From 0a5ab1d5105e1dd96f5eec29ae43124da9f5ef98 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 05:18:47 +0000 Subject: [PATCH] chore(deps): bump the github-actions-all group across 1 directory with 10 updates Bumps the github-actions-all group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `7.0.0` | | [codelytv/pr-size-labeler](https://github.com/codelytv/pr-size-labeler) | `1.10.3` | `1.10.4` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `7.0.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.3.0` | `7.0.0` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `e97e2d8cc328f1b50210efc529dca0028893a2d9` | `d1031067263f94b142dd6c0ce24c5eb9d02d52a0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `7.0.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.3.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [actions/stale](https://github.com/actions/stale) | `10.2.0` | `11.0.0` | Updates `actions/labeler` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/634933edcd8ababfe52f92936142cc22ac488b1b...bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13) Updates `codelytv/pr-size-labeler` from 1.10.3 to 1.10.4 - [Release notes](https://github.com/codelytv/pr-size-labeler/releases) - [Commits](https://github.com/codelytv/pr-size-labeler/compare/4ec67706cd878fbc1c8db0a5dcd28b6bb412e85a...095a41fca88b8764fd9e008ad269bcdb82bb38b9) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...820762786026740c76f36085b0efc47a31fe5020) Updates `actions/setup-go` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) Updates `dtolnay/rust-toolchain` from e97e2d8cc328f1b50210efc529dca0028893a2d9 to d1031067263f94b142dd6c0ce24c5eb9d02d52a0 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/e97e2d8cc328f1b50210efc529dca0028893a2d9...d1031067263f94b142dd6c0ce24c5eb9d02d52a0) Updates `actions/setup-python` from 6.2.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `golangci/golangci-lint-action` from 9.2.0 to 9.3.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/1e7e51e771db61008b38414a730f564565cf7c20...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) Updates `actions/cache` from 4.3.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/stale` from 10.2.0 to 11.0.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/b5d41d4e1d5dceea10e7104786b73624c18a190f...4391f3da665fdf50b6810c1a66712fb9ba21aa93) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/labeler dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-all - dependency-name: codelytv/pr-size-labeler dependency-version: 1.10.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-all - dependency-name: dtolnay/rust-toolchain dependency-version: d1031067263f94b142dd6c0ce24c5eb9d02d52a0 dependency-type: direct:production dependency-group: github-actions-all - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-all ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-labeler.yml | 4 +- .github/workflows/build-macos-production.yml | 8 +-- .github/workflows/ci.yml | 54 +++++++++---------- .github/workflows/dco.yml | 4 +- .github/workflows/deploy-install-gateway.yml | 6 +-- .github/workflows/release-app-tools.yml | 8 +-- .github/workflows/release-kit.yml | 20 +++---- .../release-nimi-shell-protected-local.yml | 8 +-- .../workflows/release-nimi-shell-tauri.yml | 8 +-- .github/workflows/release-security.yml | 14 ++--- .github/workflows/release.yml | 8 +-- .github/workflows/security.yml | 18 +++---- .github/workflows/stale.yml | 2 +- 13 files changed, 81 insertions(+), 81 deletions(-) diff --git a/.github/workflows/auto-labeler.yml b/.github/workflows/auto-labeler.yml index 81a8910e9c..2532b6c700 100644 --- a/.github/workflows/auto-labeler.yml +++ b/.github/workflows/auto-labeler.yml @@ -14,7 +14,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1 + - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0 with: configuration-path: .github/labeler.yml sync-labels: true @@ -25,7 +25,7 @@ jobs: contents: read pull-requests: write steps: - - uses: codelytv/pr-size-labeler@4ec67706cd878fbc1c8db0a5dcd28b6bb412e85a # v1.10.3 + - uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9 # v1.10.4 with: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} xs_label: "size/XS" diff --git a/.github/workflows/build-macos-production.yml b/.github/workflows/build-macos-production.yml index e685dd5c30..fd10542338 100644 --- a/.github/workflows/build-macos-production.yml +++ b/.github/workflows/build-macos-production.yml @@ -53,7 +53,7 @@ jobs: NIMI_NOTARYTOOL_KEYCHAIN_PROFILE: nimi-ci-notary steps: - name: Checkout the candidate source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Require Apple Silicon and select the sealed Realm target @@ -76,17 +76,17 @@ jobs: with: version: 10.34.5 - name: Set up Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false - name: Set up Rust - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Install locked dependencies diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d162441243..16dd174cf6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,11 +33,11 @@ jobs: kit_native_changed: ${{ steps.detect.outputs.kit_native_changed }} steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Detect changed paths @@ -70,7 +70,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -78,7 +78,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm @@ -108,7 +108,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -116,14 +116,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Go for workflow lint - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false @@ -162,7 +162,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -170,7 +170,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm @@ -191,7 +191,7 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -199,12 +199,12 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Setup Rust - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable @@ -217,7 +217,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -225,14 +225,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Go for deterministic Buf - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false @@ -268,7 +268,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -276,14 +276,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache-dependency-path: | @@ -291,7 +291,7 @@ jobs: nimi-cognition/go.sum - name: Setup Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' @@ -309,7 +309,7 @@ jobs: run: go vet ./... && go build ./... - name: Runtime golangci-lint - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.12.2 working-directory: runtime @@ -324,7 +324,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -332,14 +332,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Go for deterministic Buf - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false @@ -367,7 +367,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 @@ -375,14 +375,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Rust - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable components: clippy @@ -413,7 +413,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout CI selection policy - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Require every selected CI lane to pass env: NEEDS_JSON: ${{ toJSON(needs) }} diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index b5d2384db5..b9b62cec91 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout validator - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup pnpm @@ -26,7 +26,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - name: Install validator dependencies without lifecycle scripts diff --git a/.github/workflows/deploy-install-gateway.yml b/.github/workflows/deploy-install-gateway.yml index d7c1f6445d..c168134e53 100644 --- a/.github/workflows/deploy-install-gateway.yml +++ b/.github/workflows/deploy-install-gateway.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.commit_sha }} fetch-depth: 0 @@ -44,13 +44,13 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false - name: Setup Go required by the root install contract - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false diff --git a/.github/workflows/release-app-tools.yml b/.github/workflows/release-app-tools.yml index 9285557f09..bcae84f3c1 100644 --- a/.github/workflows/release-app-tools.yml +++ b/.github/workflows/release-app-tools.yml @@ -53,7 +53,7 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup pnpm @@ -61,7 +61,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false @@ -148,7 +148,7 @@ jobs: id-token: write steps: - name: Checkout exact tag source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Require immutable tag identity on main @@ -161,7 +161,7 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false diff --git a/.github/workflows/release-kit.yml b/.github/workflows/release-kit.yml index 3f8a98cab5..00c821aebb 100644 --- a/.github/workflows/release-kit.yml +++ b/.github/workflows/release-kit.yml @@ -51,7 +51,7 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup pnpm @@ -59,7 +59,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false @@ -148,7 +148,7 @@ jobs: artifact_name: ${{ steps.release.outputs.artifact_name }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -157,13 +157,13 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Install locked dependencies @@ -227,7 +227,7 @@ jobs: artifact_name: ${{ steps.release.outputs.artifact_name }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -236,13 +236,13 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Install locked dependencies @@ -302,7 +302,7 @@ jobs: id-token: write steps: - name: Checkout exact tag source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Require immutable tag identity on main @@ -315,7 +315,7 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false diff --git a/.github/workflows/release-nimi-shell-protected-local.yml b/.github/workflows/release-nimi-shell-protected-local.yml index 69c489eef1..fad03d2802 100644 --- a/.github/workflows/release-nimi-shell-protected-local.yml +++ b/.github/workflows/release-nimi-shell-protected-local.yml @@ -48,11 +48,11 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Resolve and verify protected-local component identity @@ -107,7 +107,7 @@ jobs: id-token: write steps: - name: Checkout exact tag source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Require immutable tag identity on main @@ -121,7 +121,7 @@ jobs: git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main test "$(sed -n 's/^version = "\([^"]*\)"/\1/p' kit/shell/protected-local/Cargo.toml | head -1)" = "${RELEASE_VERSION}" - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Package exact protected-local crate diff --git a/.github/workflows/release-nimi-shell-tauri.yml b/.github/workflows/release-nimi-shell-tauri.yml index dcc8ce18fb..eccb1bc4fd 100644 --- a/.github/workflows/release-nimi-shell-tauri.yml +++ b/.github/workflows/release-nimi-shell-tauri.yml @@ -50,11 +50,11 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Install Linux Tauri dependencies @@ -139,7 +139,7 @@ jobs: id-token: write steps: - name: Checkout exact tag source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Require immutable tag identity on main @@ -155,7 +155,7 @@ jobs: package_version="$(printf '%s' "${metadata}" | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const p=JSON.parse(s).packages.find(x=>x.name==='nimi-shell-tauri');process.stdout.write(p?.version || '')})")" test "${package_version}" = "${RELEASE_VERSION}" - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Package exact Tauri shell crate diff --git a/.github/workflows/release-security.yml b/.github/workflows/release-security.yml index 0dc9410174..0abdb261be 100644 --- a/.github/workflows/release-security.yml +++ b/.github/workflows/release-security.yml @@ -17,7 +17,7 @@ jobs: secrets: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_ref || github.sha }} persist-credentials: false @@ -32,10 +32,10 @@ jobs: - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 with: version: 10.34.5 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Scan exact release source @@ -46,11 +46,11 @@ jobs: workflow-audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} persist-credentials: false - - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable # Release validation installs tools itself; it does not restore PR tool caches. @@ -63,11 +63,11 @@ jobs: if: contains(fromJSON('["kit","protected-local","tauri","macos-production"]'), inputs.component) runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_ref || github.sha }} persist-credentials: false - - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Audit this component's native dependencies diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0f7dcde75d..c7882950ef 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup pnpm @@ -60,7 +60,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false @@ -132,7 +132,7 @@ jobs: id-token: write steps: - name: Checkout exact tag source - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Require immutable tag identity on main @@ -145,7 +145,7 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 package-manager-cache: false diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 420f880b7c..587f71c17b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -19,18 +19,18 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 - name: Setup Node - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "24" - name: Setup Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" @@ -44,16 +44,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Restore fixed zizmor installation id: tool-cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cargo/bin/zizmor key: security-ci-${{ runner.os }}-${{ runner.arch }}-zizmor-1.29.0 @@ -76,16 +76,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # v1 with: toolchain: stable - name: Restore fixed cargo-audit installation id: tool-cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cargo/bin/cargo-audit key: security-ci-${{ runner.os }}-${{ runner.arch }}-cargo-audit-0.22.2 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 238da6be0b..dcfded1992 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -13,7 +13,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: stale-issue-message: > This issue has been automatically marked as stale because it has not had