diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5cdd71a..c2e4d2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,9 +13,9 @@ jobs: quality: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 20 cache: npm diff --git a/.github/workflows/docker-build-test-push.yml b/.github/workflows/docker-build-test-push.yml index cae3387..4fb1bb1 100644 --- a/.github/workflows/docker-build-test-push.yml +++ b/.github/workflows/docker-build-test-push.yml @@ -69,13 +69,13 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build Docker image - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} load: true @@ -93,7 +93,7 @@ jobs: run: docker save ${{ inputs.image-name }}:test | gzip > ${{ inputs.image-name }}.tar.gz - name: Upload image artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ inputs.image-name }}-image path: ${{ inputs.image-name }}.tar.gz @@ -110,10 +110,10 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download image artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.image-name }}-image @@ -121,7 +121,7 @@ jobs: run: docker load < ${{ inputs.image-name }}.tar.gz - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} @@ -149,7 +149,7 @@ jobs: output: 'trivy-results.sarif' - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 if: always() with: sarif_file: 'trivy-results.sarif' @@ -167,12 +167,12 @@ jobs: id-token: write steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # The single-arch tar is consumed by the version report below; the # multi-arch push rebuilds from context (unavoidable for multi-platform). - name: Download image artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.image-name }}-image @@ -180,17 +180,17 @@ jobs: run: docker load < ${{ inputs.image-name }}.tar.gz - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ inputs.dockerhub-username }} password: ${{ secrets.dockerhub-token }} - name: Extract metadata id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ inputs.dockerhub-username }}/${{ inputs.image-name }} # Two tags only: the exact release version (v1.2.3 -> 1.2.3) and latest. @@ -201,7 +201,7 @@ jobs: - name: Push multi-platform image id: push - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} platforms: ${{ inputs.platforms }} @@ -214,7 +214,7 @@ jobs: provenance: true - name: Install cosign - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 # Keyless signature over the pushed manifest-list digest, recorded in the # Rekor transparency log. Verify with: @@ -253,7 +253,7 @@ jobs: } > "$OUT" - name: Upload version report - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: version-report-${{ inputs.image-name }} path: version-report-${{ inputs.image-name }}.md @@ -267,7 +267,7 @@ jobs: - name: Sync README to Docker Hub if: ${{ inputs.image-description != '' }} continue-on-error: true - uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2 + uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 with: username: ${{ inputs.dockerhub-username }} password: ${{ secrets.dockerhub-token }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e258eb5..35b6705 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,7 +16,7 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create GitHub Release env: diff --git a/.github/workflows/salesforce-code-analyzer.yml b/.github/workflows/salesforce-code-analyzer.yml index 53f3f7c..43d5794 100644 --- a/.github/workflows/salesforce-code-analyzer.yml +++ b/.github/workflows/salesforce-code-analyzer.yml @@ -95,7 +95,7 @@ jobs: actions: read steps: - name: Check out files - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify workspace env: @@ -113,18 +113,18 @@ jobs: # PREREQUISITES - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} - name: Setup Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version }} distribution: "zulu" - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} diff --git a/.github/workflows/sf-pr-validate.yml b/.github/workflows/sf-pr-validate.yml index 0a49309..9a8dc91 100644 --- a/.github/workflows/sf-pr-validate.yml +++ b/.github/workflows/sf-pr-validate.yml @@ -35,7 +35,7 @@ jobs: contents: read steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: submodules: ${{ inputs.checkout-submodules }} @@ -71,7 +71,7 @@ jobs: contents: read steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: submodules: ${{ inputs.checkout-submodules }} @@ -131,7 +131,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: scratch-org-tests-${{ github.run_number }} path: scratch-org-tests.txt diff --git a/.github/workflows/sf-release.yml b/.github/workflows/sf-release.yml index 0bf27f3..93e6bfe 100644 --- a/.github/workflows/sf-release.yml +++ b/.github/workflows/sf-release.yml @@ -75,7 +75,7 @@ jobs: tests: ${{ steps.find-tests.outputs.tests }} steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: ${{ inputs.checkout-submodules }} @@ -205,7 +205,7 @@ jobs: - name: Upload validation artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: sf-release-${{ github.run_number }} path: | @@ -236,7 +236,7 @@ jobs: quick-deployed: ${{ steps.deploy.outputs.quick-deployed }} steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: ${{ inputs.checkout-submodules }} @@ -251,7 +251,7 @@ jobs: - name: Find quick-deploy candidate id: candidate if: ${{ !inputs.full-deploy }} - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | core.setOutput('found', 'false'); @@ -299,7 +299,7 @@ jobs: - name: Download validation artifact if: steps.candidate.outputs.found == 'true' continue-on-error: true - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ${{ steps.candidate.outputs.artifact-name }} run-id: ${{ steps.candidate.outputs.run-id }} @@ -517,7 +517,7 @@ jobs: # not used. - name: Upload deploy audit artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: sf-deploy-${{ github.run_number }} path: |