From 45f68a1b5369cdd7894f7a84ff00c547cb41b08c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 13:17:53 +0000 Subject: [PATCH 1/2] Bump the github-actions group across 2 directories with 7 updates Bumps the github-actions group with 2 updates in the /.github/setup-node directory: [actions/setup-node](https://github.com/actions/setup-node) and [actions/upload-artifact](https://github.com/actions/upload-artifact). Bumps the github-actions group with 7 updates in the /.github/workflows directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [actions/upload-artifact/merge](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.37.2` | `2.40.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `actions/upload-artifact/merge` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `shivammathur/setup-php` from 2.37.2 to 2.40.0 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/f3e473d116dcccaddc5834248c87452386958240...eb7c497e18156a6bbabfef1d3a82760b9eda3962) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact/merge dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: shivammathur/setup-php dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/setup-node/action.yml | 4 +-- .github/workflows/build-plugin-zip.yml | 14 ++++---- .github/workflows/bundle-size.yml | 6 ++-- .../workflows/check-package-changelogs.yml | 4 +-- .github/workflows/create-block.yml | 2 +- .github/workflows/end2end-test.yml | 34 +++++++++---------- .github/workflows/ios-tests.yml | 8 ++--- .github/workflows/performance.yml | 30 ++++++++-------- .github/workflows/publish-npm-packages.yml | 2 +- .../workflows/required-changes-from-trunk.yml | 2 +- .github/workflows/reusable-workflow-lint.yml | 4 +-- .github/workflows/static-checks.yml | 4 +-- .github/workflows/unit-test.yml | 12 +++---- .../upload-release-to-plugin-repo.yml | 10 +++--- .github/workflows/vitest-consumers.yml | 2 +- 15 files changed, 69 insertions(+), 69 deletions(-) diff --git a/.github/setup-node/action.yml b/.github/setup-node/action.yml index 169d2949bd2b6f..44742619297e93 100644 --- a/.github/setup-node/action.yml +++ b/.github/setup-node/action.yml @@ -13,7 +13,7 @@ runs: using: 'composite' steps: - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ${{ inputs.node-version == '' && '.nvmrc' || '' }} node-version: ${{ inputs.node-version }} @@ -60,7 +60,7 @@ runs: npm ci shell: bash - name: Upload npm logs as an artifact on failure - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: failure() with: name: npm-logs diff --git a/.github/workflows/build-plugin-zip.yml b/.github/workflows/build-plugin-zip.yml index e5cf3fa4f4d441..709b41d1359bdf 100644 --- a/.github/workflows/build-plugin-zip.yml +++ b/.github/workflows/build-plugin-zip.yml @@ -250,7 +250,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' check-latest: true @@ -279,7 +279,7 @@ jobs: run: mv gutenberg.zip gutenberg-wordpress-develop.zip - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: path: ./gutenberg${{ ! matrix.IS_GUTENBERG_PLUGIN && '-wordpress-develop' || '' }}.zip archive: false @@ -310,7 +310,7 @@ jobs: - name: Upload release notes artifact if: ${{ matrix.IS_GUTENBERG_PLUGIN && needs.bump-version.outputs.new_version }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-notes path: ./release-notes.txt @@ -338,7 +338,7 @@ jobs: steps: - name: Download build artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: gutenberg-wordpress-develop.zip @@ -495,7 +495,7 @@ jobs: run: echo "version=$(echo "$VERSION" | cut -d / -f 3 | sed 's/-rc./ RC/' )" >> "$GITHUB_OUTPUT" - name: Download Plugin Zip Artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: gutenberg.zip # The artifact is the plugin zip itself (uploaded with `archive: false`). @@ -504,7 +504,7 @@ jobs: skip-decompress: true - name: Download Release Notes Artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-notes @@ -587,7 +587,7 @@ jobs: git config user.email gutenberg@wordpress.org - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: 'main/.nvmrc' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/bundle-size.yml b/.github/workflows/bundle-size.yml index 588f917ecce894..a6eb9a4b040ff2 100644 --- a/.github/workflows/bundle-size.yml +++ b/.github/workflows/bundle-size.yml @@ -62,7 +62,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' check-latest: true @@ -97,7 +97,7 @@ jobs: - name: Upload the size report if: ${{ !cancelled() && steps.size.outputs.comment-body }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pr-meta--bundle-size path: ${{ runner.temp }}/pr-meta @@ -129,7 +129,7 @@ jobs: show-progress: ${{ runner.debug == '1' && 'true' || 'false' }} persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: name: pr-meta--bundle-size diff --git a/.github/workflows/check-package-changelogs.yml b/.github/workflows/check-package-changelogs.yml index 688ed5599aa93f..2865686fd282c1 100644 --- a/.github/workflows/check-package-changelogs.yml +++ b/.github/workflows/check-package-changelogs.yml @@ -166,7 +166,7 @@ jobs: # don't currently need to `npm ci` install any dependencies. - name: Use desired version of Node.js if: steps.filter.outputs.has_changes == 'true' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' package-manager-cache: false @@ -221,7 +221,7 @@ jobs: # This intentionally doesn't use `.github/setup-node`, because we # don't currently need to `npm ci` install any dependencies. - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' package-manager-cache: false diff --git a/.github/workflows/create-block.yml b/.github/workflows/create-block.yml index 5f939f4b5a4077..cf2e2adcb9bfcd 100644 --- a/.github/workflows/create-block.yml +++ b/.github/workflows/create-block.yml @@ -87,7 +87,7 @@ jobs: echo "version=$NODE_VERSION" >> "$GITHUB_OUTPUT" - name: Use Node.js ${{ steps.node.outputs.version }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.node.outputs.version }} package-manager-cache: false diff --git a/.github/workflows/end2end-test.yml b/.github/workflows/end2end-test.yml index 0b107fd7c3e0f6..71983768092783 100644 --- a/.github/workflows/end2end-test.yml +++ b/.github/workflows/end2end-test.yml @@ -86,7 +86,7 @@ jobs: # generated files next to sources: the block parsers, the icon # library, and the worker entry points. - name: Upload build output - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-output path: | @@ -141,7 +141,7 @@ jobs: uses: ./.github/setup-node - name: Download build output - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build-output @@ -162,7 +162,7 @@ jobs: xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- npm run --workspace @wordpress/e2e-tests-playwright test:e2e -- --shard=${{ matrix.part }}/${{ matrix.totalParts }} - name: Archive blob reports (HTML) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: blob-reports--${{ matrix.part }} @@ -170,7 +170,7 @@ jobs: if-no-files-found: ignore - name: Archive flaky tests report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: flaky-tests-report--${{ matrix.part }} @@ -207,7 +207,7 @@ jobs: uses: ./.github/setup-node - name: Download build output - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build-output @@ -236,7 +236,7 @@ jobs: xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- npm run --workspace @wordpress/e2e-tests-playwright test:e2e:rtc-websocket - name: Archive blob reports (HTML) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: blob-reports--rtc-websocket @@ -244,7 +244,7 @@ jobs: if-no-files-found: ignore - name: Archive flaky tests report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: flaky-tests-report--rtc-websocket @@ -281,7 +281,7 @@ jobs: uses: ./.github/setup-node - name: Download build output - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build-output @@ -308,7 +308,7 @@ jobs: xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- npm run --workspace @wordpress/e2e-tests-playwright test:e2e:site-editor-v2 - name: Archive blob reports (HTML) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: blob-reports--site-editor-v2 @@ -316,7 +316,7 @@ jobs: if-no-files-found: ignore - name: Archive flaky tests report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ !cancelled() }} with: name: flaky-tests-report--site-editor-v2 @@ -348,7 +348,7 @@ jobs: - name: Merge flaky tests reports id: merge-flaky-tests-reports - uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact/merge@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 continue-on-error: true with: name: flaky-tests-report @@ -356,7 +356,7 @@ jobs: delete-merged: true - name: Merge blob reports - uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact/merge@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 continue-on-error: true with: name: blob-reports-merged @@ -367,7 +367,7 @@ jobs: # it also resolves under the isolated install strategy. That puts # its working directory in the workspace, hence the paths below. - name: Download merged blob reports - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: name: blob-reports-merged @@ -378,7 +378,7 @@ jobs: continue-on-error: true - name: Upload merged HTML report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 continue-on-error: true with: name: html-report--attempt-${{ github.run_attempt }} @@ -392,7 +392,7 @@ jobs: - name: Download merged flaky tests report id: download-flaky-tests-report if: ${{ github.event_name == 'pull_request' && steps.merge-flaky-tests-reports.outputs.artifact-id }} - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: flaky-tests-report path: flaky-tests @@ -406,7 +406,7 @@ jobs: - name: Upload the flaky tests report if: ${{ steps.download-flaky-tests-report.outcome == 'success' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pr-meta--flaky-tests path: pr-meta @@ -439,7 +439,7 @@ jobs: show-progress: ${{ runner.debug == '1' && 'true' || 'false' }} persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: name: pr-meta--flaky-tests diff --git a/.github/workflows/ios-tests.yml b/.github/workflows/ios-tests.yml index b60f2c8c5efeb9..a5029f278b0935 100644 --- a/.github/workflows/ios-tests.yml +++ b/.github/workflows/ios-tests.yml @@ -41,7 +41,7 @@ jobs: run: npm run build -- --skip-types - name: Upload build output - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ios-build-output path: build @@ -72,13 +72,13 @@ jobs: # The artifact holds the contents of `build`; without a path they # land in the repository root and the plugin serves core's bundles. - name: Download build output - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ios-build-output path: build - name: Set up PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '8.4' coverage: none @@ -99,7 +99,7 @@ jobs: run: ./test/ios/run.sh - name: Archive the test results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: ${{ always() }} with: name: ios-test-results diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml index d39ed09a98a5da..0f306e749f3496 100644 --- a/.github/workflows/performance.yml +++ b/.github/workflows/performance.yml @@ -95,7 +95,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' package-manager-cache: false @@ -170,7 +170,7 @@ jobs: id: download if: matrix.branch.reuseRunId continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: plugin-${{ matrix.branch.sha }} run-id: ${{ matrix.branch.reuseRunId }} @@ -219,7 +219,7 @@ jobs: cp "$MANIFEST" "$PLUGIN_DIR/perf-build.json" - name: Upload plugin - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.branch.artifact }} path: ${{ runner.temp }}/plugin @@ -239,7 +239,7 @@ jobs: - name: Upload source maps if: matrix.branch.name == fromJSON( needs.prepare.outputs.branches )[0].name - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: performance-source-maps path: ${{ runner.temp }}/source-maps @@ -273,7 +273,7 @@ jobs: uses: ./.github/setup-node - name: Download prebuilt plugins - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: plugin-* path: ${{ runner.temp }}/artifacts @@ -310,7 +310,7 @@ jobs: - name: Archive performance summary if: success() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: performance-summary-${{ matrix.shard }} path: ${{ env.WP_ARTIFACTS_PATH }}/summary.md @@ -318,14 +318,14 @@ jobs: - name: Archive performance results if: success() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: performance-results-${{ matrix.shard }} path: ${{ env.WP_ARTIFACTS_PATH }}/*.performance-results*.json - name: Archive performance traces if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: performance-traces-${{ matrix.shard }} path: ${{ env.WP_ARTIFACTS_PATH }}/traces @@ -333,7 +333,7 @@ jobs: retention-days: 14 - name: Archive debug artifacts (screenshots, HTML snapshots) - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: failure() with: name: failures-artifacts-${{ matrix.shard }} @@ -368,13 +368,13 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' package-manager-cache: false - name: Download shard results - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: performance-results-* path: ${{ env.WP_ARTIFACTS_PATH }} @@ -382,7 +382,7 @@ jobs: # Keep the single artifact that existed before the tests were sharded. - name: Archive merged performance results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: performance-results path: ${{ env.WP_ARTIFACTS_PATH }}/*.performance-results*.json @@ -391,7 +391,7 @@ jobs: id: download-summaries if: ${{ github.event_name == 'pull_request' }} continue-on-error: true - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: performance-summary-* path: ${{ env.WP_ARTIFACTS_PATH }}/summaries @@ -413,7 +413,7 @@ jobs: - name: Upload the performance report if: ${{ steps.download-summaries.outcome == 'success' }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pr-meta--performance path: pr-meta @@ -453,7 +453,7 @@ jobs: show-progress: ${{ runner.debug == '1' && 'true' || 'false' }} persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true with: name: pr-meta--performance diff --git a/.github/workflows/publish-npm-packages.yml b/.github/workflows/publish-npm-packages.yml index 51465c5e64a795..e15e54b9dbae51 100644 --- a/.github/workflows/publish-npm-packages.yml +++ b/.github/workflows/publish-npm-packages.yml @@ -78,7 +78,7 @@ jobs: # The release CLI is always loaded from trunk, so use its runtime for every release. # The selected publishing branch must remain installable under this runtime. - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: 'cli/.nvmrc' registry-url: 'https://registry.npmjs.org' diff --git a/.github/workflows/required-changes-from-trunk.yml b/.github/workflows/required-changes-from-trunk.yml index 6e2bea54e9ae28..71503ab346cb98 100644 --- a/.github/workflows/required-changes-from-trunk.yml +++ b/.github/workflows/required-changes-from-trunk.yml @@ -128,7 +128,7 @@ jobs: - name: Upload the per-pull-request results if: ${{ !cancelled() && steps.refresh.outputs.results-file != '' && (failure() || steps.refresh.outputs.written != '0') }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: required-trunk-changes-refresh-${{ github.run_id }} path: ${{ steps.refresh.outputs.results-file }} diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index 20a096795f8a74..1f35853f2b4731 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -51,7 +51,7 @@ jobs: persist-credentials: false - name: Install the latest version of uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run zizmor run: uvx zizmor@1.24.1 --persona=regular --format=sarif --strict-collection . > results.sarif @@ -59,7 +59,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif category: zizmor diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml index 66306cac8a74f4..fe6bc2f5c9a8b9 100644 --- a/.github/workflows/static-checks.yml +++ b/.github/workflows/static-checks.yml @@ -64,7 +64,7 @@ jobs: run: .github/scripts/validate-labeler-config.sh - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node }} package-manager-cache: false @@ -200,7 +200,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: '.nvmrc' # No cache restoration: this workflow also runs on push, diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 9bf8b75a6299b2..2003d31c916010 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -84,7 +84,7 @@ jobs: run: sudo apt-get update -y && sudo apt-get install -y subversion - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: .nvmrc package-manager-cache: false @@ -192,7 +192,7 @@ jobs: - name: Upload Browser Mode failure artifacts if: ${{ failure() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: vitest-browser-failures path: | @@ -291,7 +291,7 @@ jobs: run: npm run build - name: Upload built JavaScript assets - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-assets path: | @@ -369,7 +369,7 @@ jobs: # dependency versions are installed and cached. ## - name: Set up PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 with: php-version: '${{ matrix.php }}' ini-file: development @@ -383,7 +383,7 @@ jobs: custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F") - name: Download built JavaScript assets - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: build-assets path: build @@ -465,7 +465,7 @@ jobs: persist-credentials: false - name: Set up PHP - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 with: php-version: '7.4' coverage: none diff --git a/.github/workflows/upload-release-to-plugin-repo.yml b/.github/workflows/upload-release-to-plugin-repo.yml index f2296345a7dcbe..1a1818a9f26a0f 100644 --- a/.github/workflows/upload-release-to-plugin-repo.yml +++ b/.github/workflows/upload-release-to-plugin-repo.yml @@ -250,7 +250,7 @@ jobs: fi - name: Upload Changelog artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: changelog ${{ matrix.label }} path: ./changelog.txt @@ -285,7 +285,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: .nvmrc package-manager-cache: false @@ -318,7 +318,7 @@ jobs: sed -i "s/$STABLE_TAG_PLACEHOLDER/Stable tag: $VERSION/g" ./trunk/readme.txt - name: Download Changelog Artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: changelog trunk path: trunk @@ -356,7 +356,7 @@ jobs: persist-credentials: false - name: Use desired version of Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: .nvmrc package-manager-cache: false @@ -381,7 +381,7 @@ jobs: sed -i "s/$STABLE_TAG_PLACEHOLDER/Stable tag: $VERSION/g" "$VERSION/readme.txt" - name: Download Changelog Artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: changelog trunk path: ${{ needs.get-release-metadata.outputs.version }} diff --git a/.github/workflows/vitest-consumers.yml b/.github/workflows/vitest-consumers.yml index 49a82e40a75cf7..d5629cba445449 100644 --- a/.github/workflows/vitest-consumers.yml +++ b/.github/workflows/vitest-consumers.yml @@ -41,7 +41,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node }} package-manager-cache: false From c5f5b3b0d2ba232cc9e2bd5ef204082be4423d55 Mon Sep 17 00:00:00 2001 From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com> Date: Fri, 16 Oct 2026 10:20:57 -0400 Subject: [PATCH 2/2] Use correct tag reference for inline comment. --- .github/workflows/unit-test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml index 2003d31c916010..e5b4505dec3d8d 100644 --- a/.github/workflows/unit-test.yml +++ b/.github/workflows/unit-test.yml @@ -369,7 +369,7 @@ jobs: # dependency versions are installed and cached. ## - name: Set up PHP - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '${{ matrix.php }}' ini-file: development @@ -465,7 +465,7 @@ jobs: persist-credentials: false - name: Set up PHP - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: '7.4' coverage: none