From 53ddf8e107a65ebec059c9d7189c9bf6579ac7ba Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 9 Aug 2026 03:17:32 +0000 Subject: [PATCH 1/2] build(deps): bump the actions-minor-patch group across 1 directory with 5 updates Bumps the actions-minor-patch group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.0` | `4.37.6` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.0` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.0` | `4.37.6` | | [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.2` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `github/codeql-action/init` from 4.37.0 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/autobuild` from 4.37.0 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...5595ccaf912efad79be6eef63a5619ff05969be3) Updates `actions/attest` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...1e69f48acb82d1966a394da916b4c1698aa569d6) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dependency-review.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ .github/workflows/runner-release-candidate.yml | 12 ++++++------ .github/workflows/sanitization.yml | 2 +- 6 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7bdca98..bf03984 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: GOTOOLCHAIN: go1.26.5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go @@ -47,7 +47,7 @@ jobs: cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Node @@ -75,7 +75,7 @@ jobs: GOTOOLCHAIN: go1.26.5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go @@ -103,7 +103,7 @@ jobs: GOTOOLCHAIN: go1.26.5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Node @@ -149,7 +149,7 @@ jobs: GOTOOLCHAIN: go1.26.5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 05e970e..21d37ec 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,16 +25,16 @@ jobs: - javascript-typescript steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 - name: Analyze - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index ad60623..b979121 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -13,7 +13,7 @@ jobs: cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Dependency Review diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 396abc5..34eb2e4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: tag_object: ${{ steps.identity.outputs.tag_object }} steps: - name: Checkout exact tag - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -63,7 +63,7 @@ jobs: RELEASE_VERSION: ${{ needs.release-admission.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.release-admission.outputs.source_commit }} @@ -112,7 +112,7 @@ jobs: RELEASE_VERSION: ${{ needs.release-admission.outputs.version }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.release-admission.outputs.source_commit }} @@ -166,7 +166,7 @@ jobs: REBUILD_B_SHA256: ${{ needs.release-build-b.outputs.tree_tar_sha256 }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.release-admission.outputs.source_commit }} @@ -180,7 +180,7 @@ jobs: id: compare run: 'set -euo pipefail; test "$(sha256sum "$RUNNER_TEMP/rebuild-a/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; test "$(sha256sum "$RUNNER_TEMP/rebuild-b/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_B_SHA256"; test "$REBUILD_A_SHA256" = "$REBUILD_B_SHA256"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-a/publication-tree.tar"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-b/publication-tree.tar"; mkdir -m 700 "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; tar -xf "$RUNNER_TEMP/rebuild-a/publication-tree.tar" -C "$RUNNER_TEMP/a" --no-same-owner; tar -xf "$RUNNER_TEMP/rebuild-b/publication-tree.tar" -C "$RUNNER_TEMP/b" --no-same-owner; scripts/release/compare-runtime-rebuilds.sh "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; cp "$RUNNER_TEMP/rebuild-a/publication-tree.tar" "$RUNNER_TEMP/publication-bundle.tar"; test "$(sha256sum "$RUNNER_TEMP/publication-bundle.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; (cd "$RUNNER_TEMP" && jq -r ''.subjects[] | "\(.sha256) \(.path)"'' a/provenance-subjects.json >attestation-checksums.txt && printf "%s provenance-subjects.json\n" "$(sha256sum a/provenance-subjects.json | awk ''{print $1}'')" >>attestation-checksums.txt && LC_ALL=C sort -k2,2 -o attestation-checksums.txt attestation-checksums.txt); printf "publication_bundle_sha256=%s\n" "$REBUILD_A_SHA256" >>"$GITHUB_OUTPUT"' - name: Attest exact runtime provenance subjects - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ${{ runner.temp }}/attestation-checksums.txt show-summary: true @@ -214,7 +214,7 @@ jobs: PUBLICATION_BUNDLE_SHA256: ${{ needs.release-compare-attest.outputs.publication_bundle_sha256 }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 diff --git a/.github/workflows/runner-release-candidate.yml b/.github/workflows/runner-release-candidate.yml index 9b3f818..f145b01 100644 --- a/.github/workflows/runner-release-candidate.yml +++ b/.github/workflows/runner-release-candidate.yml @@ -31,7 +31,7 @@ jobs: PORTABLE_GHAR_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} run: 'set -euo pipefail; test -n "$PORTABLE_GHAR_RUNNER_OBSERVER_ACTOR"; test "$GITHUB_ACTOR" = "$PORTABLE_GHAR_RUNNER_OBSERVER_ACTOR"; test -n "$PORTABLE_GHAR_DEFAULT_BRANCH"; test "$GITHUB_REF" = "refs/heads/$PORTABLE_GHAR_DEFAULT_BRANCH"; python3 -B -c ''import json,os,pathlib,stat; fail=lambda:(_ for _ in ()).throw(ValueError("event")); path=pathlib.Path(os.environ["GITHUB_EVENT_PATH"]); info=path.lstat(); raw=path.read_bytes(); (stat.S_ISREG(info.st_mode) and not path.is_symlink() and info.st_nlink == 1 and 0 < len(raw) <= 1048576) or fail(); hook=lambda pairs:dict(pairs) if len(pairs) == len({key for key,_value in pairs}) else fail(); event=json.loads(raw.decode("utf-8","strict"),object_pairs_hook=hook,parse_constant=lambda _value:fail()); type(event) is dict or fail(); name=os.environ["GITHUB_EVENT_NAME"]; repository_dispatch=name == "repository_dispatch" and event.get("action") == "observe-runner-release" and type(event.get("client_payload")) is dict and len(event["client_payload"]) == 0; workflow_dispatch=name == "workflow_dispatch" and "action" not in event and "client_payload" not in event and ("inputs" not in event or event["inputs"] is None or type(event["inputs"]) is dict and len(event["inputs"]) == 0); (repository_dispatch or workflow_dispatch) or fail()''' - name: Checkout exact default-branch source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ github.sha }} @@ -70,7 +70,7 @@ jobs: ARTIFACT_VERSION: ${{ needs.runner-candidate-admission.outputs.artifact_version }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.runner-candidate-admission.outputs.source_commit }} @@ -120,7 +120,7 @@ jobs: ARTIFACT_VERSION: ${{ needs.runner-candidate-admission.outputs.artifact_version }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.runner-candidate-admission.outputs.source_commit }} @@ -175,7 +175,7 @@ jobs: REBUILD_B_SHA256: ${{ needs.runner-candidate-build-b.outputs.tree_tar_sha256 }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.runner-candidate-admission.outputs.source_commit }} @@ -189,7 +189,7 @@ jobs: id: compare run: 'set -euo pipefail; test "$(sha256sum "$RUNNER_TEMP/rebuild-a/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; test "$(sha256sum "$RUNNER_TEMP/rebuild-b/publication-tree.tar" | awk ''{print $1}'')" = "$REBUILD_B_SHA256"; test "$REBUILD_A_SHA256" = "$REBUILD_B_SHA256"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-a/publication-tree.tar"; python3 -c "import pathlib,sys,tarfile; t=tarfile.open(sys.argv[1],''r:''); m=t.getmembers(); n=[x.name for x in m]; assert m and len(n)==len(set(n)); assert all(x.isfile() or x.isdir() for x in m); assert all(not pathlib.PurePosixPath(x).is_absolute() and ''..'' not in pathlib.PurePosixPath(x).parts for x in n)" "$RUNNER_TEMP/rebuild-b/publication-tree.tar"; mkdir -m 700 "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; tar -xf "$RUNNER_TEMP/rebuild-a/publication-tree.tar" -C "$RUNNER_TEMP/a" --no-same-owner; tar -xf "$RUNNER_TEMP/rebuild-b/publication-tree.tar" -C "$RUNNER_TEMP/b" --no-same-owner; scripts/release/compare-runtime-rebuilds.sh "$RUNNER_TEMP/a" "$RUNNER_TEMP/b"; cp "$RUNNER_TEMP/rebuild-a/publication-tree.tar" "$RUNNER_TEMP/publication-bundle.tar"; test "$(sha256sum "$RUNNER_TEMP/publication-bundle.tar" | awk ''{print $1}'')" = "$REBUILD_A_SHA256"; (cd "$RUNNER_TEMP" && jq -r ''.subjects[] | "\(.sha256) \(.path)"'' a/provenance-subjects.json >attestation-checksums.txt && printf "%s provenance-subjects.json\n" "$(sha256sum a/provenance-subjects.json | awk ''{print $1}'')" >>attestation-checksums.txt && LC_ALL=C sort -k2,2 -o attestation-checksums.txt attestation-checksums.txt); printf "publication_bundle_sha256=%s\n" "$REBUILD_A_SHA256" >>"$GITHUB_OUTPUT"' - name: Attest exact candidate provenance subjects - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-checksums: ${{ runner.temp }}/attestation-checksums.txt show-summary: true @@ -225,7 +225,7 @@ jobs: PUBLICATION_BUNDLE_SHA256: ${{ needs.runner-candidate-compare-attest.outputs.publication_bundle_sha256 }} steps: - name: Checkout exact source - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ needs.runner-candidate-admission.outputs.source_commit }} diff --git a/.github/workflows/sanitization.yml b/.github/workflows/sanitization.yml index 76dcef5..c3851bc 100644 --- a/.github/workflows/sanitization.yml +++ b/.github/workflows/sanitization.yml @@ -17,7 +17,7 @@ jobs: cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false From ec75bbfcdbe7908b42195dfd4cadf8e23b1b2744 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sat, 8 Aug 2026 22:06:17 -0700 Subject: [PATCH 2/2] ci: approve reviewed action pin updates --- scripts/check_workflow_policy.py | 6 ++--- tests/repository/test_workflow_policy.py | 34 ++++++++++++------------ 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/scripts/check_workflow_policy.py b/scripts/check_workflow_policy.py index 4ca650b..cd68171 100644 --- a/scripts/check_workflow_policy.py +++ b/scripts/check_workflow_policy.py @@ -70,19 +70,19 @@ # not need to change again when those workflows are added. # --------------------------------------------------------------------------- REVIEWED_ACTION_PINS: dict[str, tuple[str, str]] = { - "actions/checkout": ("9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", "v7.0.0"), + "actions/checkout": ("3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"), "actions/setup-go": ("924ae3a1cded613372ab5595356fb5720e22ba16", "v6.5.0"), "actions/setup-node": ("48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e", "v6.4.0"), "actions/upload-artifact": ("043fb46d1a93c77aae656e7c1c64a875d1fc6a0a", "v7.0.1"), "docker/setup-buildx-action": ("8d2750c68a42422c14e847fe6c8ac0403b4cbd6f", "v3"), "aquasecurity/trivy-action": ("ed142fd0673e97e23eac54620cfb913e5ce36c25", "v0.36.0"), - "github/codeql-action": ("99df26d4f13ea111d4ec1a7dddef6063f76b97e9", "v4.37.0"), + "github/codeql-action": ("5595ccaf912efad79be6eef63a5619ff05969be3", "v4.37.6"), "actions/dependency-review-action": ( "a1d282b36b6f3519aa1f3fc636f609c47dddb294", "v5.0.0", ), "gitleaks/gitleaks-action": ("e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e", "v3.0.0"), - "actions/attest": ("a1948c3f048ba23858d222213b7c278aabede763", "v4.1.1"), + "actions/attest": ("1e69f48acb82d1966a394da916b4c1698aa569d6", "v4.2.2"), "actions/create-github-app-token": ( "bcd2ba49218906704ab6c1aa796996da409d3eb1", "v3.2.0", diff --git a/tests/repository/test_workflow_policy.py b/tests/repository/test_workflow_policy.py index a88c6a2..5ad5459 100644 --- a/tests/repository/test_workflow_policy.py +++ b/tests/repository/test_workflow_policy.py @@ -80,7 +80,7 @@ cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Local action @@ -122,7 +122,7 @@ def test_valid_fixture_passes_cleanly(self) -> None: def test_local_action_only_passes(self) -> None: text = VALID_WORKFLOW.replace( " - name: Checkout\n" - " uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n" + " uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n" " with:\n" " persist-credentials: false\n", "", @@ -136,8 +136,8 @@ def test_local_action_only_passes(self) -> None: class RejectActionRefTest(unittest.TestCase): def test_rejects_tag_ref(self) -> None: text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - "actions/checkout@v7.0.0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + "actions/checkout@v7.0.1", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text) @@ -147,7 +147,7 @@ def test_rejects_tag_ref(self) -> None: def test_rejects_branch_ref(self) -> None: text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", "actions/checkout@main", ) with tempfile.TemporaryDirectory() as tmp: @@ -157,11 +157,11 @@ def test_rejects_branch_ref(self) -> None: self.assertIn("40-character", result.stdout + result.stderr) def test_rejects_39_char_sha(self) -> None: - short_sha = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e" # 39 hex chars + short_sha = "3d3c42e5aac5ba805825da76410c181273ba90b" # 39 hex chars self.assertEqual(len(short_sha), 39) text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - f"actions/checkout@{short_sha} # v7.0.0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + f"actions/checkout@{short_sha} # v7.0.1", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text) @@ -170,11 +170,11 @@ def test_rejects_39_char_sha(self) -> None: self.assertIn("40-character", result.stdout + result.stderr) def test_rejects_41_char_ref(self) -> None: - long_sha = "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e00" # 41 hex chars + long_sha = "3d3c42e5aac5ba805825da76410c181273ba90b10" # 41 hex chars self.assertEqual(len(long_sha), 41) text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - f"actions/checkout@{long_sha} # v7.0.0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + f"actions/checkout@{long_sha} # v7.0.1", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text) @@ -196,8 +196,8 @@ def test_rejects_unknown_action_not_in_pin_table(self) -> None: def test_rejects_sha_not_matching_reviewed_pin(self) -> None: text = VALID_WORKFLOW.replace( - "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa # v7.0.0", + "3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa # v7.0.1", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text) @@ -207,8 +207,8 @@ def test_rejects_sha_not_matching_reviewed_pin(self) -> None: def test_rejects_missing_release_comment(self) -> None: text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text) @@ -218,8 +218,8 @@ def test_rejects_missing_release_comment(self) -> None: def test_rejects_mismatched_release_comment(self) -> None: text = VALID_WORKFLOW.replace( - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0", - "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.0", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1", + "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.0", ) with tempfile.TemporaryDirectory() as tmp: workflows_dir = write_workflow(Path(tmp), text)