From 6dc2696ab875012ebcc579039509f048e8506831 Mon Sep 17 00:00:00 2001 From: thewrz Date: Sat, 1 Aug 2026 22:47:42 -0700 Subject: [PATCH] chore(ci): bump pinned actions to latest within their major Replaces #123 (Renovate) and #137 (Dependabot), both of which #127 put into conflict by editing the same workflow files. actions/checkout v6.0.2 -> v6.1.0 actions/setup-node v6.4.0 -> v6.5.0 softprops/action-gh-release v3.0.0 -> v3.0.2 Each SHA was resolved from the upstream tag through the GitHub API rather than copied from a bot PR body, and each target is the newest release inside the major currently pinned. Pins stay full 40-character commit SHAs with the version in a trailing comment, per the repo's supply-chain convention. Majors are deliberately excluded and left for individual review: checkout v7, setup-node v7, github/codeql-action v4, and dependency-review-action v5. The last of those matters most -- its fail-on-severity behavior may differ across majors, which is why #125 pinned v4.9.0 rather than taking v5. Co-Authored-By: Claude Opus 5 --- .github/workflows/build-server.yml | 6 +++--- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/codeql.yml | 2 +- .github/workflows/dependency-health.yml | 4 ++-- .github/workflows/dependency-review.yml | 2 +- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build-server.yml b/.github/workflows/build-server.yml index 674a530..d7dae1d 100644 --- a/.github/workflows/build-server.yml +++ b/.github/workflows/build-server.yml @@ -37,12 +37,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 # The runtime resolved here is the one bundled into the release artifact # below, so .nvmrc pins what ships to users, not just what CI builds with. - name: Setup Node.js (pinned by .nvmrc) - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc @@ -159,7 +159,7 @@ jobs: - name: Upload release asset if: github.event_name == 'release' || startsWith(github.ref, 'refs/tags/v') - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: draft: ${{ github.event_name != 'release' }} files: DMXr-Server-${{ matrix.target }}.${{ matrix.archive }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0b19b97..d78ce07 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,9 +14,9 @@ jobs: typecheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc @@ -35,9 +35,9 @@ jobs: node-pin: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc @@ -55,9 +55,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc @@ -72,9 +72,9 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7c59339..a5b482b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,7 @@ jobs: matrix: language: [javascript-typescript] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3 with: diff --git a/.github/workflows/dependency-health.yml b/.github/workflows/dependency-health.yml index e62397f..3dc6b1a 100644 --- a/.github/workflows/dependency-health.yml +++ b/.github/workflows/dependency-health.yml @@ -14,9 +14,9 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: npm diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index b19c70a..74f0ab4 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -11,7 +11,7 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 with: