From cea7bd2ddb6441c31697c648179d15353e660b38 Mon Sep 17 00:00:00 2001 From: ide-developer Date: Thu, 9 Jul 2026 15:48:48 +0200 Subject: [PATCH] Update github-actions Signed-off-by: ide-developer --- .github/actions/setup-uv/action.yml | 2 +- .github/workflows/build-browser-tests.yaml | 4 ++-- .github/workflows/build-buildinputs.yaml | 6 +++--- .github/workflows/build-check-payload.yaml | 6 +++--- .github/workflows/build-notebooks-TEMPLATE.yaml | 2 +- .github/workflows/build-notebooks-pr-aipcc.yaml | 2 +- .github/workflows/build-notebooks-pr-rhel.yaml | 2 +- .github/workflows/build-notebooks-pr.yaml | 2 +- .github/workflows/build-notebooks-push.yaml | 2 +- .github/workflows/code-quality.yaml | 8 ++++---- .github/workflows/codeql.yaml | 8 ++++---- .github/workflows/gitleaks.yaml | 4 ++-- .github/workflows/piplock-renewal.yaml | 2 +- .github/workflows/purge-ghcr.yaml | 2 +- .github/workflows/rpms-lock-renewal.yaml | 2 +- .github/workflows/sec-scan.yml | 2 +- .github/workflows/security.yaml | 4 ++-- .github/workflows/semgrep.yaml | 4 ++-- .github/workflows/stale-prs.yaml | 2 +- .github/workflows/test-containers.yaml | 2 +- .github/workflows/test-playwright-action.yaml | 2 +- 21 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.github/actions/setup-uv/action.yml b/.github/actions/setup-uv/action.yml index dcc8b21dce..0cd59c42b8 100644 --- a/.github/actions/setup-uv/action.yml +++ b/.github/actions/setup-uv/action.yml @@ -15,7 +15,7 @@ runs: # https://github.com/astral-sh/setup-uv - name: Install uv and Python - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: version-file: pyproject.toml python-version: ${{ steps.python-version.outputs.version }} diff --git a/.github/workflows/build-browser-tests.yaml b/.github/workflows/build-browser-tests.yaml index dbbcf9e2ea..03bf9d4b31 100644 --- a/.github/workflows/build-browser-tests.yaml +++ b/.github/workflows/build-browser-tests.yaml @@ -55,7 +55,7 @@ jobs: - name: Login to Quay.io if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || inputs.push_image == true - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ${{ env.IMAGE_REGISTRY }} username: ${{ secrets.QUAY_ROBOT_USERNAME }} @@ -75,7 +75,7 @@ jobs: contents: read steps: - name: Login to Quay.io - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ${{ env.IMAGE_REGISTRY }} username: ${{ secrets.QUAY_ROBOT_USERNAME }} diff --git a/.github/workflows/build-buildinputs.yaml b/.github/workflows/build-buildinputs.yaml index 344906ebcf..38797746ee 100644 --- a/.github/workflows/build-buildinputs.yaml +++ b/.github/workflows/build-buildinputs.yaml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Calculate image tags id: meta @@ -54,14 +54,14 @@ jobs: - name: Log in to GHCR if: ${{ github.event_name != 'pull_request' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build image - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 id: build with: context: ./scripts/buildinputs diff --git a/.github/workflows/build-check-payload.yaml b/.github/workflows/build-check-payload.yaml index abb1856315..cc01d9705e 100644 --- a/.github/workflows/build-check-payload.yaml +++ b/.github/workflows/build-check-payload.yaml @@ -35,7 +35,7 @@ jobs: persist-credentials: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Calculate image tags id: meta @@ -55,14 +55,14 @@ jobs: - name: Log in to GHCR if: ${{ github.event_name != 'pull_request' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build image - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 id: build with: context: ./scripts/check-payload diff --git a/.github/workflows/build-notebooks-TEMPLATE.yaml b/.github/workflows/build-notebooks-TEMPLATE.yaml index c0cea583fb..9407bc4033 100644 --- a/.github/workflows/build-notebooks-TEMPLATE.yaml +++ b/.github/workflows/build-notebooks-TEMPLATE.yaml @@ -152,7 +152,7 @@ jobs: SUBSCRIPTION_ACTIVATION_KEY: ${{ secrets.SUBSCRIPTION_ACTIVATION_KEY }} - name: Login to GitHub Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/build-notebooks-pr-aipcc.yaml b/.github/workflows/build-notebooks-pr-aipcc.yaml index d760f434c6..12dafa6356 100644 --- a/.github/workflows/build-notebooks-pr-aipcc.yaml +++ b/.github/workflows/build-notebooks-pr-aipcc.yaml @@ -89,7 +89,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/build-notebooks-pr-rhel.yaml b/.github/workflows/build-notebooks-pr-rhel.yaml index ce4823ce3f..f9fa165e1c 100644 --- a/.github/workflows/build-notebooks-pr-rhel.yaml +++ b/.github/workflows/build-notebooks-pr-rhel.yaml @@ -88,7 +88,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/build-notebooks-pr.yaml b/.github/workflows/build-notebooks-pr.yaml index e5a985f190..ae8fce4857 100644 --- a/.github/workflows/build-notebooks-pr.yaml +++ b/.github/workflows/build-notebooks-pr.yaml @@ -31,7 +31,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/build-notebooks-push.yaml b/.github/workflows/build-notebooks-push.yaml index d4b01c349d..ef904ecd70 100644 --- a/.github/workflows/build-notebooks-push.yaml +++ b/.github/workflows/build-notebooks-push.yaml @@ -45,7 +45,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml index 538b71bf8e..ff99b19848 100644 --- a/.github/workflows/code-quality.yaml +++ b/.github/workflows/code-quality.yaml @@ -68,7 +68,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -117,12 +117,12 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: scripts/buildinputs/go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.12.2 working-directory: scripts/buildinputs @@ -213,7 +213,7 @@ jobs: persist-credentials: false - uses: ./.github/actions/setup-uv - name: "Cache prek" - uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/prek key: prek-${{ hashFiles('.pre-commit-config.yaml') }} diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 583764cbf4..abad93cf3c 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -33,19 +33,19 @@ jobs: - name: Set up Go if: matrix.language == 'go' - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: scripts/buildinputs/go.mod cache-dependency-path: scripts/buildinputs/go.mod - name: Initialize CodeQL - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: languages: ${{ matrix.language }} - name: Autobuild if: matrix.language != 'go' - uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 - name: Build Go if: matrix.language == 'go' @@ -54,6 +54,6 @@ jobs: go build ./... - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml index fb90e0a72f..8a08eed247 100644 --- a/.github/workflows/gitleaks.yaml +++ b/.github/workflows/gitleaks.yaml @@ -30,7 +30,7 @@ jobs: fetch-depth: 0 - name: Install Gitleaks - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 + uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 with: # mise_toml (not install_args) so the tool is both installed and # activated; install_args only runs `mise install` which leaves the @@ -60,6 +60,6 @@ jobs: - name: Upload SARIF # Do not upload on cancel or when scan/sanitize did not produce a valid SARIF. if: ${{ !cancelled() && steps.sanitize-gitleaks-sarif.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: sarif_file: gitleaks.sarif diff --git a/.github/workflows/piplock-renewal.yaml b/.github/workflows/piplock-renewal.yaml index 586c990bed..b45ba71bdb 100644 --- a/.github/workflows/piplock-renewal.yaml +++ b/.github/workflows/piplock-renewal.yaml @@ -114,7 +114,7 @@ jobs: - name: Login to GitHub Container Registry if: ${{ github.repository != 'opendatahub-io/notebooks' }} - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/purge-ghcr.yaml b/.github/workflows/purge-ghcr.yaml index c19e4b7130..57abeaff88 100644 --- a/.github/workflows/purge-ghcr.yaml +++ b/.github/workflows/purge-ghcr.yaml @@ -20,7 +20,7 @@ jobs: name: Delete old test images steps: # https://github.com/snok/container-retention-policy?tab=readme-ov-file#parameters - - uses: snok/container-retention-policy@3b0972b2276b171b212f8c4efbca59ebba26eceb # v3.0.1 + - uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 with: # account must be the gh org name when running for an org, and 'user' when running for a user account: ${{ (github.repository_owner == github.actor) && 'user' || github.repository_owner }} diff --git a/.github/workflows/rpms-lock-renewal.yaml b/.github/workflows/rpms-lock-renewal.yaml index 904896859f..8b2cca7687 100644 --- a/.github/workflows/rpms-lock-renewal.yaml +++ b/.github/workflows/rpms-lock-renewal.yaml @@ -109,7 +109,7 @@ jobs: echo "::add-mask::${SUBSCRIPTION_ORG}" - name: Login to GitHub Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/sec-scan.yml b/.github/workflows/sec-scan.yml index 254b02b781..9b92523f9f 100644 --- a/.github/workflows/sec-scan.yml +++ b/.github/workflows/sec-scan.yml @@ -95,7 +95,7 @@ jobs: persist-credentials: true - name: setup python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version-file: '.python-version' diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 196232a827..d5233aea6d 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -22,7 +22,7 @@ jobs: - name: Trivy scan uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: - version: 'v0.70.0' + version: 'v0.72.0' scan-type: 'fs' trivy-config: trivy.yaml format: 'sarif' @@ -30,6 +30,6 @@ jobs: exit-code: '0' - name: Update Security tab - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: sarif_file: 'trivy-results.sarif' diff --git a/.github/workflows/semgrep.yaml b/.github/workflows/semgrep.yaml index 95bef450e6..c1f7f2000b 100644 --- a/.github/workflows/semgrep.yaml +++ b/.github/workflows/semgrep.yaml @@ -28,7 +28,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Cache Semgrep - uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.local/pipx/venvs/semgrep key: ${{ runner.os }}-pipx-semgrep @@ -41,6 +41,6 @@ jobs: - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: sarif_file: semgrep.sarif diff --git a/.github/workflows/stale-prs.yaml b/.github/workflows/stale-prs.yaml index d7f1420267..4ff8edc141 100644 --- a/.github/workflows/stale-prs.yaml +++ b/.github/workflows/stale-prs.yaml @@ -11,7 +11,7 @@ jobs: stale: runs-on: ubuntu-26.04 steps: - - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0 + - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 with: stale-pr-message: "This PR is stale due to inactivity. Please update the PR to keep it alive. Otherwise, it will be closed after 14 days." days-before-issue-stale: -1 diff --git a/.github/workflows/test-containers.yaml b/.github/workflows/test-containers.yaml index 3d93a40e00..aac762e18e 100644 --- a/.github/workflows/test-containers.yaml +++ b/.github/workflows/test-containers.yaml @@ -121,7 +121,7 @@ jobs: echo "DOCKER_HOST=unix://$(podman info --format '{{.Host.RemoteSocket.Path}}')" >> "$GITHUB_ENV" - name: Login to GHCR - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/test-playwright-action.yaml b/.github/workflows/test-playwright-action.yaml index 8e5783a8ab..deb27b94b4 100644 --- a/.github/workflows/test-playwright-action.yaml +++ b/.github/workflows/test-playwright-action.yaml @@ -33,7 +33,7 @@ jobs: ver=$(scripts/get-pnpm-version.sh tests/browser/pnpm-lock.yaml) echo "version=${ver}" >> "$GITHUB_OUTPUT" - - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: ${{ steps.pnpm-ver.outputs.version }} cache: true