diff --git a/.github/workflows/canonical-versioning.yml b/.github/workflows/canonical-versioning.yml index 77f3c2bb..4c453bbf 100644 --- a/.github/workflows/canonical-versioning.yml +++ b/.github/workflows/canonical-versioning.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Read-only source consistency run: | diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 11a2c4cc..5f727ce7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: {languages: python,javascript-typescript} - - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 diff --git a/.github/workflows/engineering-platform-validation.yml b/.github/workflows/engineering-platform-validation.yml index 8acb6afd..e658f926 100644 --- a/.github/workflows/engineering-platform-validation.yml +++ b/.github/workflows/engineering-platform-validation.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Validate committed offline projection run: python3 docs/ai-development/validate_projection.py --profile engineering-platform --source-commit 6ec3b443c3ab3bdf76c626c2046d3778db570eb0 --extension-identity ENGINEERING_PLATFORM_DEVELOPMENT_EXTENSION @@ -56,7 +56,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: {fetch-depth: 0} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - id: profile run: PYTHONPATH=src python3 -m engineering_platform.validation_profile --base "${{ github.event.pull_request.base.sha || github.event.before }}" --branch "${{ github.head_ref || github.ref_name }}" --github-output "$GITHUB_OUTPUT" @@ -70,7 +70,7 @@ jobs: timeout-minutes: 120 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Build and install committed canonical Engineering Platform wheel run: | @@ -149,7 +149,7 @@ jobs: timeout-minutes: 120 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Build and install committed canonical Engineering Platform wheel run: | @@ -213,7 +213,7 @@ jobs: artifact_suffix: "4-of-4" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Build and install exact committed browser qualification wheel run: | @@ -297,7 +297,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Verify standalone qualification evidence run: | diff --git a/.github/workflows/ep-server-production-release.yml b/.github/workflows/ep-server-production-release.yml index e121f2e9..60945582 100644 --- a/.github/workflows/ep-server-production-release.yml +++ b/.github/workflows/ep-server-production-release.yml @@ -66,7 +66,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Verify clean release checkout run: | @@ -154,7 +154,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v22 with: {node-version: '22'} @@ -176,7 +176,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: @@ -381,7 +381,7 @@ jobs: echo 'already_published=true' >> "$GITHUB_OUTPUT" - name: Publish only the qualified immutable distributions if: steps.existing.outputs.already_published != 'true' - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1, verified 2026-07-16 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1, verified 2026-07-16 with: packages-dir: pypi-dist @@ -396,7 +396,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: @@ -539,7 +539,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: diff --git a/.github/workflows/genesis-process-group-host-probe.yml b/.github/workflows/genesis-process-group-host-probe.yml index dbfa3089..3b6953f1 100644 --- a/.github/workflows/genesis-process-group-host-probe.yml +++ b/.github/workflows/genesis-process-group-host-probe.yml @@ -18,7 +18,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: {fetch-depth: 0} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Install exact committed candidate outside checkout run: | @@ -82,7 +82,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: {fetch-depth: 0} - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Original qualified wheel and separate noneditable installation if: "!startsWith(github.ref, 'refs/tags/l2-genesis-product-probe-')" diff --git a/.github/workflows/golden-qualification-ci.yml b/.github/workflows/golden-qualification-ci.yml index 0dececdb..af532f72 100644 --- a/.github/workflows/golden-qualification-ci.yml +++ b/.github/workflows/golden-qualification-ci.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: "3.14" - name: Run standalone Golden Smoke @@ -43,7 +43,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: "3.14" - name: Run standalone Golden Regression diff --git a/.github/workflows/preproject-inspection-runtime-probe.yml b/.github/workflows/preproject-inspection-runtime-probe.yml index c0cc2275..d06f548f 100644 --- a/.github/workflows/preproject-inspection-runtime-probe.yml +++ b/.github/workflows/preproject-inspection-runtime-probe.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - name: Install exact committed ordinary wheel run: | diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml index 983e0f9f..6a1007e2 100644 --- a/.github/workflows/security-baseline.yml +++ b/.github/workflows/security-baseline.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: {python-version: '3.14'} - run: python -m pip install build pip-audit 'bandit[toml]' cyclonedx-bom . - name: Audit resolved Python dependencies diff --git a/.github/workflows/tde-observe.yml b/.github/workflows/tde-observe.yml index fb08aeb1..0579e7c1 100644 --- a/.github/workflows/tde-observe.yml +++ b/.github/workflows/tde-observe.yml @@ -20,7 +20,7 @@ jobs: timeout-minutes: 20 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 with: python-version: '3.14' - name: Generate canonical coverage input