From 5d44ecc86ae048cd66bf1e86c2d7ed86f0bcd93b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 05:51:48 +0000
Subject: [PATCH 1/3] chore(deps): bump the actions-maintenance group with 4
 updates

Bumps the actions-maintenance group with 4 updates: [durable-workflow/.github/.github/actions/bootstrap-patched-pip](https://github.com/durable-workflow/.github), [durable-workflow/.github/.github/actions/verify-composer-trust](https://github.com/durable-workflow/.github), [docker/login-action](https://github.com/docker/login-action) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action).


Updates `durable-workflow/.github/.github/actions/bootstrap-patched-pip` from 76f333804e68725059039fd54df241d40d855cd3 to edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f
- [Release notes](https://github.com/durable-workflow/.github/releases)
- [Commits](https://github.com/durable-workflow/.github/compare/76f333804e68725059039fd54df241d40d855cd3...edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f)

Updates `durable-workflow/.github/.github/actions/verify-composer-trust` from 76f333804e68725059039fd54df241d40d855cd3 to edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f
- [Release notes](https://github.com/durable-workflow/.github/releases)
- [Commits](https://github.com/durable-workflow/.github/compare/76f333804e68725059039fd54df241d40d855cd3...edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f)

Updates `docker/login-action` from 4.7.0 to 4.8.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/81c6f93d4bc991e510b342a00b419b3bb4efc5c6...8aa5831fb8d48d8f76594c7ddde61ae58019f550)

Updates `SonarSource/sonarqube-scan-action` from 8.4.0 to 8.4.1
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/4d1dc0c91ee400dcf8a6dddf2f705ac36542e304...e805d875275f728fac1885b413934be6d7c63f65)

---
updated-dependencies:
- dependency-name: durable-workflow/.github/.github/actions/bootstrap-patched-pip
  dependency-version: edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f
  dependency-type: direct:production
  dependency-group: actions-maintenance
- dependency-name: durable-workflow/.github/.github/actions/verify-composer-trust
  dependency-version: edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f
  dependency-type: direct:production
  dependency-group: actions-maintenance
- dependency-name: docker/login-action
  dependency-version: 4.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-maintenance
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 8.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-maintenance
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml                  | 12 ++++++------
 .github/workflows/composer-lock-audit.yml |  4 ++--
 .github/workflows/devcontainer-image.yml  | 12 ++++++------
 .github/workflows/playground-journeys.yml |  6 +++---
 .github/workflows/sonar.yml               |  2 +-
 5 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a6843ad8..9f7bce82 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -63,13 +63,13 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           working-directory: playground/php-runtime
 
@@ -159,7 +159,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -172,7 +172,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           working-directory: microservice
 
@@ -213,7 +213,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Bootstrap patched pip trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
       - run: 'python -m pip install --only-binary :all: PyYAML==6.0.2'
       - name: Require centrally approved immutable action commits
         run: >-
diff --git a/.github/workflows/composer-lock-audit.yml b/.github/workflows/composer-lock-audit.yml
index 9f1c2d9e..b604b3a4 100644
--- a/.github/workflows/composer-lock-audit.yml
+++ b/.github/workflows/composer-lock-audit.yml
@@ -44,7 +44,7 @@ jobs:
           python-version: '3.13'
 
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -56,7 +56,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before advisory requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
 
       - name: Audit the committed lock inventory
         run: bash scripts/ci/audit-committed-composer-locks.sh
diff --git a/.github/workflows/devcontainer-image.yml b/.github/workflows/devcontainer-image.yml
index f54e19c1..3d66def8 100644
--- a/.github/workflows/devcontainer-image.yml
+++ b/.github/workflows/devcontainer-image.yml
@@ -57,13 +57,13 @@ jobs:
           echo '2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576  .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh' | sha256sum --check --strict
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -103,13 +103,13 @@ jobs:
     steps:
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -210,13 +210,13 @@ jobs:
           persist-credentials: false
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Sign in to GitHub Container Registry
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - name: Sign in to Docker Hub
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           username: durableworkflow
           password: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/playground-journeys.yml b/.github/workflows/playground-journeys.yml
index 3cd974c8..ccdf3fb0 100644
--- a/.github/workflows/playground-journeys.yml
+++ b/.github/workflows/playground-journeys.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -43,10 +43,10 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3 # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
         with:
           working-directory: playground/php-runtime
 
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index b8a7da9a..fe858479 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: SonarSource/sonarqube-scan-action@4d1dc0c91ee400dcf8a6dddf2f705ac36542e304 # v8.4.0
+      - uses: SonarSource/sonarqube-scan-action@e805d875275f728fac1885b413934be6d7c63f65 # v8.4.1
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:

From 8a4186038e0fc0f1d6a2f1b20928767729b17d38 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Mon, 9 Nov 2026 21:17:40 +0000
Subject: [PATCH 2/3] Use the hosted-qualified private pip bootstrap

---
 .github/workflows/ci.yml                  | 12 ++++++------
 .github/workflows/composer-lock-audit.yml |  4 ++--
 .github/workflows/playground-journeys.yml |  6 +++---
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9f7bce82..2101a272 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -63,13 +63,13 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: playground/php-runtime
 
@@ -159,7 +159,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -172,7 +172,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: microservice
 
@@ -213,7 +213,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Bootstrap patched pip trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
       - run: 'python -m pip install --only-binary :all: PyYAML==6.0.2'
       - name: Require centrally approved immutable action commits
         run: >-
diff --git a/.github/workflows/composer-lock-audit.yml b/.github/workflows/composer-lock-audit.yml
index b604b3a4..81ccc57b 100644
--- a/.github/workflows/composer-lock-audit.yml
+++ b/.github/workflows/composer-lock-audit.yml
@@ -44,7 +44,7 @@ jobs:
           python-version: '3.13'
 
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git,npm
 
@@ -56,7 +56,7 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before advisory requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Audit the committed lock inventory
         run: bash scripts/ci/audit-committed-composer-locks.sh
diff --git a/.github/workflows/playground-journeys.yml b/.github/workflows/playground-journeys.yml
index ccdf3fb0..1918df5f 100644
--- a/.github/workflows/playground-journeys.yml
+++ b/.github/workflows/playground-journeys.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           python-version: '3.13'
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           clients: pip,python,composer,curl,git
 
@@ -43,10 +43,10 @@ jobs:
           tools: composer:2.10.3
 
       - name: Verify actual Composer trust before dependency requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
 
       - name: Verify the playground Composer configuration
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
         with:
           working-directory: playground/php-runtime
 

From e17bfcb00c0f08749482bf1214a193f263da7bbf Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Mon, 9 Nov 2026 21:26:46 +0000
Subject: [PATCH 3/3] Keep the bootstrap contract pinned to the qualified
 revision

---
 tests/Unit/DevcontainerImageContractTest.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/Unit/DevcontainerImageContractTest.php b/tests/Unit/DevcontainerImageContractTest.php
index f79df3e0..3e5321ef 100644
--- a/tests/Unit/DevcontainerImageContractTest.php
+++ b/tests/Unit/DevcontainerImageContractTest.php
@@ -125,7 +125,7 @@ public function test_composer_jobs_check_trust_before_dependency_resolution(): v
             foreach ($steps as $index => $step) {
                 if (str_starts_with($step['uses'] ?? '', 'durable-workflow/.github/.github/actions/bootstrap-patched-pip@')) {
                     $bootstrap = $index;
-                    $this->assertSame('76f333804e68725059039fd54df241d40d855cd3', explode('@', $step['uses'])[1]);
+                    $this->assertSame('52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2', explode('@', $step['uses'])[1]);
                     $this->assertStringContainsString('composer,curl,git', $step['with']['clients']);
                 }
                 if (str_starts_with($step['uses'] ?? '', 'shivammathur/setup-php@')) {
@@ -138,7 +138,7 @@ public function test_composer_jobs_check_trust_before_dependency_resolution(): v
             $this->assertLessThan($setup, $bootstrap);
             $this->assertSame('composer:2.10.3', $steps[$setup]['with']['tools']);
             $this->assertSame(
-                'durable-workflow/.github/.github/actions/verify-composer-trust@76f333804e68725059039fd54df241d40d855cd3',
+                'durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2',
                 $steps[$setup + 1]['uses'],
             );
             $this->assertSame($job === 'microservice-test' ? 'microservice' : '.', $steps[$setup + 1]['with']['working-directory'] ?? '.');