From 4e5c6e1d6b7764c231ca66cb34c95965a8ea9475 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 00:44:07 +0000 Subject: [PATCH] build(deps): bump the actions-updates group across 1 directory with 10 updates Bumps the actions-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.1` | `2.22.1` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.1.0` | `10.3.0` | | [edera-dev/actions/report-disk-space](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [edera-dev/actions/reclaim-disk-space](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [edera-dev/actions/configure-azure-sccache](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [edera-dev/actions/.github/workflows/advisory-review.yml](https://github.com/edera-dev/actions) | `0c15ad17d0b4e52af066d268a249d6ac3c7ce3b8` | `72785a27a033e2a64c53d9d55c88253fa174cc16` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` | Updates `step-security/harden-runner` from 2.20.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `astral-sh/setup-uv` from 10.1.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/bec219d24cd3e171d82865faccec33120bb574f4...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `edera-dev/actions/report-disk-space` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `edera-dev/actions/reclaim-disk-space` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `edera-dev/actions/configure-azure-sccache` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `edera-dev/actions/.github/workflows/advisory-review.yml` from 0c15ad17d0b4e52af066d268a249d6ac3c7ce3b8 to 72785a27a033e2a64c53d9d55c88253fa174cc16 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/0c15ad17d0b4e52af066d268a249d6ac3c7ce3b8...72785a27a033e2a64c53d9d55c88253fa174cc16) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: edera-dev/actions/.github/workflows/advisory-review.yml dependency-version: 72785a27a033e2a64c53d9d55c88253fa174cc16 dependency-type: direct:production dependency-group: actions-updates - dependency-name: edera-dev/actions/configure-azure-sccache dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: edera-dev/actions/reclaim-disk-space dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: edera-dev/actions/report-disk-space dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] --- .github/workflows/buildenv-diff.yml | 2 +- .github/workflows/buildenv.yml | 14 ++++++------ .github/workflows/digestabot.yml | 2 +- .github/workflows/lint.yml | 2 +- .github/workflows/matrix.yml | 34 ++++++++++++++-------------- .github/workflows/pr-review.yml | 4 ++-- .github/workflows/refresh-nvidia.yml | 4 ++-- 7 files changed, 31 insertions(+), 31 deletions(-) diff --git a/.github/workflows/buildenv-diff.yml b/.github/workflows/buildenv-diff.yml index 9e417b8..c163557 100644 --- a/.github/workflows/buildenv-diff.yml +++ b/.github/workflows/buildenv-diff.yml @@ -18,7 +18,7 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository diff --git a/.github/workflows/buildenv.yml b/.github/workflows/buildenv.yml index 52378e0..855ca86 100644 --- a/.github/workflows/buildenv.yml +++ b/.github/workflows/buildenv.yml @@ -38,13 +38,13 @@ jobs: runs-on: "${{ matrix.runner }}" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -67,7 +67,7 @@ jobs: docker run --rm "${IMAGE}@$(cat digest-${{ matrix.arch }})" \ cat /usr/share/buildenv/packages.tsv > "packages-${{ matrix.arch }}.tsv" - name: upload digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "buildenv-digest-${{ matrix.arch }}" path: "digest-${{ matrix.arch }}" @@ -75,7 +75,7 @@ jobs: compression-level: 0 retention-days: 1 - name: upload package manifest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "buildenv-packages-${{ matrix.arch }}" path: "packages-${{ matrix.arch }}.tsv" @@ -89,13 +89,13 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -105,7 +105,7 @@ jobs: username: "${{github.actor}}" password: "${{secrets.GITHUB_TOKEN}}" - name: download digests - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "buildenv-digest-*" merge-multiple: true diff --git a/.github/workflows/digestabot.yml b/.github/workflows/digestabot.yml index 005631e..514c66d 100644 --- a/.github/workflows/digestabot.yml +++ b/.github/workflows/digestabot.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 9aa3d02..ca03e1b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -31,7 +31,7 @@ jobs: curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck" - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: Show versions diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml index 577c573..d21cba9 100644 --- a/.github/workflows/matrix.yml +++ b/.github/workflows/matrix.yml @@ -24,11 +24,11 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: Setup Crane @@ -42,7 +42,7 @@ jobs: - name: generate matrix run: './hack/build/generate-matrix.sh "${{ inputs.spec }}"' - name: upload matrix - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: matrix path: "matrix.json" @@ -83,17 +83,17 @@ jobs: KERNEL_ARCH: "${{ matrix.builds.arch }}" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: report disk space (before) - uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 - name: reclaim runner disk space # Kernel builds never touch Rust or the hosted toolcache, so both # opt-in removals are on. Must stay before cosign-installer, which # installs into the toolcache this deletes. - uses: edera-dev/actions/reclaim-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/reclaim-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 with: remove-toolcache: 'true' remove-rust: 'true' @@ -132,7 +132,7 @@ jobs: # - name: docker setup linux-kernel-oci # run: sudo uv run ./hack/build/docker-setup.py - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -148,19 +148,19 @@ jobs: # list in hack/build/generate-docker-script.py (docker_compile); a # name missing there silently never reaches the build container. id: sccache - uses: edera-dev/actions/configure-azure-sccache@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/configure-azure-sccache@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 with: connection-string-rw: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }} connection-string-ro: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING_RO }} key-prefix: kernel - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: generate docker script run: "./hack/build/generate-docker-script.sh" - name: upload docker script - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "build-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}.sh" path: "docker.sh" @@ -172,11 +172,11 @@ jobs: - name: report disk space (after) # always() so ENOSPC failures still show where the disk went. if: always() - uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 - name: upload digests # Only produced when publishing — push-by-digest path writes digests.json. if: ${{ inputs.publish }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "digests-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}" path: "digests.json" @@ -208,13 +208,13 @@ jobs: DIGESTS_DIR: digests steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: '3.14' - name: install python deps @@ -222,7 +222,7 @@ jobs: - name: install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -232,7 +232,7 @@ jobs: username: "${{github.actor}}" password: "${{secrets.GITHUB_TOKEN}}" - name: download digest artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: # Each per-arch build uploads its digests under a uniquely-named # artifact; pattern + default merge-multiple=false drops each artifact @@ -242,7 +242,7 @@ jobs: - name: generate merge script run: uv run ./hack/build/generate-merge-script.py - name: upload merge script - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "merge-${{ matrix.merges.branch }}-${{ matrix.merges.version }}-${{ matrix.merges.flavor }}.sh" path: "merge.sh" diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index d5fe521..d878c78 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -22,7 +22,7 @@ concurrency: jobs: suggestions: - uses: edera-dev/actions/.github/workflows/advisory-review.yml@0c15ad17d0b4e52af066d268a249d6ac3c7ce3b8 + uses: edera-dev/actions/.github/workflows/advisory-review.yml@72785a27a033e2a64c53d9d55c88253fa174cc16 permissions: contents: read pull-requests: write @@ -35,7 +35,7 @@ jobs: workspace-id: ${{ vars.PR_REVIEW_WORKSPACE_ID }} coverage: - uses: edera-dev/actions/.github/workflows/advisory-review.yml@0c15ad17d0b4e52af066d268a249d6ac3c7ce3b8 + uses: edera-dev/actions/.github/workflows/advisory-review.yml@72785a27a033e2a64c53d9d55c88253fa174cc16 permissions: contents: read pull-requests: write diff --git a/.github/workflows/refresh-nvidia.yml b/.github/workflows/refresh-nvidia.yml index 83d1cd4..883876e 100644 --- a/.github/workflows/refresh-nvidia.yml +++ b/.github/workflows/refresh-nvidia.yml @@ -15,7 +15,7 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository @@ -23,7 +23,7 @@ jobs: - name: scrape upstream and rewrite config.yaml run: python3 ./hack/build/refresh-nvidia-versions.py - name: generate cultivator token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: generate-token with: app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"