml b/.github/workflows/python-linting.yml index 1e8c157..0cd9f20 100644 --- a/.github/workflows/python-linting.yml +++ b/.github/workflows/python-linting.yml @@ -45,10 +45,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml index 2ee55e3..386050b 100644 --- a/.github/workflows/python-release.yml +++ b/.github/workflows/python-release.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Check release" id: check_release @@ -56,7 +56,7 @@ jobs: fi github-release: - uses: advanced-security/reusable-workflows/.github/workflows/release.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/release.yml@v0.3.5 needs: [ version-changes ] if: ${{ needs.version-changes.outputs.release == 'true' }} secrets: inherit diff --git a/.github/workflows/python-testing.yml b/.github/workflows/python-testing.yml index 1bc64d8..0198812 100644 --- a/.github/workflows/python-testing.yml +++ b/.github/workflows/python-testing.yml @@ -39,10 +39,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/python-vendor.yml b/.github/workflows/python-vendor.yml index d924b70..c72cf7e 100644 --- a/.github/workflows/python-vendor.yml +++ b/.github/workflows/python-vendor.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Get Custom Property" id: get_custom_property env: @@ -51,10 +51,10 @@ jobs: pull-requests: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python ${{ inputs.version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ inputs.version }} @@ -79,7 +79,7 @@ jobs: - name: "Create Pull Request with updated vendored dependencies" if: ${{ steps.vendoring.outputs.changes > 0 }} - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ github.token }} commit-message: "[chore]: Update vendored dependencies" diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index b8cca63..879963f 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -25,14 +25,14 @@ on: jobs: # Run the tests on all supported versions of Python testing: - uses: advanced-security/reusable-workflows/.github/workflows/python-testing.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/python-testing.yml@v0.3.5 secrets: inherit with: versions: ${{ inputs.versions }} # Run linters on the codebase linting: - uses: advanced-security/reusable-workflows/.github/workflows/python-linting.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/python-linting.yml@v0.3.5 needs: [ testing ] secrets: inherit with: @@ -40,7 +40,7 @@ jobs: # Vendor the dependencies into the repository if needed vendoring: - uses: advanced-security/reusable-workflows/.github/workflows/python-vendor.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/python-vendor.yml@v0.3.5 needs: [ testing, linting ] if: ${{ inputs.vendor == 'true' }} secrets: inherit @@ -50,7 +50,7 @@ jobs: # Release a new version of the package release: - uses: advanced-security/reusable-workflows/.github/workflows/python-release.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/python-release.yml@v0.3.5 needs: [ testing, linting ] secrets: inherit with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1cfb4e1..a723e26 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,15 +30,15 @@ jobs: steps: - name: "Checkout" - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Patch Release Me" - uses: 42ByteLabs/patch-release-me@f950db6bce09f2156a5f2d1cc86ac60ed1663a9e # 0.5.3 + uses: 42ByteLabs/patch-release-me@04ea0a696abfc3cfbdfadb279bd9c9dd0b1652a2 # 0.6.6 with: mode: ${{ github.event.inputs.bump }} - name: "Create Release" - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ github.token }} commit-message: "[chore]: Create release for ${{ github.event.inputs.version }}" @@ -61,7 +61,7 @@ jobs: # https://github.com/peter-murray/semver-data-action - name: Parse SemVer id: version - uses: peter-murray/semver-action@5a07021b987a48fb9129231397615329ad74703c # v1.0.1 + uses: peter-murray/semver-action@096534327266864e217e0fb65903cb71df38aa20 # v2.0.0 with: version: ${{ inputs.version }} diff --git a/.github/workflows/sec-opengrep.yml b/.github/workflows/sec-opengrep.yml index 19db2a9..b12f148 100644 --- a/.github/workflows/sec-opengrep.yml +++ b/.github/workflows/sec-opengrep.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout code" - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Download / Install Opengrep" run: | diff --git a/.github/workflows/self-dependency-review.yml b/.github/workflows/self-dependency-review.yml index f357f4e..896feeb 100644 --- a/.github/workflows/self-dependency-review.yml +++ b/.github/workflows/self-dependency-review.yml @@ -19,5 +19,5 @@ permissions: jobs: dependency-review: - uses: advanced-security/reusable-workflows/.github/workflows/dependency-review.yml@v0.3.0 + uses: advanced-security/reusable-workflows/.github/workflows/dependency-review.yml@v0.3.5 secrets: inherit diff --git a/.github/workflows/self-release.yml b/.github/workflows/self-release.yml index 7a68a4b..c2cc24a 100644 --- a/.github/workflows/self-release.yml +++ b/.github/workflows/self-release.yml @@ -15,7 +15,7 @@ jobs: version: ${{ steps.version-changes.outputs.version }} steps: - name: "Checkout" - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: "Fetch Release" id: version-changes diff --git a/.github/workflows/self-wiki.yml b/.github/workflows/self-wiki.yml index 321f339..dd89167 100644 --- a/.github/workflows/self-wiki.yml +++ b/.github/workflows/self-wiki.yml @@ -16,6 +16,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - - uses: Andrew-Chen-Wang/github-wiki-action@50650fccf3a10f741995523cf9708c53cec8912a + - uses: Andrew-Chen-Wang/github-wiki-action@1bbb4280446f9630e8e21a18012cbacf3b0f992e