diff --git a/.github/workflows/build-macos-production.yml b/.github/workflows/build-macos-production.yml index 3358c35f8..405f483ee 100644 --- a/.github/workflows/build-macos-production.yml +++ b/.github/workflows/build-macos-production.yml @@ -105,7 +105,7 @@ jobs: with: version: 10.34.5 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -128,7 +128,7 @@ jobs: go-version-file: runtime/go.mod cache: false - name: Set up Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Install locked dependencies @@ -193,14 +193,14 @@ jobs: rm -f "${key_file}" "${admission_file}" - name: Upload complete Mac product release inputs if: inputs.prepare_product - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nimi-product-macos-arm64-${{ github.run_id }}-${{ github.run_attempt }} path: .nimi/local/product-release/macos-arm64/* include-hidden-files: true if-no-files-found: error - name: Upload only the signed installer - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nimi-macos-arm64-${{ github.run_id }}-${{ github.run_attempt }}-${{ inputs.realm_target || 'local-acceptance' }} path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f44c7b4dd..a4cac7287 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,7 +41,7 @@ jobs: with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - name: Detect changed paths @@ -66,7 +66,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -106,7 +106,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -171,7 +171,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -200,12 +200,12 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - name: Setup Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable @@ -228,7 +228,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 @@ -288,7 +288,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 @@ -298,7 +298,7 @@ jobs: go-version-file: runtime/go.mod - name: Setup Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable @@ -355,7 +355,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -403,7 +403,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -466,7 +466,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm @@ -520,14 +520,14 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: pnpm cache-dependency-path: pnpm-lock.yaml - name: Setup Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable components: clippy diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index c0030054a..e1361612a 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -26,7 +26,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - name: Install validator dependencies without lifecycle scripts diff --git a/.github/workflows/deploy-install-gateway.yml b/.github/workflows/deploy-install-gateway.yml index f1f159b76..18f409d16 100644 --- a/.github/workflows/deploy-install-gateway.yml +++ b/.github/workflows/deploy-install-gateway.yml @@ -48,7 +48,7 @@ jobs: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false diff --git a/.github/workflows/release-app-tools.yml b/.github/workflows/release-app-tools.yml index 89b62c0d2..3670d8495 100644 --- a/.github/workflows/release-app-tools.yml +++ b/.github/workflows/release-app-tools.yml @@ -61,7 +61,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -133,7 +133,7 @@ jobs: curl --retry 3 --retry-delay 2 --retry-all-errors --fail --silent --show-error --user-agent "${CRATES_IO_USER_AGENT}" "https://crates.io/api/v1/crates/nimi-shell-tauri/${tauri_version}" >/dev/null - name: Upload exact App Tools package for tag publication if: steps.release.outputs.production == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/app-tools/*.tgz @@ -163,13 +163,13 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Download exact validated App Tools package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate.outputs.artifact_name }} path: dist/component-release/app-tools diff --git a/.github/workflows/release-kit.yml b/.github/workflows/release-kit.yml index 80094475b..cd8753b05 100644 --- a/.github/workflows/release-kit.yml +++ b/.github/workflows/release-kit.yml @@ -59,7 +59,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -131,7 +131,7 @@ jobs: npm view "@nimiplatform/sdk@${sdk_range#^}" version >/dev/null - name: Upload exact Kit package for tag publication if: steps.release.outputs.production == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/kit/*.tgz @@ -157,13 +157,13 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Install locked dependencies @@ -207,7 +207,7 @@ jobs: if ($LASTEXITCODE -ne 0) { throw 'Windows native build changed tracked source' } - name: Upload exact Windows native package for tag publication if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kit/v') - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/kit-windows/*.tgz @@ -236,13 +236,13 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Install locked dependencies @@ -285,7 +285,7 @@ jobs: git diff --exit-code - name: Upload exact macOS native package for tag publication if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kit/v') - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/kit-macos/*.tgz @@ -315,18 +315,18 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Download exact validated Kit package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate.outputs.artifact_name }} path: dist/component-release/kit - name: Download exact validated Windows native package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate-windows.outputs.artifact_name }} path: dist/component-release/kit-windows @@ -348,7 +348,7 @@ jobs: npm publish "${tarballs[0]}" --access public --provenance fi - name: Download exact validated macOS native package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate-macos.outputs.artifact_name }} path: dist/component-release/kit-macos diff --git a/.github/workflows/release-nimi-shell-protected-local.yml b/.github/workflows/release-nimi-shell-protected-local.yml index fd4af1327..23cd40e81 100644 --- a/.github/workflows/release-nimi-shell-protected-local.yml +++ b/.github/workflows/release-nimi-shell-protected-local.yml @@ -52,7 +52,7 @@ jobs: with: fetch-depth: 0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Resolve and verify protected-local component identity @@ -121,7 +121,7 @@ jobs: git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main test "$(sed -n 's/^version = "\([^"]*\)"/\1/p' kit/shell/protected-local/Cargo.toml | head -1)" = "${RELEASE_VERSION}" - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Package exact protected-local crate diff --git a/.github/workflows/release-nimi-shell-tauri.yml b/.github/workflows/release-nimi-shell-tauri.yml index 6382a330b..c055056f6 100644 --- a/.github/workflows/release-nimi-shell-tauri.yml +++ b/.github/workflows/release-nimi-shell-tauri.yml @@ -54,7 +54,7 @@ jobs: with: fetch-depth: 0 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Install Linux Tauri dependencies @@ -155,7 +155,7 @@ jobs: package_version="$(printf '%s' "${metadata}" | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{const p=JSON.parse(s).packages.find(x=>x.name==='nimi-shell-tauri');process.stdout.write(p?.version || '')})")" test "${package_version}" = "${RELEASE_VERSION}" - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Package exact Tauri shell crate diff --git a/.github/workflows/release-product.yml b/.github/workflows/release-product.yml index ae5170e29..678230943 100644 --- a/.github/workflows/release-product.yml +++ b/.github/workflows/release-product.yml @@ -51,12 +51,12 @@ jobs: input: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha }} fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -117,22 +117,22 @@ jobs: runs-on: windows-latest timeout-minutes: 180 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha }} persist-credentials: false - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 with: version: 10.34.5 - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false - - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: runtime/go.mod cache: false - - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Install locked workspace and NSIS toolchain @@ -164,7 +164,7 @@ jobs: pnpm release:product:prepare-target -- --identity "$root/$asset.identity.json" --asset "$root/$asset" --inventory "$root/nimi-installed-windows-amd64.json" --admission $admissionFile --signing-key $keyFile --source $env:SOURCE_SHA --output .nimi/local/product-release/windows-amd64 if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } } finally { Remove-Item $keyFile, $admissionFile -Force -ErrorAction SilentlyContinue } - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nimi-product-windows-amd64-${{ github.run_id }}-${{ github.run_attempt }} path: .nimi/local/product-release/windows-amd64/* @@ -184,15 +184,15 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.source_sha }} persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 if: inputs.prepared_run_id == '' && (inputs.prepared_windows_run_id == '' || inputs.prepared_macos_run_id == '') with: pattern: nimi-product-*-${{ github.run_id }}-${{ github.run_attempt }} @@ -200,7 +200,7 @@ jobs: path: .nimi/local/product-release/ready - name: Download the original prepared Windows target if: inputs.prepared_windows_run_id != '' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nimi-product-windows-amd64-${{ inputs.prepared_windows_run_id }}-${{ inputs.prepared_windows_run_attempt }} github-token: ${{ github.token }} @@ -209,7 +209,7 @@ jobs: path: .nimi/local/product-release/ready - name: Download the original prepared macOS target if: inputs.prepared_macos_run_id != '' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nimi-product-macos-arm64-${{ inputs.prepared_macos_run_id }}-${{ inputs.prepared_macos_run_attempt }} github-token: ${{ github.token }} @@ -218,7 +218,7 @@ jobs: path: .nimi/local/product-release/ready - name: Download the original complete prepared file set if: inputs.prepared_run_id != '' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nimi-product-ready-${{ inputs.prepared_run_id }}-${{ inputs.prepared_run_attempt }} github-token: ${{ github.token }} @@ -229,7 +229,7 @@ jobs: env: SOURCE_SHA: ${{ inputs.source_sha }} run: node scripts/release/validate-product-release.mjs --directory .nimi/local/product-release/ready --source "${SOURCE_SHA}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nimi-product-ready-${{ github.run_id }}-${{ github.run_attempt }} path: .nimi/local/product-release/ready/* @@ -241,16 +241,16 @@ jobs: if: always() && needs.assemble.result == 'success' && inputs.publish runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nimi-product-ready-${{ github.run_id }}-${{ github.run_attempt }} path: .nimi/local/product-release/ready diff --git a/.github/workflows/release-sdk-adapter-vercel-ai.yml b/.github/workflows/release-sdk-adapter-vercel-ai.yml index 8fa2b9d30..ce71342ad 100644 --- a/.github/workflows/release-sdk-adapter-vercel-ai.yml +++ b/.github/workflows/release-sdk-adapter-vercel-ai.yml @@ -60,7 +60,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -120,7 +120,7 @@ jobs: npm view "@nimiplatform/sdk@${sdk_range}" version >/dev/null - name: Upload exact Vercel adapter package for tag publication if: steps.release.outputs.production == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/sdk-adapter-vercel-ai/*.tgz @@ -150,13 +150,13 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Download exact validated Vercel adapter package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate.outputs.artifact_name }} path: dist/component-release/sdk-adapter-vercel-ai diff --git a/.github/workflows/release-security.yml b/.github/workflows/release-security.yml index d5ecf2d60..4d9587365 100644 --- a/.github/workflows/release-security.yml +++ b/.github/workflows/release-security.yml @@ -32,7 +32,7 @@ jobs: - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: version: 10.34.5 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 @@ -50,7 +50,7 @@ jobs: with: ref: ${{ github.sha }} persist-credentials: false - - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable # Release validation installs tools itself; it does not restore PR tool caches. @@ -67,7 +67,7 @@ jobs: with: ref: ${{ inputs.source_ref || github.sha }} persist-credentials: false - - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable - name: Audit this component's native dependencies diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e7b47f42b..dc9f33c80 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,7 +60,7 @@ jobs: with: version: 10.34.5 - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -115,7 +115,7 @@ jobs: npm publish "${tarballs[0]}" --access public --dry-run - name: Upload exact SDK package for tag publication if: steps.release.outputs.production == 'true' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.release.outputs.artifact_name }} path: dist/component-release/sdk/*.tgz @@ -145,13 +145,13 @@ jobs: git fetch --no-tags origin main:refs/remotes/origin/main git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main - name: Setup Node.js for npm OIDC - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false registry-url: https://registry.npmjs.org - name: Download exact validated SDK package - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ needs.validate.outputs.artifact_name }} path: dist/component-release/sdk diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 5e9639c90..649039231 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -25,7 +25,7 @@ jobs: uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Setup Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" @@ -47,7 +47,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable @@ -79,7 +79,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Rust - uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1 + uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1 with: toolchain: stable