From eff79c5fa7c874ce3af5c63e729b21be72591c3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 17:38:37 +0000 Subject: [PATCH] build(deps): bump the actions-monthly group across 6 directories with 10 updates Bumps the actions-monthly group with 4 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [actions/github-script](https://github.com/actions/github-script) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Bumps the actions-monthly group with 2 updates in the /.github/actions/doc_preview directory: [JamesIves/github-pages-deploy-action](https://github.com/jamesives/github-pages-deploy-action) and [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment). Bumps the actions-monthly group with 2 updates in the /.github/actions/fetch_ctk directory: [actions/cache/restore](https://github.com/actions/cache) and [actions/cache/save](https://github.com/actions/cache). Bumps the actions-monthly group with 1 update in the /.github/actions/griffe-api-check directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Bumps the actions-monthly group with 1 update in the /.github/actions/lychee-links directory: [actions/upload-artifact](https://github.com/actions/upload-artifact). Bumps the actions-monthly group with 1 update in the /.github/actions/setup-pixi directory: [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi). Updates `astral-sh/setup-uv` from 10.3.0 to 10.3.2 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e) Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `actions/github-script` from 7.0.1 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7.0.1...v9) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) Updates `JamesIves/github-pages-deploy-action` from 4.8.0 to 4.9.0 - [Release notes](https://github.com/jamesives/github-pages-deploy-action/releases) - [Commits](https://github.com/jamesives/github-pages-deploy-action/compare/d92aa235d04922e8f08b40ce78cc5442fcfbfa2f...fa24774553152dd7873cd16ebd8d959b010c5445) Updates `marocchino/sticky-pull-request-comment` from 3.0.3 to 3.0.5 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/d4d6b0936434b21bc8345ad45a440c5f7d2c40ff...5770ad5eb8f42dd2c4f34da00c94c5381e49af88) Updates `actions/cache/restore` from 5.0.4 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/cache/save` from 5.0.4 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `astral-sh/setup-uv` from 8.2.0 to 10.3.2 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...07a047e608db84b3d8c06cd9a7c7dcc9c355c18e) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `prefix-dev/setup-pixi` from 0.9.6 to 0.11.2 - [Release notes](https://github.com/prefix-dev/setup-pixi/releases) - [Commits](https://github.com/prefix-dev/setup-pixi/compare/5185adfbffb4bd703da3010310260805d89ebb11...ad1da6449d9e506fd127fd67ab2d054a769f6a94) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-monthly - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-monthly - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-monthly - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-monthly - dependency-name: JamesIves/github-pages-deploy-action dependency-version: 4.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-monthly - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-monthly - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-monthly - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-monthly - dependency-name: astral-sh/setup-uv dependency-version: 10.3.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-monthly - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-monthly - dependency-name: prefix-dev/setup-pixi dependency-version: 0.11.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-monthly ... Signed-off-by: dependabot[bot] --- .github/actions/doc_preview/action.yml | 4 ++-- .github/actions/fetch_ctk/action.yml | 4 ++-- .github/actions/griffe-api-check/action.yml | 2 +- .github/actions/lychee-links/action.yml | 2 +- .github/actions/setup-pixi/action.yml | 2 +- .github/workflows/bandit.yml | 4 ++-- .github/workflows/build-wheel.yml | 2 +- .github/workflows/runner-trust-probe.yml | 4 ++-- .github/workflows/woa-transport-check.yml | 2 +- .github/workflows/woa-validation-dispatch.yml | 2 +- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/actions/doc_preview/action.yml b/.github/actions/doc_preview/action.yml index a0c7f212297..4580dd810db 100644 --- a/.github/actions/doc_preview/action.yml +++ b/.github/actions/doc_preview/action.yml @@ -20,7 +20,7 @@ runs: steps: - name: Deploy doc preview if: ${{ startsWith(github.ref_name, 'pull-request/') }} - uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: git-config-name: cuda-python-bot git-config-email: cuda-python-bot@users.noreply.github.com @@ -35,7 +35,7 @@ runs: - name: Leave a comment after deployment if: ${{ startsWith(github.ref_name, 'pull-request/') }} - uses: marocchino/sticky-pull-request-comment@d4d6b0936434b21bc8345ad45a440c5f7d2c40ff # v3.0.3 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 with: header: pr-preview number: ${{ inputs.pr-number }} diff --git a/.github/actions/fetch_ctk/action.yml b/.github/actions/fetch_ctk/action.yml index 994e35924fc..e9b9e7321fd 100644 --- a/.github/actions/fetch_ctk/action.yml +++ b/.github/actions/fetch_ctk/action.yml @@ -51,7 +51,7 @@ runs: - name: Download CTK cache id: ctk-get-cache - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 continue-on-error: true with: key: ${{ env.CTK_CACHE_KEY }} @@ -137,7 +137,7 @@ runs: - name: Upload CTK cache if: ${{ !cancelled() && steps.ctk-get-cache.outputs.cache-hit != 'true' }} - uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: key: ${{ env.CTK_CACHE_KEY }} path: ./${{ env.CTK_CACHE_FILENAME }} diff --git a/.github/actions/griffe-api-check/action.yml b/.github/actions/griffe-api-check/action.yml index 6c090ddeb43..dd7dce91c16 100644 --- a/.github/actions/griffe-api-check/action.yml +++ b/.github/actions/griffe-api-check/action.yml @@ -25,7 +25,7 @@ runs: using: composite steps: - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 with: enable-cache: false diff --git a/.github/actions/lychee-links/action.yml b/.github/actions/lychee-links/action.yml index 4f345576d3d..c2c8f6a0616 100644 --- a/.github/actions/lychee-links/action.yml +++ b/.github/actions/lychee-links/action.yml @@ -138,7 +138,7 @@ runs: - name: Upload link-check reports if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: lychee-${{ inputs.kind }}-${{ runner.os }}-${{ github.run_id }}-${{ github.run_attempt }} path: ${{ runner.temp }}/lychee-reports/ diff --git a/.github/actions/setup-pixi/action.yml b/.github/actions/setup-pixi/action.yml index fc43720878d..162e9e5b0fe 100644 --- a/.github/actions/setup-pixi/action.yml +++ b/.github/actions/setup-pixi/action.yml @@ -27,7 +27,7 @@ runs: - name: Setup pixi ${{ steps.version.outputs.pixi-version }} # Pinned to a commit SHA; install logic lives in the action and is # auditable/pinned (vs. a curl|bash of an unverified installer). - uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6 + uses: prefix-dev/setup-pixi@ad1da6449d9e506fd127fd67ab2d054a769f6a94 # v0.11.2 with: pixi-version: ${{ steps.version.outputs.pixi-version }} run-install: false diff --git a/.github/workflows/bandit.yml b/.github/workflows/bandit.yml index e414a2d7d3e..6a292cb13da 100644 --- a/.github/workflows/bandit.yml +++ b/.github/workflows/bandit.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install uv - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 + uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 with: enable-cache: false @@ -45,6 +45,6 @@ jobs: with: args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif" - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: results.sarif diff --git a/.github/workflows/build-wheel.yml b/.github/workflows/build-wheel.yml index 9b2be767828..fa49373d145 100644 --- a/.github/workflows/build-wheel.yml +++ b/.github/workflows/build-wheel.yml @@ -91,7 +91,7 @@ jobs: # xref: https://github.com/orgs/community/discussions/42856#discussioncomment-7678867 - name: Adding addtional GHA cache-related env vars if: ${{ env.BUILD_BINDINGS == 'true' || env.BUILD_CORE == 'true' }} - uses: actions/github-script@v9 + uses: actions/github-script@v9.0.0 with: script: | core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on'); diff --git a/.github/workflows/runner-trust-probe.yml b/.github/workflows/runner-trust-probe.yml index 8b46e6e0f67..2a55975d4f0 100644 --- a/.github/workflows/runner-trust-probe.yml +++ b/.github/workflows/runner-trust-probe.yml @@ -140,7 +140,7 @@ jobs: - name: Probe Node 20 action runtime (informational) if: ${{ always() }} continue-on-error: true - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 (declares node20) + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7.0.1 (declares node20) with: script: | const probe = require(`${process.env.GITHUB_WORKSPACE}/ci/tools/runner_trust_probe_node.js`); @@ -194,7 +194,7 @@ jobs: - name: Probe Node 20 action runtime (informational) if: ${{ always() }} continue-on-error: true - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 (declares node20) + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7.0.1 (declares node20) with: script: | const probe = require(`${process.env.GITHUB_WORKSPACE}/ci/tools/runner_trust_probe_node.js`); diff --git a/.github/workflows/woa-transport-check.yml b/.github/workflows/woa-transport-check.yml index 34bfadd386e..c845c7839e7 100644 --- a/.github/workflows/woa-transport-check.yml +++ b/.github/workflows/woa-transport-check.yml @@ -62,7 +62,7 @@ jobs: steps: - name: Create private dispatch token id: private-app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }} private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }} diff --git a/.github/workflows/woa-validation-dispatch.yml b/.github/workflows/woa-validation-dispatch.yml index cead1752f24..e06dcfd21cf 100644 --- a/.github/workflows/woa-validation-dispatch.yml +++ b/.github/workflows/woa-validation-dispatch.yml @@ -94,7 +94,7 @@ jobs: steps: - name: Create private dispatch token id: private-app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ vars.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_CLIENT_ID }} private-key: ${{ secrets.CUDA_PYTHON_WOA_XREPO_CI_PRIVATE_APP_PRIVATE_KEY }}