From f0c0ac7772323d7ab8b4147c587fd6a7db0a8ac2 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 23:12:13 +0000 Subject: [PATCH] fix(ci): reconcile workflows with actions.lock using gh-actions-lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lockfile is authoritative: workflows carry readable refs and the lock records the commit each ref resolves to. Hand-pinning refs to SHAs broke that pairing and made every workflow in the repo unstartable (startup_failure, 'Invalid lockfile'). Regenerated with github/gh-actions-lock v0.1.6 — the official CLI extension for this feature. `gh actions-lock --verify-local` reports valid: true. --- .github/workflows/actions.lock | 18 ++++----- .github/workflows/bridge-gate.yml | 3 +- .github/workflows/build-validation.yml | 9 +++-- .github/workflows/cflite_batch.yml | 5 ++- .github/workflows/cflite_pr.yml | 5 ++- .github/workflows/codeql.yml | 7 ++-- .github/workflows/coq-build.yml | 3 +- .github/workflows/doc-consonance.yml | 3 +- .github/workflows/dogfood-gate.yml | 3 +- .github/workflows/elixir-ci.yml | 25 ++++++------ .github/workflows/fuzz.yml | 9 +++-- .github/workflows/ghcr-publish.yml | 5 ++- .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 3 +- .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 9 +++-- .github/workflows/reuse.yml | 3 +- .github/workflows/rust-ci.yml | 49 ++++++++++++------------ .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/security-scan.yml | 1 + .github/workflows/spark-theatre-gate.yml | 1 + 25 files changed, 96 insertions(+), 72 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index fefadef..6ff5d99 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -25,7 +25,7 @@ workflows: '.github/workflows/elixir-ci.yml': - 'actions/cache@v6.1.0' - 'actions/checkout@v7.0.1' - - 'codecov/codecov-action@v7.0.0' + - 'codecov/codecov-action@v7.1.0' - 'erlef/setup-beam@v1.24.1' '.github/workflows/fuzz.yml': - 'actions/checkout@v7.0.1' @@ -49,10 +49,10 @@ workflows: '.github/workflows/rust-ci.yml': - 'actions/checkout@v7.0.1' - 'actions/upload-artifact@v7.0.1' - - 'codecov/codecov-action@v7.0.0' + - 'codecov/codecov-action@v7.1.0' - 'dtolnay/rust-toolchain@stable' - 'rustsec/audit-check@v2.0.0' - - 'taiki-e/install-action@v2.87.3' + - 'taiki-e/install-action@v2.87.13' '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/security-scan.yml': [] @@ -107,9 +107,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'codecov/codecov-action@v7.0.0': - ref: 'v7.0.0' - commit: 'sha1-fb8b3582c8e4def4969c97caa2f19720cb33a72f' + 'codecov/codecov-action@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-0b35c9ecc4f0529d0eb674914510c22f85b196b4' owner_id: 8226205 repo_id: 200299178 uses: @@ -144,8 +144,8 @@ dependencies: commit: 'sha1-69366f33c96575abad1ee0dba8212993eecbe998' owner_id: 25397242 repo_id: 523199201 - 'taiki-e/install-action@v2.87.3': - ref: 'v2.87.3' - commit: 'sha1-0758d235715de2f3551eacc980d9ae8fce9342c3' + 'taiki-e/install-action@v2.87.13': + ref: 'v2.87.13' + commit: 'sha1-26e9283f268b880168bdbd2c545dfcd60ec2c6ab' owner_id: 43724913 repo_id: 442947557 diff --git a/.github/workflows/bridge-gate.yml b/.github/workflows/bridge-gate.yml index 41498ca..1a43586 100644 --- a/.github/workflows/bridge-gate.yml +++ b/.github/workflows/bridge-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -31,7 +32,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: B3 gate -- nix bumps (no network) env: diff --git a/.github/workflows/build-validation.yml b/.github/workflows/build-validation.yml index 1e355e2..d6d70ff 100644 --- a/.github/workflows/build-validation.yml +++ b/.github/workflows/build-validation.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -18,8 +19,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable with: toolchain: stable - run: cargo check --workspace @@ -32,8 +33,8 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + - uses: actions/checkout@v7.0.1 + - uses: erlef/setup-beam@v1.24.1 with: elixir-version: "1.17" otp-version: "27" diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index d823a9c..5a6f039 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -27,14 +28,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 1800 diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index a607ceb..da2df9f 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -24,14 +25,14 @@ jobs: steps: - name: Build Fuzzers (${{ matrix.sanitizer }}) id: build - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/build_fuzzers@v1 with: language: rust sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) id: run - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 + uses: google/clusterfuzzlite/actions/run_fuzzers@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} fuzz-seconds: 300 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index adf4427..cb4334e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -38,17 +39,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 + uses: github/codeql-action/init@v4.37.9 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 + uses: github/codeql-action/analyze@v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/coq-build.yml b/.github/workflows/coq-build.yml index ebc8d40..9400afc 100644 --- a/.github/workflows/coq-build.yml +++ b/.github/workflows/coq-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -34,7 +35,7 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install Coq run: | diff --git a/.github/workflows/doc-consonance.yml b/.github/workflows/doc-consonance.yml index 6f3e71a..3696a13 100644 --- a/.github/workflows/doc-consonance.yml +++ b/.github/workflows/doc-consonance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -16,6 +17,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Doc-consonance gate (no query-language misnomer in docs) run: bash tests/doc-consonance-gate.sh diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 80b34bb..b2d317c 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -28,7 +29,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Check for A2ML files id: detect diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index 621b7ce..621edfb 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -44,7 +45,7 @@ jobs: - elixir: "1.17" otp: "27" steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -64,12 +65,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: ${{ matrix.elixir }} otp-version: ${{ matrix.otp }} - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | elixir-orchestration/deps @@ -97,7 +98,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -117,12 +118,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: "1.17" otp-version: "27" - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | elixir-orchestration/deps @@ -133,7 +134,7 @@ jobs: - if: steps.detect.outputs.relevant == 'true' run: mix coveralls.json - if: steps.detect.outputs.relevant == 'true' - uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0 + uses: codecov/codecov-action@v7.1.0 with: files: elixir-orchestration/cover/excoveralls.json flags: elixir @@ -148,7 +149,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -168,12 +169,12 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: "1.17" otp-version: "27" - if: steps.detect.outputs.relevant == 'true' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6.1.0 with: path: | elixir-orchestration/deps @@ -197,7 +198,7 @@ jobs: run: working-directory: elixir-orchestration steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Detect relevant changes id: detect working-directory: ${{ github.workspace }} @@ -217,7 +218,7 @@ jobs: echo "relevant=true" >> "$GITHUB_OUTPUT" fi - if: steps.detect.outputs.relevant == 'true' - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-beam@v1.24.1 with: elixir-version: "1.17" otp-version: "27" diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 31974e7..91099d3 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -28,8 +29,8 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable with: toolchain: stable - name: Run core fuzz compile check @@ -45,8 +46,8 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable - name: Run debugger fuzz compile check run: | cd debugger/fuzz diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index 39d5bb5..c61ec44 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -38,7 +39,7 @@ jobs: id-token: write # mint the OIDC token the attestation is signed with attestations: write # write the build-provenance attestation (the "claim") steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Build image (Podman) run: | @@ -93,7 +94,7 @@ jobs: # --repo ${{ github.repository }} - name: Attest container provenance if: github.event_name != 'pull_request' - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + uses: actions/attest-build-provenance@v4.2.2 with: subject-name: ghcr.io/hyperpolymath/verisimdb-api subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 0bd4bca..28d541d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index d4289e3..5d356b3 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index e4c5bf1..9a52c98 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -19,7 +20,7 @@ jobs: timeout-minutes: 60 steps: - name: Trigger Propagation - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 + uses: peter-evans/repository-dispatch@v4.0.1 with: token: ${{ secrets.FARM_DISPATCH_TOKEN }} repository: hyperpolymath/.git-private-farm diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index b59bbe8..13a8524 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 9bcd91b..995b049 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -22,9 +23,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Checkout Ddraig SSG - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -41,7 +42,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 + uses: actions/upload-pages-artifact@v5.0.0 with: path: '_site' deploy: @@ -54,4 +55,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 + uses: actions/deploy-pages@v5.0.1 diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index c575048..26c0a4c 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -24,7 +25,7 @@ jobs: timeout-minutes: 60 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: Install reuse run: pip install reuse diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 4f919af..a121cb9 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. @@ -31,8 +32,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable with: toolchain: stable components: rustfmt @@ -43,8 +44,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable with: components: clippy - run: cargo clippy --workspace --all-targets --no-deps -- -D warnings @@ -54,8 +55,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable - run: cargo test --workspace --no-fail-fast doc: @@ -65,8 +66,8 @@ jobs: env: RUSTDOCFLAGS: "-D warnings" steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable - run: cargo doc --workspace --no-deps audit: @@ -74,8 +75,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 + - uses: actions/checkout@v7.0.1 + - uses: rustsec/audit-check@v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -84,8 +85,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 + - uses: actions/checkout@v7.0.1 + - uses: taiki-e/install-action@v2.87.13 with: tool: cargo-deny - run: cargo deny check advisories bans licenses sources @@ -95,8 +96,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable - run: cargo bench --no-run coverage: @@ -104,14 +105,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable with: components: llvm-tools-preview - - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 + - uses: taiki-e/install-action@v2.87.13 - name: Generate lcov report run: cargo llvm-cov --workspace --lcov --output-path lcov.info - - uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0 + - uses: codecov/codecov-action@v7.1.0 with: files: lcov.info flags: rust @@ -130,9 +131,9 @@ jobs: timeout-minutes: 60 if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - - uses: taiki-e/install-action@26e9283f268b880168bdbd2c545dfcd60ec2c6ab # v2.87.13 + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable + - uses: taiki-e/install-action@v2.87.13 with: tool: cargo-mutants - name: Run mutation tests on core invariant crates @@ -147,7 +148,7 @@ jobs: --no-shuffle \ --output mutants-out/ continue-on-error: true - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@v7.0.1 if: always() with: name: mutants-report @@ -163,6 +164,6 @@ jobs: - fuzz/Cargo.toml - rust-core/fuzz/Cargo.toml steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + - uses: actions/checkout@v7.0.1 + - uses: dtolnay/rust-toolchain@stable - run: cargo check --manifest-path ${{ matrix.manifest }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 0926333..eb1f8db 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 02311e4..3dfc9da 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index c9964da..04519d4 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml index 20bbbe2..8064aad 100644 --- a/.github/workflows/spark-theatre-gate.yml +++ b/.github/workflows/spark-theatre-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock.