diff --git a/.github/workflows/api-contract-check.yml b/.github/workflows/api-contract-check.yml index 140f1cdfe..9f26613cd 100644 --- a/.github/workflows/api-contract-check.yml +++ b/.github/workflows/api-contract-check.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout PR HEAD - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index 1578ad6f2..1112f77ad 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -58,7 +58,7 @@ jobs: RESULT_DIR: /tmp/benchmark-results steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/ci-failure-pci.yml b/.github/workflows/ci-failure-pci.yml index c37d212ab..86cf8b500 100644 --- a/.github/workflows/ci-failure-pci.yml +++ b/.github/workflows/ci-failure-pci.yml @@ -76,7 +76,7 @@ jobs: - name: Checkout (for pci-send) if: ${{ steps.app-check.outputs.skip == 'false' }} - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7e4ae6abd..d882576e0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 @@ -50,7 +50,7 @@ jobs: GOFLAGS: -mod=vendor steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 @@ -107,7 +107,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 @@ -212,7 +212,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 @@ -302,7 +302,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Notify build status via Slack env: diff --git a/.github/workflows/counts-vendor-sync.yml b/.github/workflows/counts-vendor-sync.yml index afdaf6fd8..69d208b7b 100644 --- a/.github/workflows/counts-vendor-sync.yml +++ b/.github/workflows/counts-vendor-sync.yml @@ -38,10 +38,10 @@ jobs: timeout-minutes: 5 steps: - name: Checkout cli - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Checkout plugins (public, no token required) - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: nself-org/plugins path: .plugins-canonical diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index fd5a57062..ff4bffd6f 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -50,7 +50,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/credential-rotation-reminder.yml b/.github/workflows/credential-rotation-reminder.yml index 9dd0ef08d..56d05c23e 100644 --- a/.github/workflows/credential-rotation-reminder.yml +++ b/.github/workflows/credential-rotation-reminder.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout cli repo (script source) - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: nself-org/cli path: cli diff --git a/.github/workflows/deep-qa-block.yml b/.github/workflows/deep-qa-block.yml index 47489565a..182f87677 100644 --- a/.github/workflows/deep-qa-block.yml +++ b/.github/workflows/deep-qa-block.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/default-images-pullable.yml b/.github/workflows/default-images-pullable.yml index 66625a204..a5024e53a 100644 --- a/.github/workflows/default-images-pullable.yml +++ b/.github/workflows/default-images-pullable.yml @@ -52,7 +52,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: diff --git a/.github/workflows/deploy-sim.yml b/.github/workflows/deploy-sim.yml index 937bd4208..7d4ee1a8f 100644 --- a/.github/workflows/deploy-sim.yml +++ b/.github/workflows/deploy-sim.yml @@ -16,7 +16,7 @@ jobs: timeout-minutes: 30 steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: diff --git a/.github/workflows/deprecation-check.yml b/.github/workflows/deprecation-check.yml index a9ef02520..117a3b1a3 100644 --- a/.github/workflows/deprecation-check.yml +++ b/.github/workflows/deprecation-check.yml @@ -14,7 +14,7 @@ jobs: timeout-minutes: 3 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # need full history to diff against base diff --git a/.github/workflows/doc-sync.yml b/.github/workflows/doc-sync.yml index 993cfa052..a120237fc 100644 --- a/.github/workflows/doc-sync.yml +++ b/.github/workflows/doc-sync.yml @@ -21,7 +21,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 @@ -83,7 +83,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 6874b3c32..ab8f80c12 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -55,7 +55,7 @@ jobs: id-token: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 # Single source of proceed/version/latest. Fails closed: secrets absent, a # non-tag head_branch, a tag with no GitHub release, or a failed Release diff --git a/.github/workflows/e2e-golden-path.yml b/.github/workflows/e2e-golden-path.yml index 6da943401..9490e8173 100644 --- a/.github/workflows/e2e-golden-path.yml +++ b/.github/workflows/e2e-golden-path.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go (for any CLI build steps) uses: actions/setup-go@v7 diff --git a/.github/workflows/embedded-pg-bench.yml b/.github/workflows/embedded-pg-bench.yml index 349bcff3b..ff02c03f7 100644 --- a/.github/workflows/embedded-pg-bench.yml +++ b/.github/workflows/embedded-pg-bench.yml @@ -33,7 +33,7 @@ jobs: - macos-14 # Apple Silicon โ€” primary deployment target steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/embedded-pg-matrix.yml b/.github/workflows/embedded-pg-matrix.yml index 03abf9931..7b6305398 100644 --- a/.github/workflows/embedded-pg-matrix.yml +++ b/.github/workflows/embedded-pg-matrix.yml @@ -36,7 +36,7 @@ jobs: - macos-15-intel # Intel (darwin/amd64) โ€” macos-13 retired Dec 2025 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: @@ -68,7 +68,7 @@ jobs: - macos-14 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/endpoint-auth-gate.yml b/.github/workflows/endpoint-auth-gate.yml index 1ac9815a5..ad12a804c 100644 --- a/.github/workflows/endpoint-auth-gate.yml +++ b/.github/workflows/endpoint-auth-gate.yml @@ -36,7 +36,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/go-list-updates-monthly.yml b/.github/workflows/go-list-updates-monthly.yml index ace1b0383..dda334591 100644 --- a/.github/workflows/go-list-updates-monthly.yml +++ b/.github/workflows/go-list-updates-monthly.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/govuln.yml b/.github/workflows/govuln.yml index 6625690b2..6dbded499 100644 --- a/.github/workflows/govuln.yml +++ b/.github/workflows/govuln.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/govulncheck-nightly.yml b/.github/workflows/govulncheck-nightly.yml index 1dd5db1cb..1395eb700 100644 --- a/.github/workflows/govulncheck-nightly.yml +++ b/.github/workflows/govulncheck-nightly.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml index be8c19d3c..c574d346b 100644 --- a/.github/workflows/hadolint.yml +++ b/.github/workflows/hadolint.yml @@ -22,7 +22,7 @@ jobs: hadolint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Run hadolint uses: hadolint/hadolint-action@v3.5.0 with: diff --git a/.github/workflows/hygiene.yml b/.github/workflows/hygiene.yml index 612087c16..56f1e7890 100644 --- a/.github/workflows/hygiene.yml +++ b/.github/workflows/hygiene.yml @@ -50,7 +50,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/image-pin-bump.yml b/.github/workflows/image-pin-bump.yml index 960ea1eb0..28f3c6685 100644 --- a/.github/workflows/image-pin-bump.yml +++ b/.github/workflows/image-pin-bump.yml @@ -71,7 +71,7 @@ jobs: DRY_RUN_PR: ${{ inputs.dry_run_pr == true && 'true' || 'false' }} BRANCH: ${{ inputs.dry_run_pr == true && 'chore/image-pins-dry-run' || 'chore/image-pins' }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 with: @@ -259,7 +259,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Skip unless the owner switch is on if: vars.IMAGE_MIRROR_APPLY != 'true' diff --git a/.github/workflows/license-audit.yml b/.github/workflows/license-audit.yml index 22f27d849..3b8219ad6 100644 --- a/.github/workflows/license-audit.yml +++ b/.github/workflows/license-audit.yml @@ -32,7 +32,7 @@ jobs: name: Check Go dependency licenses runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/license-gate-unit-test.yml b/.github/workflows/license-gate-unit-test.yml index 6aafeda6c..460cb8d2c 100644 --- a/.github/workflows/license-gate-unit-test.yml +++ b/.github/workflows/license-gate-unit-test.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/license-gate.yml b/.github/workflows/license-gate.yml index a0e084cce..45113641b 100644 --- a/.github/workflows/license-gate.yml +++ b/.github/workflows/license-gate.yml @@ -34,7 +34,7 @@ jobs: name: Go Dependency License Gate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/license-mutation.yml b/.github/workflows/license-mutation.yml index 53d4e6f9a..dc99d9cab 100644 --- a/.github/workflows/license-mutation.yml +++ b/.github/workflows/license-mutation.yml @@ -33,7 +33,7 @@ jobs: timeout-minutes: 90 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/migration-fixture.yml b/.github/workflows/migration-fixture.yml index be44c3cda..f4159fd2d 100644 --- a/.github/workflows/migration-fixture.yml +++ b/.github/workflows/migration-fixture.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/multi-arch-check.yml b/.github/workflows/multi-arch-check.yml index ad95d9952..f40704125 100644 --- a/.github/workflows/multi-arch-check.yml +++ b/.github/workflows/multi-arch-check.yml @@ -39,7 +39,7 @@ jobs: goarch: arm64 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/nightly-registry-perf.yml b/.github/workflows/nightly-registry-perf.yml index 32dbc8964..6f38a3251 100644 --- a/.github/workflows/nightly-registry-perf.yml +++ b/.github/workflows/nightly-registry-perf.yml @@ -15,7 +15,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/nself-first-check.yml b/.github/workflows/nself-first-check.yml index 9415f55fe..b173c573a 100644 --- a/.github/workflows/nself-first-check.yml +++ b/.github/workflows/nself-first-check.yml @@ -19,7 +19,7 @@ jobs: compose-header-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/ollama-pin-drift.yml b/.github/workflows/ollama-pin-drift.yml index b3718ace9..ed5aa5d57 100644 --- a/.github/workflows/ollama-pin-drift.yml +++ b/.github/workflows/ollama-pin-drift.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/p93-soak-monitor.yml b/.github/workflows/p93-soak-monitor.yml index facbd7780..0bf94779c 100644 --- a/.github/workflows/p93-soak-monitor.yml +++ b/.github/workflows/p93-soak-monitor.yml @@ -50,7 +50,7 @@ jobs: HETZNER_NSELF_TOKEN: ${{ secrets.HETZNER_NSELF_TOKEN }} SOAK_RUN_T09: ${{ inputs.run_t09 == 'true' && '1' || '0' }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install deps run: | diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml index cf752c416..97e4387c3 100644 --- a/.github/workflows/perf.yml +++ b/.github/workflows/perf.yml @@ -65,7 +65,7 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # need full history to find the merge-base # The PR head, not the synthetic merge commit: HEAD must be the @@ -294,7 +294,7 @@ jobs: RUN_RUNS: "30" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # The PR head, not the synthetic merge commit (see Binary Size Gate). @@ -527,7 +527,7 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: diff --git a/.github/workflows/ping-api-deploy.yml b/.github/workflows/ping-api-deploy.yml index 63c59439d..d6814752b 100644 --- a/.github/workflows/ping-api-deploy.yml +++ b/.github/workflows/ping-api-deploy.yml @@ -50,7 +50,7 @@ jobs: # Valid job-level `if:` (github context only โ€” no secrets reference). if: github.event_name == 'workflow_dispatch' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Verify ping_api service directory exists run: | diff --git a/.github/workflows/pre-release-gate.yml b/.github/workflows/pre-release-gate.yml index c1c92f58d..a97f91ad1 100644 --- a/.github/workflows/pre-release-gate.yml +++ b/.github/workflows/pre-release-gate.yml @@ -47,7 +47,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # need full history for DENY-003 commits-since-prior-tag diff --git a/.github/workflows/quarterly-doc-audit.yml b/.github/workflows/quarterly-doc-audit.yml index 33bd9af20..4c73c91c0 100644 --- a/.github/workflows/quarterly-doc-audit.yml +++ b/.github/workflows/quarterly-doc-audit.yml @@ -33,7 +33,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 1 diff --git a/.github/workflows/release-dryrun.yml b/.github/workflows/release-dryrun.yml index c5c21357e..5fe1529b5 100644 --- a/.github/workflows/release-dryrun.yml +++ b/.github/workflows/release-dryrun.yml @@ -55,7 +55,7 @@ jobs: CGO_ENABLED: 0 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -102,10 +102,10 @@ jobs: needs: extract-version steps: - name: Checkout CLI repo - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Checkout Admin repo - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: nself-org/admin path: admin-repo @@ -172,7 +172,7 @@ jobs: needs: extract-version steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Install syft uses: anchore/sbom-action/download-syft@v0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 17829c4b4..94e784c52 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -319,7 +319,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/rls-pentest-smoke.yml b/.github/workflows/rls-pentest-smoke.yml index 78f11beea..a26d956a4 100644 --- a/.github/workflows/rls-pentest-smoke.yml +++ b/.github/workflows/rls-pentest-smoke.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 7398d6695..bb64d2de9 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/sdk-coherence-check.yml b/.github/workflows/sdk-coherence-check.yml index 579924e41..8756696ba 100644 --- a/.github/workflows/sdk-coherence-check.yml +++ b/.github/workflows/sdk-coherence-check.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 # tags are needed to tell whether the release shipped the SDK tag form diff --git a/.github/workflows/sdk-cross-import-check.yml b/.github/workflows/sdk-cross-import-check.yml index 1c1ee9eb2..180ac24a8 100644 --- a/.github/workflows/sdk-cross-import-check.yml +++ b/.github/workflows/sdk-cross-import-check.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Check for cross-imports run: | diff --git a/.github/workflows/sdk-go-remote-mutation.yml b/.github/workflows/sdk-go-remote-mutation.yml index dcf450c9a..257c00551 100644 --- a/.github/workflows/sdk-go-remote-mutation.yml +++ b/.github/workflows/sdk-go-remote-mutation.yml @@ -51,7 +51,7 @@ jobs: GREMLINS_WORKERS: "4" steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/sdk-go-test.yml b/.github/workflows/sdk-go-test.yml index 7e58542f4..7456a943d 100644 --- a/.github/workflows/sdk-go-test.yml +++ b/.github/workflows/sdk-go-test.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/sdk-publish-go.yml b/.github/workflows/sdk-publish-go.yml index 3015cd707..1a98e0a3c 100644 --- a/.github/workflows/sdk-publish-go.yml +++ b/.github/workflows/sdk-publish-go.yml @@ -41,7 +41,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/sdk-py-publish.yml b/.github/workflows/sdk-py-publish.yml index 515459aa3..d1a74c02d 100644 --- a/.github/workflows/sdk-py-publish.yml +++ b/.github/workflows/sdk-py-publish.yml @@ -73,7 +73,7 @@ jobs: name: pypi url: https://pypi.org/p/nself-sdk steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-python@v7 with: python-version: '3.11' diff --git a/.github/workflows/sdk-py-test.yml b/.github/workflows/sdk-py-test.yml index f88aed24e..2afc93418 100644 --- a/.github/workflows/sdk-py-test.yml +++ b/.github/workflows/sdk-py-test.yml @@ -33,7 +33,7 @@ jobs: working-directory: sdk/py steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v7 diff --git a/.github/workflows/sdk-reverse-dep-check.yml b/.github/workflows/sdk-reverse-dep-check.yml index b8562177a..f2b3b3ed8 100644 --- a/.github/workflows/sdk-reverse-dep-check.yml +++ b/.github/workflows/sdk-reverse-dep-check.yml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: @@ -72,7 +72,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-python@v7 with: python-version: '3.11' @@ -87,7 +87,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: pnpm/action-setup@v6 with: version: 9 diff --git a/.github/workflows/sdk-ts-publish.yml b/.github/workflows/sdk-ts-publish.yml index 3de6db483..c77c7b43d 100644 --- a/.github/workflows/sdk-ts-publish.yml +++ b/.github/workflows/sdk-ts-publish.yml @@ -53,7 +53,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 # Preflight: proceed only when the SDK dir exists AND the npm token is # present. NPM_TOKEN is read via step env (the valid place to reference diff --git a/.github/workflows/sdk-ts-sdk-publish.yml b/.github/workflows/sdk-ts-sdk-publish.yml index e6f24f226..c5a667522 100644 --- a/.github/workflows/sdk-ts-sdk-publish.yml +++ b/.github/workflows/sdk-ts-sdk-publish.yml @@ -38,7 +38,7 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Set up Node.js uses: actions/setup-node@v7 diff --git a/.github/workflows/sdk-ts-test.yml b/.github/workflows/sdk-ts-test.yml index 4f910dd89..fb67caa0f 100644 --- a/.github/workflows/sdk-ts-test.yml +++ b/.github/workflows/sdk-ts-test.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest if: github.event_name == 'push' || github.event_name == 'pull_request' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: pnpm/action-setup@v6 with: diff --git a/.github/workflows/sdk-version-sync.yml b/.github/workflows/sdk-version-sync.yml index 6677e6c9b..2bda4b827 100644 --- a/.github/workflows/sdk-version-sync.yml +++ b/.github/workflows/sdk-version-sync.yml @@ -36,7 +36,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Resolve target version id: target diff --git a/.github/workflows/sec-lint.yml b/.github/workflows/sec-lint.yml index 3f63200dd..ac726f625 100644 --- a/.github/workflows/sec-lint.yml +++ b/.github/workflows/sec-lint.yml @@ -23,7 +23,7 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Run security lint run: bash scripts/sec-lint.sh internal @@ -38,7 +38,7 @@ jobs: # .claude/docs/doctrines/ci-cd-green.md ยง The ACCEPTED/Expiry Exception Pattern. steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Run CI-masking lint run: bash scripts/ci-masking-lint.sh diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 9613d1e1e..a911408dd 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -13,7 +13,7 @@ jobs: security: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-go@v7 with: go-version-file: go.mod diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 90f451be1..968e78a5b 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go uses: actions/setup-go@v7 diff --git a/.github/workflows/two-command-drill.yml b/.github/workflows/two-command-drill.yml index 08400a42b..fa9cca5ca 100644 --- a/.github/workflows/two-command-drill.yml +++ b/.github/workflows/two-command-drill.yml @@ -37,7 +37,7 @@ jobs: v15: '1' steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/version-lockstep.yml b/.github/workflows/version-lockstep.yml index 5f7ef3e96..b656c6c2b 100644 --- a/.github/workflows/version-lockstep.yml +++ b/.github/workflows/version-lockstep.yml @@ -47,19 +47,19 @@ jobs: steps: - name: Checkout cli - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: path: cli - name: Checkout admin - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: nself-org/admin token: ${{ secrets.GITHUB_TOKEN }} path: admin - name: Checkout homebrew-nself - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: repository: nself-org/homebrew-nself token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml index 08cfc91fe..0b0cd5797 100644 --- a/.github/workflows/wiki-sync.yml +++ b/.github/workflows/wiki-sync.yml @@ -16,7 +16,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Sync to GitHub Wiki env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/windows-smoke.yml b/.github/workflows/windows-smoke.yml index 505eed588..041c7c12a 100644 --- a/.github/workflows/windows-smoke.yml +++ b/.github/workflows/windows-smoke.yml @@ -52,7 +52,7 @@ jobs: - name: Checkout if: ${{ inputs.arch == 'both' || inputs.arch == matrix.goarch }} - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Set up Go if: ${{ inputs.arch == 'both' || inputs.arch == matrix.goarch }}