From 0f1a37bf333a21f9728fc232e467d41c8b2a44a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 03:27:49 +0000 Subject: [PATCH] chore(deps): bump the pinned-actions group with 5 updates Bumps the pinned-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.6.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `actions/checkout` from 4.2.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c) Updates `docker/login-action` from 3.7.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...dbcb813823bdd20940b903addbd779551569679f) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0...5f6978faf089d4d20b00c7766989d076bb2fc7f1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pinned-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pinned-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pinned-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pinned-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pinned-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/prismpm.yml | 50 +++++++++++++-------------- .github/workflows/template-update.yml | 12 +++---- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/prismpm.yml b/.github/workflows/prismpm.yml index dcf2c9f..4d12b39 100644 --- a/.github/workflows/prismpm.yml +++ b/.github/workflows/prismpm.yml @@ -58,7 +58,7 @@ jobs: sdk-image: ${{ steps.lock.outputs.sdk-image }} steps: - name: Check out the exact event revision without credentials - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -87,7 +87,7 @@ jobs: contents: read steps: - name: Check out the exact event revision without credentials - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -119,7 +119,7 @@ jobs: release-digest: ${{ steps.product.outputs.release-digest }} steps: - name: Check out the exact event revision without credentials - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -157,7 +157,7 @@ jobs: mkdir -p .prism/ci printf '%s' "$RESULT" > .prism/ci/build.json - name: Preserve the exact OCI graph and canonical result - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: prismpm-product-release if-no-files-found: error @@ -194,12 +194,12 @@ jobs: immutable-reference: ${{ needs.build.outputs.immutable-reference }} steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Restore the build job's exact OCI graph - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: name: prismpm-product-release path: .prism @@ -229,7 +229,7 @@ jobs: sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} trusted-root: ${{ steps.policy.outputs.trusted-root-path }} - name: Authenticate to GHCR with the short-lived job token - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} @@ -255,12 +255,12 @@ jobs: plan-digest: ${{ steps.plan.outputs.plan-digest }} steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for immutable release retrieval - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} @@ -286,7 +286,7 @@ jobs: sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} target: ${{ inputs.target }} - name: Preserve the exact target-state-bound plan as inert data - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: prismpm-deployment-plan if-no-files-found: error @@ -308,12 +308,12 @@ jobs: evidence-digest: ${{ steps.deploy.outputs.evidence-digest }} steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for immutable release retrieval - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} @@ -331,7 +331,7 @@ jobs: reference: ${{ needs.promote.outputs.immutable-reference }} sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} - name: Restore the exact plan produced against observed target state - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: name: prismpm-deployment-plan path: .prism/plans @@ -351,7 +351,7 @@ jobs: reference: ${{ needs.promote.outputs.immutable-reference }} sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} - name: Preserve target state for independent post-deployment verification - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: prismpm-deployment-state if-no-files-found: error @@ -371,12 +371,12 @@ jobs: packages: read steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for immutable release retrieval - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} @@ -394,7 +394,7 @@ jobs: reference: ${{ needs.promote.outputs.immutable-reference }} sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} - name: Restore the deploy job's exact observed target state - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: name: prismpm-deployment-state path: .prism/targets @@ -426,12 +426,12 @@ jobs: transcript-digest: ${{ steps.conformance.outputs.transcript-digest }} steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for immutable release retrieval - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} @@ -456,7 +456,7 @@ jobs: reference: ${{ needs.promote.outputs.immutable-reference }} sdk-image: ${{ needs.resolve-sdk.outputs.sdk-image }} - name: Preserve the conformance-bearing graph for protected acceptance - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: prismpm-accepted-input if-no-files-found: error @@ -477,18 +477,18 @@ jobs: packages: write steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for the exact evidence-bearing release graph - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Restore the exact conformance-bearing graph without rebuilding - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: name: prismpm-accepted-input path: .prism @@ -535,12 +535,12 @@ jobs: packages: read steps: - name: Check out the reviewed workflow revision - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false - name: Authenticate for immutable accepted-release retrieval - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/template-update.yml b/.github/workflows/template-update.yml index fe747b9..90f19a0 100644 --- a/.github/workflows/template-update.yml +++ b/.github/workflows/template-update.yml @@ -27,13 +27,13 @@ jobs: contents: read steps: - name: Check out the protected downstream branch without credentials - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false ref: ${{ github.event.repository.default_branch }} - name: Check out the exact reviewed template policy snapshot - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -125,7 +125,7 @@ jobs: git diff --binary >.template-update.patch test -s .template-update.patch - name: Preserve the inert reviewable patch - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: template-update-proposal if-no-files-found: error @@ -143,13 +143,13 @@ jobs: pull-requests: write steps: - name: Check out the protected default branch without persisted credentials - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false ref: ${{ github.event.repository.default_branch }} - name: Restore and apply the inert proposal - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with: name: template-update-proposal - name: Validate and apply the proposed patch without executing it @@ -158,7 +158,7 @@ jobs: git apply .template-update.patch rm .template-update.patch - name: Open the patch as a pull request - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 with: branch: automation/template-contract-update commit-message: "chore: update locked UOR template contract"