diff --git a/.github/workflows/cloudflare-web.yml b/.github/workflows/cloudflare-web.yml index 9743783e1..b119496b2 100644 --- a/.github/workflows/cloudflare-web.yml +++ b/.github/workflows/cloudflare-web.yml @@ -117,7 +117,7 @@ jobs: - name: Comment PR plan if: github.event_name == 'pull_request' - uses: dflook/tofu-plan@cdb4f4d604c9fa695e457744dd1f802853397ce7 # v3.0.0 + uses: dflook/tofu-plan@5a47499905d68757ecd7cf58cfe6312efe71a142 # v3.0.1 with: path: infra/web label: ${{ needs.detect.outputs.environment }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5d7f1f994..253afa7e6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -69,7 +69,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -98,6 +98,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: '/language:${{matrix.language}}' diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 4422748d9..165beb3ab 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -89,10 +89,10 @@ jobs: NODE_OPTIONS=--max_old_space_size=4096 pnpm run build - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build and push Docker image id: push @@ -110,7 +110,7 @@ jobs: - name: Generate artifact attestation if: github.event_name != 'pull_request' - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/flake-lock-fix.yml b/.github/workflows/flake-lock-fix.yml index d17e8d6a7..d204c0117 100644 --- a/.github/workflows/flake-lock-fix.yml +++ b/.github/workflows/flake-lock-fix.yml @@ -55,7 +55,7 @@ jobs: token: ${{ steps.app-token.outputs.token }} - name: Install Determinate Nix - uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9 + uses: DeterminateSystems/determinate-nix-action@021c8a1bd3570eb21f5c20a054812b0c4d9ca614 # v3.22.3 - id: check run: nix flake check -L diff --git a/.github/workflows/rust-quality.yml b/.github/workflows/rust-quality.yml index 48ea6ac96..55d3ee1a5 100644 --- a/.github/workflows/rust-quality.yml +++ b/.github/workflows/rust-quality.yml @@ -30,7 +30,7 @@ jobs: persist-credentials: false - name: Setup mise - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3 + uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: cache: true @@ -66,12 +66,12 @@ jobs: pkg-config - name: Setup mise - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3 + uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: cache: true - name: Cache Rust build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: src-tauri # Restore only on PRs; the repo sits at the 10 GiB cache cap. diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml index 20f939f49..bda46e092 100644 --- a/.github/workflows/tauri-build.yml +++ b/.github/workflows/tauri-build.yml @@ -142,7 +142,7 @@ jobs: run: rustup target add ${{ matrix.rust-targets }} - name: Cache Rust build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: src-tauri @@ -216,7 +216,7 @@ jobs: - name: Attest Windows bundles if: ${{ matrix.name == 'Windows' }} - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | src-tauri/target/release/bundle/msi/*.msi @@ -269,7 +269,7 @@ jobs: - name: Attest Linux bundles if: matrix.cef - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | src-tauri/target/release/bundle/deb/*.deb @@ -345,12 +345,12 @@ jobs: run: rustup target add $RUST_TARGETS - name: Cache Rust build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: src-tauri - name: Setup Gradle - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 + uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 - name: Resolve NDK shell: bash @@ -389,7 +389,7 @@ jobs: mv "$AAB" "$OUT/bundle/universalRelease/BlockWire-${VERSION}-android-universal.aab" - name: Attest Android bundles - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | src-tauri/gen/android/app/build/outputs/apk/universal/release/*.apk @@ -479,7 +479,7 @@ jobs: run: rustup target add $RUST_TARGETS - name: Cache Rust build - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: src-tauri @@ -528,7 +528,7 @@ jobs: echo "ipa_build=${IPA_BUILD:-$VERSION}" >> "$GITHUB_OUTPUT" - name: Attest iOS bundle - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: ${{ steps.ipa.outputs.path }} @@ -698,7 +698,7 @@ jobs: - name: Attest updater manifest if: steps.manifest.outputs.produced == 'true' - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: latest.json