diff --git a/.github/workflows/ci-feedback.yml b/.github/workflows/ci-feedback.yml index be179c0..2377610 100644 --- a/.github/workflows/ci-feedback.yml +++ b/.github/workflows/ci-feedback.yml @@ -37,7 +37,7 @@ jobs: # tree. Either way `./actions/ci-feedback` cannot resolve, which is how # 0.1.21 shipped this path broken for every reusable caller. Name the # repository explicitly and pin it. - - uses: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26 + - uses: NDDev-OpenNetwork/ci-workflows/actions/ci-feedback@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b # 0.1.29 with: run-id: ${{ inputs.run-id }} run-attempt: ${{ inputs.run-attempt }} diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index cda0862..42ac44c 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -75,7 +75,7 @@ jobs: - name: Spell check (typos) if: ${{ inputs.typos }} - uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2 + uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3 with: files: ${{ inputs.typos_files }} diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml index 1d0a3d4..2a024b7 100644 --- a/.github/workflows/iac-scan.yml +++ b/.github/workflows/iac-scan.yml @@ -48,7 +48,7 @@ jobs: persist-credentials: false - name: Checkov - uses: bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e # v12.3125.0 + uses: bridgecrewio/checkov-action@5798bad4f6dd9c1fb67ae3ec10d42d8fb67037c4 # v12.3126.0 with: directory: ${{ inputs.directory }} framework: ${{ inputs.framework }} diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml index b4b690e..54f9118 100644 --- a/.github/workflows/kotlin-android-ci.yml +++ b/.github/workflows/kotlin-android-ci.yml @@ -81,7 +81,7 @@ jobs: - name: Set up Gradle id: gradle - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: cache-provider: basic diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml index 82d5b7d..4d5c6dc 100644 --- a/.github/workflows/nddev-security-bundle.yml +++ b/.github/workflows/nddev-security-bundle.yml @@ -169,7 +169,7 @@ jobs: - name: Upload zizmor SARIF if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }} - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif category: zizmor diff --git a/.github/workflows/private-security-bundle-free.yml b/.github/workflows/private-security-bundle-free.yml index 23e8b99..d26ec2d 100644 --- a/.github/workflows/private-security-bundle-free.yml +++ b/.github/workflows/private-security-bundle-free.yml @@ -150,7 +150,7 @@ jobs: - name: Restore pinned uv archive if: ${{ steps.baked-uv.outputs.available != 'true' }} id: uv-archive - uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26 + uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b # 0.1.29 with: url: https://github.com/astral-sh/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz sha256: 04bc7d180d6138bf6dc08387acf507a823f397a98fea55da36b0ccc7fbce3b68 @@ -173,7 +173,7 @@ jobs: printf '%s\n' "$RUNNER_TEMP/private-security-tools/bin" >> "$GITHUB_PATH" - name: Restore actionlint archive - uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26 + uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b # 0.1.29 with: url: https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz sha256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 @@ -181,7 +181,7 @@ jobs: max-bytes: '16777216' - name: Restore OSV-Scanner binary - uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26 + uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b # 0.1.29 with: url: https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64 sha256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108 @@ -189,7 +189,7 @@ jobs: max-bytes: '268435456' - name: Restore gitleaks archive - uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26 + uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@d92026cf31a10a0eeaa532e1f323c7cfdfbfac5b # 0.1.29 with: url: https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz sha256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml index c30a9ce..7c8432b 100644 --- a/.github/workflows/public-codeql.yml +++ b/.github/workflows/public-codeql.yml @@ -115,21 +115,21 @@ jobs: - name: Initialize CodeQL if: ${{ inputs.config_file == '' }} - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} - name: Initialize CodeQL with config if: ${{ inputs.config_file != '' }} - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} config-file: ${{ inputs.config_file }} - name: Autobuild if: ${{ inputs.autobuild && inputs.build_command == '' }} - uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 - name: Custom build if: ${{ inputs.build_command != '' }} @@ -139,13 +139,13 @@ jobs: - name: Analyze if: ${{ inputs.output_directory == '' }} - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{ matrix.language }}" - name: Analyze with output directory if: ${{ inputs.output_directory != '' }} - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{ matrix.language }}" output: ${{ inputs.output_directory }} diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml index c5cd05c..1c8a92c 100644 --- a/.github/workflows/public-scorecard.yml +++ b/.github/workflows/public-scorecard.yml @@ -165,7 +165,7 @@ jobs: - name: Upload SARIF to code scanning id: upload-sarif if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }} - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: results.sarif category: ${{ inputs.sarif_category }} diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml index 8073703..a0fc25b 100644 --- a/.github/workflows/rust-supply-chain.yml +++ b/.github/workflows/rust-supply-chain.yml @@ -101,7 +101,7 @@ jobs: with: toolchain: ${{ inputs.toolchain }} - name: Install cargo-audit - uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17 + uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 with: tool: cargo-audit@${{ inputs.cargo_audit_version }} - name: Run cargo-audit @@ -124,7 +124,7 @@ jobs: with: toolchain: ${{ inputs.toolchain }} - name: Install cargo-machete - uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17 + uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 with: tool: cargo-machete@${{ inputs.cargo_machete_version }} - name: Run cargo-machete diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml index 5c1b252..35a6628 100644 --- a/.github/workflows/zizmor-sarif.yml +++ b/.github/workflows/zizmor-sarif.yml @@ -82,7 +82,7 @@ jobs: "${ZIZMOR_TARGET}" > zizmor.sarif - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 + uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: sarif_file: zizmor.sarif category: zizmor diff --git a/catalog/action-images.yml b/catalog/action-images.yml index 61daa3a..2fe6a17 100644 --- a/catalog/action-images.yml +++ b/catalog/action-images.yml @@ -33,7 +33,7 @@ images: published-evidence path for the public tier, so a substituted image would change what the SARIF and JSON attest to. - action: bridgecrewio/checkov-action - image: docker://ghcr.io/bridgecrewio/checkov:3.3.19 + image: docker://ghcr.io/bridgecrewio/checkov:3.3.20 used_by: - .github/workflows/iac-scan.yml reason: >- diff --git a/catalog/scorecard-evidence.yml b/catalog/scorecard-evidence.yml index e79fe75..145ea98 100644 --- a/catalog/scorecard-evidence.yml +++ b/catalog/scorecard-evidence.yml @@ -66,7 +66,7 @@ category_contract: guid: null source_urls: - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go - - https://github.com/github/codeql-action/blob/1c5b675653bb5c22dbe9b12b556ec555138e09fd/src/upload-lib.ts + - https://github.com/github/codeql-action/blob/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2/src/upload-lib.ts - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning attempts: - attempt: 1 diff --git a/catalog/tools.yml b/catalog/tools.yml index 985f1b6..d112460 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -118,8 +118,8 @@ tools: name: github/codeql-action homepage: "https://github.com/github/codeql-action" kind: action - current_version: "v4.38.1" - pin: "github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd" + current_version: "v4.38.2" + pin: "github/codeql-action@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2" used_by: - .github/workflows/nddev-security-bundle.yml - .github/workflows/public-codeql.yml @@ -291,8 +291,8 @@ tools: name: gradle/actions/setup-gradle homepage: "https://github.com/gradle/actions" kind: action - current_version: "v6.3.0" - pin: "gradle/actions@9c971963bec38e04b3d30dcc455b5382be2fdbfb" + current_version: "v6.4.0" + pin: "gradle/actions@3f5f9adaf7d9fecd50b5935e54106014257a94e6" used_by: - .github/workflows/kotlin-android-ci.yml last_verified: "2026-09-21" @@ -362,8 +362,8 @@ tools: name: crate-ci/typos homepage: "https://github.com/crate-ci/typos" kind: action - current_version: "v1.50.2" - pin: "crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53" + current_version: "v1.50.3" + pin: "crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461" used_by: - .github/workflows/docs-quality.yml last_verified: "2026-09-21" @@ -464,8 +464,8 @@ tools: name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3125.0" - pin: "bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e" + current_version: "v12.3126.0" + pin: "bridgecrewio/checkov-action@5798bad4f6dd9c1fb67ae3ec10d42d8fb67037c4" used_by: - .github/workflows/iac-scan.yml last_verified: "2026-09-21" @@ -665,8 +665,8 @@ tools: name: taiki-e/install-action homepage: "https://github.com/taiki-e/install-action" kind: action - current_version: "v2.87.17" - pin: "taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73" + current_version: "v2.87.21" + pin: "taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29" used_by: - .github/workflows/rust-supply-chain.yml last_verified: "2026-09-21"