From fd26888eb0087daf601ae3b2c79650e0d693ea60 Mon Sep 17 00:00:00 2001 From: dlp-bot Date: Mon, 26 Oct 2026 21:16:22 +0100 Subject: [PATCH] [ci] Update 7 actions in 9 workflows (#17925) * Bump actions/download-artifact v8.0.1 => v8.0.2 * Bump actions/setup-node v7.0.0 => v7.1.0 * Bump actions/setup-python v7.0.0 => v7.1.0 * Bump actions/upload-artifact v7.0.1 => v7.0.2 * Bump github/codeql-action v4.38.2 => v4.39.1 * Bump pypa/gh-action-pypi-publish v1.14.2 => v1.14.3 * Bump zizmorcore/zizmor-action v0.6.4 => v0.8.0 Authored by: bashonly, dlp-bot Co-authored-by: bashonly --- .github/workflows/build.yml | 18 +++++++++--------- .github/workflows/challenge-tests.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/core.yml | 2 +- .github/workflows/quick-test.yml | 4 ++-- .github/workflows/release-master.yml | 4 ++-- .github/workflows/release-nightly.yml | 4 ++-- .github/workflows/release.yml | 12 ++++++------ .github/workflows/sanitize-comment.yml | 2 +- .github/workflows/test-workflows.yml | 4 ++-- 10 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 91d9467e8f..7cf8ad361d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -200,7 +200,7 @@ jobs: fetch-depth: 0 # Needed for changelog persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' @@ -229,7 +229,7 @@ jobs: [[ "${version}" != "${downgraded_version}" ]] - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-bin-${{ github.job }} path: | @@ -291,7 +291,7 @@ jobs: docker compose up --build --exit-code-from "${SERVICE}" "${SERVICE}" - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-bin-${{ matrix.os }}_${{ matrix.arch }} path: | @@ -376,7 +376,7 @@ jobs: [[ "$version" != "$downgraded_version" ]] - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-bin-${{ github.job }} path: | @@ -396,7 +396,7 @@ jobs: steps: - name: Download artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: build-bin-macos @@ -439,7 +439,7 @@ jobs: with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' architecture: ${{ matrix.arch }} @@ -496,7 +496,7 @@ jobs: } - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-bin-${{ github.job }}-${{ matrix.arch }} path: | @@ -517,7 +517,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifact pattern: build-bin-* @@ -594,7 +594,7 @@ jobs: done - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-${{ github.job }} path: | diff --git a/.github/workflows/challenge-tests.yml b/.github/workflows/challenge-tests.yml index 0b3bda5475..0361ffac4c 100644 --- a/.github/workflows/challenge-tests.yml +++ b/.github/workflows/challenge-tests.yml @@ -45,7 +45,7 @@ jobs: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true @@ -62,7 +62,7 @@ jobs: no-cache: true - name: Install Node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: '22.0' # minimum supported version diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 74ae8547c6..f61988edd3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,12 +36,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml index 973bc04af6..7a48cec119 100644 --- a/.github/workflows/core.yml +++ b/.github/workflows/core.yml @@ -57,7 +57,7 @@ jobs: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true diff --git a/.github/workflows/quick-test.yml b/.github/workflows/quick-test.yml index 7cd815d6c7..f55f844b70 100644 --- a/.github/workflows/quick-test.yml +++ b/.github/workflows/quick-test.yml @@ -25,7 +25,7 @@ jobs: with: persist-credentials: false - name: Set up Python 3.11 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.11' - name: Install test requirements @@ -51,7 +51,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' - name: Install dev dependencies diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml index f9d1161fd1..9f351cdf84 100644 --- a/.github/workflows/release-master.yml +++ b/.github/workflows/release-master.yml @@ -42,11 +42,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Download artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist name: build-pypi - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: verbose: true diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index e0538c7476..24292f0b39 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -95,12 +95,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Download artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist name: build-pypi - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: verbose: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e197553e1a..7f8ebd759b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -90,7 +90,7 @@ jobs: persist-credentials: true # Needed to git-push the release commit ssh-key: ${{ secrets.RELEASE_KEY }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' # Keep this in sync with test-workflows.yml @@ -178,7 +178,7 @@ jobs: with: fetch-depth: 0 # Needed for changelog persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' @@ -215,7 +215,7 @@ jobs: - name: Upload artifacts if: github.event.workflow != '.github/workflows/release.yml' # Reusable workflow_call - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: build-pypi path: | @@ -224,7 +224,7 @@ jobs: - name: Publish to PyPI if: github.event.workflow == '.github/workflows/release.yml' # Direct workflow_dispatch - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: verbose: true @@ -245,12 +245,12 @@ jobs: fetch-depth: 0 persist-credentials: true # Needed to git-push the release tag ssh-key: ${{ secrets.RELEASE_KEY }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifact pattern: build-* merge-multiple: true - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' diff --git a/.github/workflows/sanitize-comment.yml b/.github/workflows/sanitize-comment.yml index 5faf4cb3f7..7c815cdf60 100644 --- a/.github/workflows/sanitize-comment.yml +++ b/.github/workflows/sanitize-comment.yml @@ -2,7 +2,7 @@ name: Sanitize comment on: issue_comment: - types: [created, edited] + types: [created, edited] # zizmor: ignore[dangerous-triggers] permissions: {} diff --git a/.github/workflows/test-workflows.yml b/.github/workflows/test-workflows.yml index d32fb58d4d..1a6c07934e 100644 --- a/.github/workflows/test-workflows.yml +++ b/.github/workflows/test-workflows.yml @@ -30,7 +30,7 @@ jobs: with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.14' # Keep this in sync with release.yml's prepare job @@ -83,7 +83,7 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 with: advanced-security: false persona: pedantic