From 52a900773be75315d010a0d2d76364bccee50558 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 21 Sep 2026 14:02:42 +0500 Subject: [PATCH] chore(tools): scheduled pin refresh to 2026-09-21 upstream releases Bumps twelve action pins and three CLI pins: codeql-action v4.38.1, setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, build-push-action v7.4.0, install-action v2.87.17, osv-scanner 2.6.0, semgrep 1.177.0, syft 1.52.0. checkov's transitive docker image re-recorded as checkov:3.3.19. setup-rust-toolchain (v2.0.0 major) and zizmor (v1.30.1, 65 new low findings) held pending dedicated review. Signed-off-by: rldyourmnd --- .github/workflows/benchmark-compare.yml | 2 +- .github/workflows/benchmark.yml | 2 +- .github/workflows/ci.yml | 8 +- .github/workflows/coverage-gate.yml | 2 +- .github/workflows/docker-build.yml | 4 +- .github/workflows/docs-quality.yml | 2 +- .github/workflows/iac-scan.yml | 2 +- .github/workflows/java-ci.yml | 2 +- .github/workflows/kotlin-android-ci.yml | 4 +- .github/workflows/maintenance.yml | 2 +- .github/workflows/nddev-security-bundle.yml | 4 +- .github/workflows/osv-scan.yml | 4 +- .../private-security-bundle-free.yml | 4 +- .github/workflows/private-static.yml | 2 +- .github/workflows/public-codeql.yml | 10 +- .github/workflows/public-scorecard.yml | 2 +- .github/workflows/python-ci.yml | 2 +- .github/workflows/qt-ci.yml | 2 +- .github/workflows/r-ci.yml | 2 +- .../workflows/release-supply-chain-free.yml | 10 +- .github/workflows/release-supply-chain.yml | 10 +- .github/workflows/release.yml | 2 +- .../workflows/runtime-fixtures-languages.yml | 12 +- .github/workflows/rust-supply-chain.yml | 4 +- .github/workflows/semgrep-ci.yml | 4 +- .github/workflows/sql-ci.yml | 2 +- .github/workflows/zizmor-no-sarif.yml | 2 +- .github/workflows/zizmor-sarif.yml | 4 +- CHANGELOG.md | 12 ++ catalog/action-images.yml | 2 +- catalog/scorecard-evidence.yml | 2 +- catalog/tools.yml | 171 +++++++++--------- scripts/check_release_supply_chain.py | 10 +- scripts/run_private_security_bundle.sh | 4 +- 34 files changed, 166 insertions(+), 147 deletions(-) diff --git a/.github/workflows/benchmark-compare.yml b/.github/workflows/benchmark-compare.yml index a56e891..0c32cd3 100644 --- a/.github/workflows/benchmark-compare.yml +++ b/.github/workflows/benchmark-compare.yml @@ -126,7 +126,7 @@ jobs: run: bash -euo pipefail -c "$BENCH_COMMAND" - name: Compare and alert - uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 + uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc # v1.22.2 with: tool: ${{ inputs.tool }} output-file-path: ${{ inputs.output_file_path }} diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 6989751..667519d 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -128,7 +128,7 @@ jobs: run: bash -euo pipefail -c "$BENCH_COMMAND" - name: Compare and alert - uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1 + uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc # v1.22.2 with: tool: ${{ inputs.tool }} output-file-path: ${{ inputs.output_file_path }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ed7d83c..0e2912f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -68,7 +68,7 @@ jobs: python-version: "3.13" update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # Stated, not inherited -- and it does change something. The pinned @@ -124,7 +124,7 @@ jobs: python-version: "3.13" update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # Stated, not inherited -- and it does change something. The pinned @@ -299,7 +299,7 @@ jobs: update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 enable-cache: false @@ -396,7 +396,7 @@ jobs: update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 enable-cache: false diff --git a/.github/workflows/coverage-gate.yml b/.github/workflows/coverage-gate.yml index 1dd8194..0e84ba6 100644 --- a/.github/workflows/coverage-gate.yml +++ b/.github/workflows/coverage-gate.yml @@ -103,7 +103,7 @@ jobs: - name: Upload to Codecov if: ${{ inputs.use_codecov }} - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: token: ${{ secrets.codecov_token }} files: ${{ inputs.files }} diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 076dd7a..4137c56 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -147,11 +147,11 @@ jobs: password: ${{ github.token }} - name: Set up BuildKit - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Build and push id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: ${{ inputs.context }} file: ${{ inputs.dockerfile }} diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 097248e..cda0862 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -75,7 +75,7 @@ jobs: - name: Spell check (typos) if: ${{ inputs.typos }} - uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3 # v1.50.0 + uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2 with: files: ${{ inputs.typos_files }} diff --git a/.github/workflows/iac-scan.yml b/.github/workflows/iac-scan.yml index 8c04bc7..1d0a3d4 100644 --- a/.github/workflows/iac-scan.yml +++ b/.github/workflows/iac-scan.yml @@ -48,7 +48,7 @@ jobs: persist-credentials: false - name: Checkov - uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e # v12.3122.0 + uses: bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e # v12.3125.0 with: directory: ${{ inputs.directory }} framework: ${{ inputs.framework }} diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml index 8403287..195194c 100644 --- a/.github/workflows/java-ci.yml +++ b/.github/workflows/java-ci.yml @@ -64,7 +64,7 @@ jobs: - name: Set up Java if: ${{ !inputs.use_preinstalled_toolchain }} - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.distribution }} diff --git a/.github/workflows/kotlin-android-ci.yml b/.github/workflows/kotlin-android-ci.yml index 2264487..b4b690e 100644 --- a/.github/workflows/kotlin-android-ci.yml +++ b/.github/workflows/kotlin-android-ci.yml @@ -74,7 +74,7 @@ jobs: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: java-version: ${{ inputs.java_version }} distribution: ${{ inputs.java_distribution }} @@ -87,7 +87,7 @@ jobs: - name: Set up Android SDK if: ${{ inputs.setup_android }} - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 + uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4 with: packages: ${{ inputs.android_packages }} diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml index 97b1906..cdd1e84 100644 --- a/.github/workflows/maintenance.yml +++ b/.github/workflows/maintenance.yml @@ -82,7 +82,7 @@ jobs: update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # The sweep decides what maintenance debt exists; it must not diff --git a/.github/workflows/nddev-security-bundle.yml b/.github/workflows/nddev-security-bundle.yml index f14e5f6..2a0515b 100644 --- a/.github/workflows/nddev-security-bundle.yml +++ b/.github/workflows/nddev-security-bundle.yml @@ -116,7 +116,7 @@ jobs: "$source_root/scripts/run_private_security_bundle.sh" >> "$GITHUB_ENV" - name: Set up pinned uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 enable-cache: false @@ -169,7 +169,7 @@ jobs: - name: Upload zizmor SARIF if: ${{ !cancelled() && steps.scan.conclusion != 'skipped' }} - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: sarif_file: ${{ runner.temp }}/private-security-zizmor.sarif category: zizmor diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml index 3c4b45b..9505cb8 100644 --- a/.github/workflows/osv-scan.yml +++ b/.github/workflows/osv-scan.yml @@ -19,11 +19,11 @@ on: default: '--recursive .' osv_scanner_version: type: string - default: '2.5.0' + default: '2.6.0' osv_scanner_sha256: description: 'SHA256 of osv-scanner_linux_amd64 from the release SHA256SUMS.' type: string - default: 'edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c' + default: 'ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108' timeout_minutes: type: number default: 15 diff --git a/.github/workflows/private-security-bundle-free.yml b/.github/workflows/private-security-bundle-free.yml index acae325..b353bac 100644 --- a/.github/workflows/private-security-bundle-free.yml +++ b/.github/workflows/private-security-bundle-free.yml @@ -183,8 +183,8 @@ jobs: - name: Restore OSV-Scanner binary uses: NDDev-OpenNetwork/ci-workflows/actions/tool-cache@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23 with: - url: https://github.com/google/osv-scanner/releases/download/v2.5.0/osv-scanner_linux_amd64 - sha256: edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c + url: https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64 + sha256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108 output: ${{ runner.temp }}/private-security-tools/osv-scanner max-bytes: '268435456' diff --git a/.github/workflows/private-static.yml b/.github/workflows/private-static.yml index 50d10a1..1a57e8b 100644 --- a/.github/workflows/private-static.yml +++ b/.github/workflows/private-static.yml @@ -110,7 +110,7 @@ jobs: - name: Set up uv if: ${{ inputs.setup_uv }} - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: ${{ inputs.uv_version }} # uv provisions our pinned tooling here, not the caller's diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml index 181033d..c30a9ce 100644 --- a/.github/workflows/public-codeql.yml +++ b/.github/workflows/public-codeql.yml @@ -115,21 +115,21 @@ jobs: - name: Initialize CodeQL if: ${{ inputs.config_file == '' }} - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} - name: Initialize CodeQL with config if: ${{ inputs.config_file != '' }} - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: languages: ${{ matrix.language }} config-file: ${{ inputs.config_file }} - name: Autobuild if: ${{ inputs.autobuild && inputs.build_command == '' }} - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 - name: Custom build if: ${{ inputs.build_command != '' }} @@ -139,13 +139,13 @@ jobs: - name: Analyze if: ${{ inputs.output_directory == '' }} - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: category: "/language:${{ matrix.language }}" - name: Analyze with output directory if: ${{ inputs.output_directory != '' }} - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: category: "/language:${{ matrix.language }}" output: ${{ inputs.output_directory }} diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml index ed8a496..c5cd05c 100644 --- a/.github/workflows/public-scorecard.yml +++ b/.github/workflows/public-scorecard.yml @@ -165,7 +165,7 @@ jobs: - name: Upload SARIF to code scanning id: upload-sarif if: ${{ github.event_name != 'pull_request' || inputs.upload_sarif_on_forks || github.event.pull_request.head.repo.full_name == github.repository }} - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: sarif_file: results.sarif category: ${{ inputs.sarif_category }} diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index ed7943f..caa32fa 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -108,7 +108,7 @@ jobs: - name: Set up uv and Python if: ${{ inputs.package_manager == 'uv' && !inputs.use_preinstalled_toolchain }} - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: ${{ inputs.uv_version }} enable-cache: true diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml index a00d815..f50ab12 100644 --- a/.github/workflows/qt-ci.yml +++ b/.github/workflows/qt-ci.yml @@ -98,7 +98,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # Pinned, not inherited: setup-uv's `version` defaults to the # version in pyproject.toml or, absent one, whatever is latest. diff --git a/.github/workflows/r-ci.yml b/.github/workflows/r-ci.yml index eda79fd..1a102b4 100644 --- a/.github/workflows/r-ci.yml +++ b/.github/workflows/r-ci.yml @@ -64,7 +64,7 @@ jobs: persist-credentials: false - name: Set up R - uses: r-lib/actions/setup-r@465b7d8e732ca3921382b1674c59bada9cbf3399 # v2.13.0 + uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2.14.0 with: r-version: ${{ inputs.r_version }} use-public-rspm: ${{ inputs.use_public_rspm }} diff --git a/.github/workflows/release-supply-chain-free.yml b/.github/workflows/release-supply-chain-free.yml index aad82db..2119f5d 100644 --- a/.github/workflows/release-supply-chain-free.yml +++ b/.github/workflows/release-supply-chain-free.yml @@ -435,11 +435,11 @@ jobs: RELEASE_RUNNER_ARCH: ${{ runner.arch }} RELEASE_RUNNER_OS: ${{ runner.os }} SYFT_CHECK_FOR_APP_UPDATE: 'false' - SYFT_LINUX_ARM64_SHA256: 9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e - SYFT_LINUX_ARM64_SIZE: '25829350' - SYFT_LINUX_X64_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca - SYFT_LINUX_X64_SIZE: '28342623' - SYFT_VERSION: '1.46.0' + SYFT_LINUX_ARM64_SHA256: c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706 + SYFT_LINUX_ARM64_SIZE: '26744986' + SYFT_LINUX_X64_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d + SYFT_LINUX_X64_SIZE: '29289629' + SYFT_VERSION: '1.52.0' run: | set -euo pipefail umask 077 diff --git a/.github/workflows/release-supply-chain.yml b/.github/workflows/release-supply-chain.yml index 220aaa6..ddc1781 100644 --- a/.github/workflows/release-supply-chain.yml +++ b/.github/workflows/release-supply-chain.yml @@ -442,11 +442,11 @@ jobs: RELEASE_RUNNER_ARCH: ${{ runner.arch }} RELEASE_RUNNER_OS: ${{ runner.os }} SYFT_CHECK_FOR_APP_UPDATE: 'false' - SYFT_LINUX_ARM64_SHA256: 9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e - SYFT_LINUX_ARM64_SIZE: '25829350' - SYFT_LINUX_X64_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca - SYFT_LINUX_X64_SIZE: '28342623' - SYFT_VERSION: '1.46.0' + SYFT_LINUX_ARM64_SHA256: c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706 + SYFT_LINUX_ARM64_SIZE: '26744986' + SYFT_LINUX_X64_SHA256: caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d + SYFT_LINUX_X64_SIZE: '29289629' + SYFT_VERSION: '1.52.0' run: | set -euo pipefail umask 077 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a70d1fb..c45e7ee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -77,7 +77,7 @@ jobs: update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # setup-uv caches by default. On a publishing workflow that turns the diff --git a/.github/workflows/runtime-fixtures-languages.yml b/.github/workflows/runtime-fixtures-languages.yml index 07d40b4..0f43fcf 100644 --- a/.github/workflows/runtime-fixtures-languages.yml +++ b/.github/workflows/runtime-fixtures-languages.yml @@ -500,7 +500,7 @@ jobs: python-version: '3.13' update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # Pinned, not inherited: setup-uv's `version` defaults to the # version in pyproject.toml or, absent one, whatever is latest. @@ -544,7 +544,7 @@ jobs: python-version: '3.13' update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # Pinned, not inherited: setup-uv's `version` defaults to the # version in pyproject.toml or, absent one, whatever is latest. @@ -586,12 +586,12 @@ jobs: with: persist-credentials: false - name: Set up JDK - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: java-version: '21' distribution: temurin - name: Set up Android SDK - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 + uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4 with: packages: 'platforms;android-37.0 build-tools;36.0.0' - name: Set up isolated Python contract runtime @@ -601,7 +601,7 @@ jobs: python-version: '3.13' update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # Pinned, not inherited: setup-uv's `version` defaults to the # version in pyproject.toml or, absent one, whatever is latest. @@ -660,7 +660,7 @@ jobs: python-version: '3.13' update-environment: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: # Pinned, not inherited: setup-uv's `version` defaults to the # version in pyproject.toml or, absent one, whatever is latest. diff --git a/.github/workflows/rust-supply-chain.yml b/.github/workflows/rust-supply-chain.yml index ffa149f..4d21b35 100644 --- a/.github/workflows/rust-supply-chain.yml +++ b/.github/workflows/rust-supply-chain.yml @@ -101,7 +101,7 @@ jobs: with: toolchain: ${{ inputs.toolchain }} - name: Install cargo-audit - uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2 + uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17 with: tool: cargo-audit@${{ inputs.cargo_audit_version }} - name: Run cargo-audit @@ -124,7 +124,7 @@ jobs: with: toolchain: ${{ inputs.toolchain }} - name: Install cargo-machete - uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2 + uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17 with: tool: cargo-machete@${{ inputs.cargo_machete_version }} - name: Run cargo-machete diff --git a/.github/workflows/semgrep-ci.yml b/.github/workflows/semgrep-ci.yml index d40da72..29d2c9f 100644 --- a/.github/workflows/semgrep-ci.yml +++ b/.github/workflows/semgrep-ci.yml @@ -20,7 +20,7 @@ on: semgrep_version: description: 'Exact semgrep version to pin.' type: string - default: '1.170.0' + default: '1.177.0' extra_args: type: string default: '' @@ -57,7 +57,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # uv provisions our pinned analyser here, not the caller's diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml index 5e8aaf5..54776c6 100644 --- a/.github/workflows/sql-ci.yml +++ b/.github/workflows/sql-ci.yml @@ -65,7 +65,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # uv provisions our pinned tooling here, not the caller's diff --git a/.github/workflows/zizmor-no-sarif.yml b/.github/workflows/zizmor-no-sarif.yml index b3075de..495847f 100644 --- a/.github/workflows/zizmor-no-sarif.yml +++ b/.github/workflows/zizmor-no-sarif.yml @@ -56,7 +56,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # Consumer-facing gate. uv provisions our pinned analyser here, diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml index 31d47c7..7026a88 100644 --- a/.github/workflows/zizmor-sarif.yml +++ b/.github/workflows/zizmor-sarif.yml @@ -57,7 +57,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 with: version: 0.11.30 # This workflow backs the `zizmor` job, which is in `ci-gate.needs`. @@ -82,7 +82,7 @@ jobs: "${ZIZMOR_TARGET}" > zizmor.sarif - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: sarif_file: zizmor.sarif category: zizmor diff --git a/CHANGELOG.md b/CHANGELOG.md index 2c65918..27ef6c6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,18 @@ The project follows Semantic Versioning. ## [Unreleased] +- **Scheduled tool refresh, 2026-09-21.** Bumped twelve action pins and three + CLI pins to their current upstream releases: codeql-action v4.38.1, + setup-android v4.0.4, setup-r v2.14.0, codecov-action v7.1.1, typos + v1.50.2, checkov-action v12.3125.0, github-action-benchmark v1.22.2, + setup-uv v10.1.0, setup-java v6.0.1, setup-buildx-action v4.4.1, + build-push-action v7.4.0, install-action v2.87.17; osv-scanner 2.6.0, + semgrep 1.177.0 and syft 1.52.0 with re-verified release checksums. + `setup-rust-toolchain` stays on v1.17.0 (upstream v2.0.0 is a major bump + pending input-contract review) and `zizmor` stays on 1.26.1 (upstream + v1.30.1 reports 65 new low findings on this tree, held for dedicated + triage). Every catalog `last_verified` restamped to the audit date. + ## [0.1.24] - 2026-09-20 - **Fix a reusable workflow that could not reach its own vendored actions.** diff --git a/catalog/action-images.yml b/catalog/action-images.yml index e96e51e..61daa3a 100644 --- a/catalog/action-images.yml +++ b/catalog/action-images.yml @@ -33,7 +33,7 @@ images: published-evidence path for the public tier, so a substituted image would change what the SARIF and JSON attest to. - action: bridgecrewio/checkov-action - image: docker://ghcr.io/bridgecrewio/checkov:3.3.16 + image: docker://ghcr.io/bridgecrewio/checkov:3.3.19 used_by: - .github/workflows/iac-scan.yml reason: >- diff --git a/catalog/scorecard-evidence.yml b/catalog/scorecard-evidence.yml index bc78d22..e79fe75 100644 --- a/catalog/scorecard-evidence.yml +++ b/catalog/scorecard-evidence.yml @@ -66,7 +66,7 @@ category_contract: guid: null source_urls: - https://github.com/ossf/scorecard/blob/v5.5.0/pkg/scorecard/sarif.go - - https://github.com/github/codeql-action/blob/cdf488f595d80d6e07e03d4674febd5ab45fa938/src/upload-lib.ts + - https://github.com/github/codeql-action/blob/1c5b675653bb5c22dbe9b12b556ec555138e09fd/src/upload-lib.ts - https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/sarif-support-for-code-scanning attempts: - attempt: 1 diff --git a/catalog/tools.yml b/catalog/tools.yml index a4f4a1d..fe700c2 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -1,7 +1,7 @@ # External tools referenced by ci-workflows. # Machine-readable source of truth. Mirrored by docs/. Enforced by scripts/validate_catalog.py. # Action `pin` values are full commit SHAs (tags are mutable); CLIs pin by version/checksum and use null here. -# Last verified: 2026-08-13 +# Last verified: 2026-09-21 tools: - id: aqtinstall @@ -12,7 +12,7 @@ tools: pin: "3.3.0" used_by: - .github/workflows/qt-ci.yml - last_verified: "2026-08-15" + last_verified: "2026-09-21" notes: >- Installed from requirements-qt.txt, a hash-locked closure of 28 packages, rather than resolved at run time. Pinning the two top-level names left @@ -27,7 +27,7 @@ tools: pin: "1.1.3" used_by: - .github/workflows/qt-ci.yml - last_verified: "2026-08-15" + last_verified: "2026-09-21" notes: aqtinstall's archive backend; locked in the same closure. lock: requirements-qt.txt lock_sha256: "e8fd018f0ce1d2f8f23d1fe9ce674e384e98e3fc1ac34386e2fa769fede16185" @@ -41,7 +41,7 @@ tools: - .github/workflows/actionlint.yml - .github/workflows/nddev-security-bundle.yml - .github/workflows/private-security-bundle-free.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: zizmor name: zizmor @@ -49,12 +49,16 @@ tools: kind: cli current_version: "1.26.1" pin: null + notes: >- + Upstream v1.30.1 exists; its new audits report 65 low findings on this + tree (self-repository et al). Held for a dedicated triage PR — the + self-CI zizmor job fails on any finding at or above 'low'. used_by: - .github/workflows/nddev-security-bundle.yml - .github/workflows/private-security-bundle-free.yml - .github/workflows/zizmor-sarif.yml - .github/workflows/zizmor-no-sarif.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: gitleaks name: gitleaks @@ -67,28 +71,28 @@ tools: - .github/workflows/nddev-security-bundle.yml - .github/workflows/private-security-bundle-free.yml - .github/workflows/secret-scan.yml - last_verified: "2026-08-13" + last_verified: "2026-09-21" - id: trivy name: Trivy homepage: "https://github.com/aquasecurity/trivy" kind: cli - current_version: "v0.72.0" + current_version: "v0.74.0" pin: null used_by: - .github/workflows/container-ci.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: syft name: Syft homepage: "https://github.com/anchore/syft" kind: cli - current_version: "v1.46.0" - pin: "linux_amd64 size:28342623 sha256:d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca; linux_arm64 size:25829350 sha256:9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e" + current_version: "v1.52.0" + pin: "linux_amd64 size:29289629 sha256:caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d; linux_arm64 size:26744986 sha256:c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706" used_by: - .github/workflows/release-supply-chain.yml - .github/workflows/release-supply-chain-free.yml - last_verified: "2026-07-11" + last_verified: "2026-09-21" - id: harden-runner name: step-security/harden-runner @@ -108,20 +112,20 @@ tools: - .github/workflows/public-scorecard.yml - .github/workflows/release.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: codeql-action name: github/codeql-action homepage: "https://github.com/github/codeql-action" kind: action - current_version: "v4.37.9" - pin: "github/codeql-action@cdf488f595d80d6e07e03d4674febd5ab45fa938" + current_version: "v4.38.1" + pin: "github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd" used_by: - .github/workflows/nddev-security-bundle.yml - .github/workflows/public-codeql.yml - .github/workflows/public-scorecard.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: dependency-review-action name: actions/dependency-review-action @@ -131,7 +135,7 @@ tools: pin: "actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294" used_by: - .github/workflows/public-dependency-review.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: scorecard-action name: ossf/scorecard-action @@ -143,7 +147,7 @@ tools: - .github/workflows/public-scorecard-analysis.yml - .github/workflows/public-scorecard.yml - .github/workflows/public-scorecard-json.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: attest name: actions/attest @@ -153,7 +157,7 @@ tools: pin: "actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6" used_by: - .github/workflows/release-supply-chain.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: attest-build-provenance name: actions/attest-build-provenance @@ -163,7 +167,7 @@ tools: pin: "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8" used_by: - .github/workflows/release-supply-chain.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: checkout name: actions/checkout @@ -228,7 +232,7 @@ tools: - .github/workflows/web-ci.yml - .github/workflows/zizmor-no-sarif.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: setup-python name: actions/setup-python @@ -249,7 +253,7 @@ tools: - .github/workflows/runtime-fixtures.yml - .github/workflows/runtime-fixtures-event-write.yml - .github/workflows/runtime-fixtures-languages.yml - last_verified: "2026-07-04" + last_verified: "2026-09-21" - id: upload-artifact name: actions/upload-artifact @@ -268,7 +272,7 @@ tools: - .github/workflows/release-supply-chain.yml - .github/workflows/runtime-fixtures-languages.yml - .github/workflows/secret-scan.yml - last_verified: "2026-08-22" + last_verified: "2026-09-21" - id: ccache-action @@ -280,7 +284,7 @@ tools: used_by: - .github/workflows/cpp-ci.yml - .github/workflows/qt-ci.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: setup-gradle name: gradle/actions/setup-gradle @@ -290,18 +294,18 @@ tools: pin: "gradle/actions@9c971963bec38e04b3d30dcc455b5382be2fdbfb" used_by: - .github/workflows/kotlin-android-ci.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: setup-android name: android-actions/setup-android homepage: "https://github.com/android-actions/setup-android" kind: action - current_version: "v4.0.1" - pin: "android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699" + current_version: "v4.0.4" + pin: "android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd" used_by: - .github/workflows/kotlin-android-ci.yml - .github/workflows/runtime-fixtures-languages.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: setup-swift name: swift-actions/setup-swift @@ -311,27 +315,27 @@ tools: pin: "swift-actions/setup-swift@364295d9c23900ce04d4e5cc708387921b4e50f9" used_by: - .github/workflows/swift-ci.yml - last_verified: "2026-07-25" + last_verified: "2026-09-21" - id: setup-r name: r-lib/actions/setup-r homepage: "https://github.com/r-lib/actions" kind: action - current_version: "v2.13.0" - pin: "r-lib/actions@465b7d8e732ca3921382b1674c59bada9cbf3399" + current_version: "v2.14.0" + pin: "r-lib/actions@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05" used_by: - .github/workflows/r-ci.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: codecov-action name: codecov/codecov-action homepage: "https://github.com/codecov/codecov-action" kind: action - current_version: "v7.0.0" - pin: "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f" + current_version: "v7.1.1" + pin: "codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5" used_by: - .github/workflows/coverage-gate.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: coveralls-action name: coverallsapp/github-action @@ -341,7 +345,7 @@ tools: pin: "coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329" used_by: - .github/workflows/coverage-gate.yml - last_verified: "2026-08-05" + last_verified: "2026-09-21" - id: lychee-action name: lycheeverse/lychee-action @@ -351,17 +355,17 @@ tools: pin: "lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8" used_by: - .github/workflows/docs-quality.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: typos-action name: crate-ci/typos homepage: "https://github.com/crate-ci/typos" kind: action - current_version: "v1.50.0" - pin: "crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3" + current_version: "v1.50.2" + pin: "crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53" used_by: - .github/workflows/docs-quality.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: markdownlint-cli2-action name: DavidAnson/markdownlint-cli2-action @@ -371,7 +375,7 @@ tools: pin: "DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff" used_by: - .github/workflows/docs-quality.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: commitlint-action name: wagoid/commitlint-github-action @@ -381,7 +385,7 @@ tools: pin: "wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed" used_by: - .github/workflows/pr-hygiene.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: semantic-pull-request name: amannn/action-semantic-pull-request @@ -391,7 +395,7 @@ tools: pin: "amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50" used_by: - .github/workflows/pr-hygiene.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: labeler name: actions/labeler @@ -401,7 +405,7 @@ tools: pin: "actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13" used_by: - .github/workflows/pr-hygiene.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: stale name: actions/stale @@ -411,29 +415,29 @@ tools: pin: "actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93" used_by: - .github/workflows/pr-hygiene.yml - last_verified: "2026-08-05" + last_verified: "2026-09-21" - id: osv-scanner name: osv-scanner homepage: "https://github.com/google/osv-scanner" kind: cli - current_version: "v2.5.0" + current_version: "v2.6.0" pin: null used_by: - .github/workflows/osv-scan.yml - .github/workflows/nddev-security-bundle.yml - .github/workflows/private-security-bundle-free.yml - last_verified: "2026-08-15" + last_verified: "2026-09-21" - id: semgrep name: semgrep homepage: "https://github.com/semgrep/semgrep" kind: cli - current_version: "v1.170.0" + current_version: "v1.177.0" pin: null used_by: - .github/workflows/semgrep-ci.yml - last_verified: "2026-07-21" + last_verified: "2026-09-21" - id: anchore-scan-action name: anchore/scan-action @@ -443,7 +447,7 @@ tools: pin: "anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439" used_by: - .github/workflows/grype-scan.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: hadolint name: hadolint @@ -453,28 +457,28 @@ tools: pin: null used_by: - .github/workflows/hadolint-ci.yml - last_verified: "2026-08-10" + last_verified: "2026-09-21" - id: checkov-action name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3122.0" - pin: "bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e" + current_version: "v12.3125.0" + pin: "bridgecrewio/checkov-action@444c9db6fa75e2d9c19ebf1fde7322089be9009e" used_by: - .github/workflows/iac-scan.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" - id: github-action-benchmark name: benchmark-action/github-action-benchmark homepage: "https://github.com/benchmark-action/github-action-benchmark" kind: action - current_version: "v1.22.1" - pin: "benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba" + current_version: "v1.22.2" + pin: "benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc" used_by: - .github/workflows/benchmark.yml - .github/workflows/benchmark-compare.yml - last_verified: "2026-07-08" + last_verified: "2026-09-21" - id: setup-node name: actions/setup-node @@ -487,7 +491,7 @@ tools: - .github/workflows/benchmark-compare.yml - .github/workflows/mutation-testing.yml - .github/workflows/node-ci.yml - last_verified: "2026-07-25" + last_verified: "2026-09-21" - id: cache name: actions/cache @@ -498,14 +502,14 @@ tools: used_by: - .github/workflows/dart-flutter-ci.yml - .github/workflows/qt-ci.yml - last_verified: "2026-08-14" + last_verified: "2026-09-21" - id: setup-uv name: astral-sh/setup-uv homepage: "https://github.com/astral-sh/setup-uv" kind: action - current_version: "v10.0.1" - pin: "astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d" + current_version: "v10.1.0" + pin: "astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4" used_by: - .github/workflows/ci.yml - .github/workflows/maintenance.yml @@ -519,7 +523,7 @@ tools: - .github/workflows/sql-ci.yml - .github/workflows/zizmor-no-sarif.yml - .github/workflows/zizmor-sarif.yml - last_verified: "2026-07-20" + last_verified: "2026-09-21" - id: setup-bun name: oven-sh/setup-bun @@ -530,7 +534,7 @@ tools: used_by: - .github/workflows/node-ci.yml - .github/workflows/web-ci.yml - last_verified: "2026-07-20" + last_verified: "2026-09-21" - id: setup-go name: actions/setup-go @@ -544,7 +548,7 @@ tools: - .github/workflows/go-ci.yml - .github/workflows/public-codeql.yml - .github/workflows/ci.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: setup-rust-toolchain name: actions-rust-lang/setup-rust-toolchain @@ -552,6 +556,9 @@ tools: kind: action current_version: "v1.17.0" pin: "actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659" + notes: >- + Upstream v2.0.0 released; major bump held pending input-contract + review. Track before next refresh. used_by: - .github/workflows/benchmark.yml - .github/workflows/benchmark-compare.yml @@ -559,7 +566,7 @@ tools: - .github/workflows/mutation-testing.yml - .github/workflows/rust-ci.yml - .github/workflows/rust-supply-chain.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: setup-dotnet name: actions/setup-dotnet @@ -569,19 +576,19 @@ tools: pin: "actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68" used_by: - .github/workflows/dotnet-ci.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: setup-java name: actions/setup-java homepage: "https://github.com/actions/setup-java" kind: action - current_version: "v6.0.0" - pin: "actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c" + current_version: "v6.0.1" + pin: "actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6" used_by: - .github/workflows/java-ci.yml - .github/workflows/kotlin-android-ci.yml - .github/workflows/runtime-fixtures-languages.yml - last_verified: "2026-09-01" + last_verified: "2026-09-21" - id: setup-terraform name: hashicorp/setup-terraform @@ -592,7 +599,7 @@ tools: used_by: - .github/workflows/terraform-ci.yml - .github/workflows/ci.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: trivy-action name: aquasecurity/trivy-action @@ -602,7 +609,7 @@ tools: pin: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" used_by: - .github/workflows/container-ci.yml - last_verified: "2026-07-12" + last_verified: "2026-09-21" - id: docker-login-action name: docker/login-action @@ -612,27 +619,27 @@ tools: pin: "docker/login-action@dbcb813823bdd20940b903addbd779551569679f" used_by: - .github/workflows/docker-build.yml - last_verified: "2026-09-01" + last_verified: "2026-09-21" - id: docker-setup-buildx-action name: docker/setup-buildx-action homepage: "https://github.com/docker/setup-buildx-action" kind: action - current_version: "v4.3.0" - pin: "docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e" + current_version: "v4.4.1" + pin: "docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069" used_by: - .github/workflows/docker-build.yml - last_verified: "2026-09-01" + last_verified: "2026-09-21" - id: docker-build-push-action name: docker/build-push-action homepage: "https://github.com/docker/build-push-action" kind: action - current_version: "v7.3.0" - pin: "docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a" + current_version: "v7.4.0" + pin: "docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc" used_by: - .github/workflows/docker-build.yml - last_verified: "2026-09-01" + last_verified: "2026-09-21" # Registered late: these three workflows (rust-supply-chain, clusterfuzzlite) # shipped without catalog entries because the pin validators check pin format, @@ -646,17 +653,17 @@ tools: pin: "EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25" used_by: - .github/workflows/rust-supply-chain.yml - last_verified: "2026-08-12" + last_verified: "2026-09-21" - id: taiki-e-install-action name: taiki-e/install-action homepage: "https://github.com/taiki-e/install-action" kind: action - current_version: "v2.87.2" - pin: "taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf" + current_version: "v2.87.17" + pin: "taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73" used_by: - .github/workflows/rust-supply-chain.yml - last_verified: "2026-09-07" + last_verified: "2026-09-21" # Upstream tags no release, so the pin comment carries the commit date rather # than a version. Bump it by picking a newer commit deliberately, not by @@ -669,4 +676,4 @@ tools: pin: "google/clusterfuzzlite@52ecc61cb587ee99c26825a112a21abf19c7448c" used_by: - .github/workflows/clusterfuzzlite.yml - last_verified: "2026-08-12" + last_verified: "2026-09-21" diff --git a/scripts/check_release_supply_chain.py b/scripts/check_release_supply_chain.py index 0d3f7c4..d592388 100644 --- a/scripts/check_release_supply_chain.py +++ b/scripts/check_release_supply_chain.py @@ -46,16 +46,16 @@ SYFT_PINS = { "ARM64": { "archive_arch": "arm64", - "sha256": "9fafef4db4f032ce81008d3a1529985d41ceb6ccdf2b388c9ce2f1ed7d32082e", - "size": "25829350", + "sha256": "c46d5e4c28e12aa4c5becfaa343ef1c7f89045b6b895f2c21d471c62db09c706", + "size": "26744986", }, "X64": { "archive_arch": "amd64", - "sha256": "d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca", - "size": "28342623", + "sha256": "caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d", + "size": "29289629", }, } -SYFT_VERSION = "1.46.0" +SYFT_VERSION = "1.52.0" def _steps(workflow: dict[str, Any], job_name: str) -> list[dict[str, Any]]: diff --git a/scripts/run_private_security_bundle.sh b/scripts/run_private_security_bundle.sh index 622fd58..04f3f1e 100755 --- a/scripts/run_private_security_bundle.sh +++ b/scripts/run_private_security_bundle.sh @@ -6,8 +6,8 @@ umask 077 readonly actionlint_version=1.7.12 readonly actionlint_sha256=8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 readonly zizmor_version=1.26.1 -readonly osv_version=2.5.0 -readonly osv_sha256=edcfc41d257db36148f065055655fe3fcfc434b0b423ea67468a84c207524e0c +readonly osv_version=2.6.0 +readonly osv_sha256=ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108 readonly gitleaks_version=8.30.1 readonly gitleaks_sha256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb readonly gitleaks_size=8230402