diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c7c07d..7074f35 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -201,7 +201,7 @@ jobs: - name: Upload packages if: inputs.production-packages && matrix.configuration == 'Release' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: nuget-packages path: | @@ -212,7 +212,7 @@ jobs: - name: Upload coverage if: matrix.configuration == 'Debug' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: coverage path: ${{ env.RESULTS }}/*.xml @@ -221,7 +221,7 @@ jobs: - name: Upload test results if: ${{ !cancelled() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-results-${{ matrix.configuration }} path: ${{ env.RESULTS }}/*.trx @@ -231,7 +231,7 @@ jobs: # Crash dumps, hang dumps and the test sequence logs that name the tests running at the time. - name: Upload test dumps if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-dumps-${{ matrix.configuration }} path: | @@ -242,7 +242,7 @@ jobs: - name: Upload binary logs if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: binlogs-build-test-${{ matrix.configuration }} path: artifacts/logs/*.binlog @@ -289,7 +289,7 @@ jobs: - name: Upload binary logs if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: binlogs-aot path: artifacts/logs/*.binlog @@ -345,7 +345,7 @@ jobs: # Offline audits only, so the result depends on the commit alone; the online audits run in zizmor-online.yml. - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 with: version: 1.30.1 online-audits: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 43819e1..fabe9d8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -48,7 +48,7 @@ jobs: cache: 'false' - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: csharp build-mode: manual @@ -69,13 +69,13 @@ jobs: } - name: Analyze - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: /language:csharp - name: Upload binlog if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: binlogs-codeql-csharp path: artifacts/logs/*.binlog @@ -96,13 +96,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: languages: actions build-mode: none queries: security-extended - name: Analyze - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: category: /language:actions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6dbe650..c37936b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -158,7 +158,7 @@ jobs: - name: Upload release notes if: steps.tag.outputs.version != '' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-notes path: artifacts/release-notes/release-notes.md @@ -190,7 +190,7 @@ jobs: VERSION: ${{ needs.verify.outputs.version }} steps: - name: Download packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nuget-packages path: artifacts/nuget @@ -283,7 +283,7 @@ jobs: $summary | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 - name: Upload the staged SBOMs and SHA256SUMS - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-staging path: artifacts/staging @@ -312,13 +312,13 @@ jobs: persist-credentials: false - name: Download packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nuget-packages path: artifacts/nuget - name: Download the staged SBOMs and SHA256SUMS - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-staging path: artifacts/attestations @@ -508,7 +508,7 @@ jobs: Write-Output "Wrote SHA256SUMS ($($assets.Count) assets)." - name: Upload the attestation bundles, SBOMs and SHA256SUMS - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: attestation-bundles path: artifacts/attestations @@ -535,19 +535,19 @@ jobs: persist-credentials: false - name: Download packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nuget-packages path: artifacts/release - name: Download the attestation bundles, SBOMs and SHA256SUMS - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: attestation-bundles path: artifacts/release - name: Download release notes - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-notes path: artifacts/release-notes @@ -626,13 +626,13 @@ jobs: cache: 'false' - name: Download packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nuget-packages path: artifacts/nuget - name: Download SHA256SUMS - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: attestation-bundles path: artifacts/release-assets @@ -730,7 +730,7 @@ jobs: cache: 'false' - name: Download packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: nuget-packages path: artifacts/nuget diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f5bad3e..f2b793c 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -35,20 +35,20 @@ jobs: # No repo_token: rulesets are readable with the default token. - name: Run Scorecard - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: scorecard-results path: results.sarif retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 1198a25..e519b6c 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -70,7 +70,7 @@ jobs: # SonarScanner for .NET uses Java. The same JDK 21 distribution as CheatEngine.SDK keeps scanner behaviour # reproducible across both repositories. - name: Set up JDK 21 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: zulu java-version: '21' @@ -89,7 +89,7 @@ jobs: key: sonar-analyzers-${{ runner.os }}-${{ runner.arch }}-${{ env.SONAR_SCANNER_VERSION }}-v1 - name: Download coverage - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: coverage path: ${{ runner.temp }}/coverage diff --git a/.github/workflows/zizmor-online.yml b/.github/workflows/zizmor-online.yml index bd1ea83..7500ab8 100644 --- a/.github/workflows/zizmor-online.yml +++ b/.github/workflows/zizmor-online.yml @@ -38,7 +38,7 @@ jobs: # Inputs: https://github.com/zizmorcore/zizmor-action (v0.6.4 action.yml). - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 with: version: 1.30.1 online-audits: true diff --git a/tests/CheatEngine.Client.Repository.Tests/Workflows/WorkflowContractTests.cs b/tests/CheatEngine.Client.Repository.Tests/Workflows/WorkflowContractTests.cs index 16d5733..d3e7e4a 100644 --- a/tests/CheatEngine.Client.Repository.Tests/Workflows/WorkflowContractTests.cs +++ b/tests/CheatEngine.Client.Repository.Tests/Workflows/WorkflowContractTests.cs @@ -82,17 +82,17 @@ public sealed partial class WorkflowContractTests private static readonly Dictionary CanonicalPins = new(StringComparer.Ordinal) { ["actions/checkout"] = ("3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"), - ["actions/upload-artifact"] = ("043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", "v7.0.1"), - ["actions/download-artifact"] = ("3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", "v8.0.1"), + ["actions/upload-artifact"] = ("cf430e030ddbb5b0abf93d22962f4752f3646cd9", "v7.0.2"), + ["actions/download-artifact"] = ("9000827ccba6bdab643e8b6fd33ac0654aef8333", "v8.0.2"), ["actions/setup-dotnet"] = ("a98b56852c35b8e3190ac28c8c2271da59106c68", "v6.0.0"), - ["actions/setup-java"] = ("de7274f081f381c8f8158605e0321c36c376e2e6", "v6.0.1"), + ["actions/setup-java"] = ("b843ebf9b913146b38da2eaa7aeddf76074ae1ad", "v6.1.0"), ["actions/attest"] = ("1e69f48acb82d1966a394da916b4c1698aa569d6", "v4.2.2"), ["NuGet/login"] = ("8d196754b4036150537f80ac539e15c2f1028841", "v1.2.0"), ["xmake-io/github-action-setup-xmake"] = ("3a1a5dddfc7fa625d9a698738334bf55655a861a", "v1.2.5"), ["actions/dependency-review-action"] = ("a1d282b36b6f3519aa1f3fc636f609c47dddb294", "v5.0.0"), - ["zizmorcore/zizmor-action"] = ("cc914d7f3750a2d13d75c7f184a1060aa0e9d482", "v0.6.4"), - ["github/codeql-action"] = ("2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2", "v4.38.2"), - ["ossf/scorecard-action"] = ("2d1146689b8cda280b9bc96326124645441f03bc", "v2.4.4"), + ["zizmorcore/zizmor-action"] = ("85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e", "v0.7.1"), + ["github/codeql-action"] = ("6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee", "v4.39.0"), + ["ossf/scorecard-action"] = ("fa7117db83c52d787ae5a89f350999701505d78e", "v2.5.0"), ["actions/cache"] = ("55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6.1.0") };