diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 000000000..1f9608d2d --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,166 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/bazel-test.yml': + - 'actions/cache@v4.2.3' + - 'actions/checkout@v4.2.2' + - 'actions/setup-java@v4.7.1' + - 'bazelbuild/setup-bazelisk@v3.0.0' + - 'cloudbees-oss/smart-tests-results-upload-action@v1.3.0' + '.github/workflows/e2e.yml': + - 'actions/checkout@v4.2.2' + - 'actions/setup-go@v5.5.0' + - 'actions/setup-java@v4.7.1' + - 'astral-sh/setup-uv@v3.2.4' + - 'cloudbees-oss/smart-tests-results-upload-action@v1.3.0' + '.github/workflows/pre-commit.yml': + - 'actions/checkout@v6.1.0' + - 'actions/setup-python@v6.3.0' + - 'pre-commit/action@v3.0.1' + '.github/workflows/publish.yml': + - 'actions/attest-build-provenance@v2.4.0' + - 'actions/checkout@v4.2.2' + - 'actions/checkout@v4.4.0' + - 'astral-sh/setup-uv@v3.2.4' + - 'docker/build-push-action@v6.18.0' + - 'docker/login-action@v3.4.0' + - 'docker/setup-buildx-action@v3.10.0' + - 'songmu/tagpr@v1.9.0' + '.github/workflows/test.yml': + - 'actions/checkout@v4.4.0' + - 'actions/setup-java@v4.7.1' + - 'astral-sh/setup-uv@v3.2.4' + - 'cloudbees-oss/smart-tests-results-upload-action@v1.3.0' + '.github/workflows/update_maven_install_json.yml': + - 'actions/cache@v4.2.3' + - 'actions/checkout@v4.4.0' + - 'actions/setup-java@v4.9.1' + - 'bazelbuild/setup-bazelisk@v3.0.0' + - 'iarekylew00t/verified-bot-commit@v2.3.3' + '.github/workflows/verify-lockfile.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01': + ref: 'predicate@1.1.5' + commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01' + owner_id: 44036562 + repo_id: 760702757 + 'actions/attest-build-provenance@v2.4.0': + ref: 'v2.4.0' + commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be' + owner_id: 44036562 + repo_id: 760702757 + uses: + - 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01' + - 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc': + ref: 'v2.4.0' + commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + owner_id: 44036562 + repo_id: 760701061 + 'actions/cache@v4': + ref: 'v4' + commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830' + owner_id: 44036562 + repo_id: 215566462 + 'actions/cache@v4.2.3': + ref: 'v4.2.3' + commit: 'sha1-5a3ec84eff668545956fd18022155c47e93e2684' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.2.2': + ref: 'v4.2.2' + commit: 'sha1-11bd71901bbe5b1630ceea73d27597364c9af683' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/setup-go@v5.5.0': + ref: 'v5.5.0' + commit: 'sha1-d35c59abb061a4a6fb18e82ac0862c26744d6ab5' + owner_id: 44036562 + repo_id: 192624594 + 'actions/setup-java@v4.7.1': + ref: 'v4.7.1' + commit: 'sha1-c5195efecf7bdfc987ee8bae7a71cb8b11521c00' + owner_id: 44036562 + repo_id: 196057608 + 'actions/setup-java@v4.9.1': + ref: 'v4.9.1' + commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3' + owner_id: 44036562 + repo_id: 196057608 + 'actions/setup-python@v6.3.0': + ref: 'v6.3.0' + commit: 'sha1-ece7cb06caefa5fff74198d8649806c4678c61a1' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a': + ref: 'v7.0.1' + commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v3.2.4': + ref: 'v3.2.4' + commit: 'sha1-caf0cab7a618c569241d31dcd442f54681755d39' + owner_id: 115962839 + repo_id: 846733598 + 'bazelbuild/setup-bazelisk@v3.0.0': + ref: 'v3.0.0' + commit: 'sha1-b39c379c82683a5f25d34f0d062761f62693e0b2' + owner_id: 11684617 + repo_id: 336287450 + 'cloudbees-oss/smart-tests-results-upload-action@v1.3.0': + ref: 'v1.3.0' + commit: 'sha1-2598e17b493b876e051538e1324c5f2b5c56acca' + owner_id: 18043353 + repo_id: 1224401035 + uses: + - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' + 'docker/build-push-action@v6.18.0': + ref: 'v6.18.0' + commit: 'sha1-263435318d21b8e681c14492fe198d362a7d2c83' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v3.4.0': + ref: 'v3.4.0' + commit: 'sha1-74a5d142397b4f367a81961eba4e8cd7edddf772' + owner_id: 5429470 + repo_id: 287743349 + 'docker/setup-buildx-action@v3.10.0': + ref: 'v3.10.0' + commit: 'sha1-b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2' + owner_id: 5429470 + repo_id: 288485773 + 'iarekylew00t/verified-bot-commit@v2.3.3': + ref: 'v2.3.3' + commit: 'sha1-33985d44b7719dcaf0b854a0f4b0caad9bdc5b86' + owner_id: 1072572 + repo_id: 851264189 + 'pre-commit/action@v3.0.1': + ref: 'v3.0.1' + commit: 'sha1-2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd' + owner_id: 6943086 + repo_id: 204199630 + uses: + - 'actions/cache@v4' + 'songmu/tagpr@v1.9.0': + ref: 'v1.9.0' + commit: 'sha1-7191605433b03e11b313dbbc0efb80185170de4b' + owner_id: 177122 + repo_id: 524603982 diff --git a/.github/workflows/bazel-test.yml b/.github/workflows/bazel-test.yml index 0ee88e61b..68f026282 100644 --- a/.github/workflows/bazel-test.yml +++ b/.github/workflows/bazel-test.yml @@ -18,16 +18,16 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@v4.2.2 - name: Set up JDK 8 - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 + uses: actions/setup-java@v4.7.1 with: distribution: temurin java-version: "8" - name: Setup Bazel - uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3.0.0 + uses: bazelbuild/setup-bazelisk@v3.0.0 - name: Cache Bazel outputs - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + uses: actions/cache@v4.2.3 with: path: "~/.cache/bazel" key: bazel @@ -43,5 +43,5 @@ jobs: fi - name: Upload test results - uses: cloudbees-oss/smart-tests-results-upload-action@v1 + uses: cloudbees-oss/smart-tests-results-upload-action@v1.3.0 if: always() diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index fc43e6c35..ea18c749d 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -16,21 +16,21 @@ jobs: tests: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + - uses: actions/checkout@v4.2.2 + - uses: actions/checkout@v4.2.2 with: repository: launchableinc/examples path: examples - name: Set up JDK 1.8 - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4 + uses: actions/setup-java@v4.7.1 with: java-version: 8 distribution: "temurin" - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 + - uses: actions/setup-go@v5.5.0 with: go-version: 1.24 - name: Install uv - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 + uses: astral-sh/setup-uv@v3.2.4 with: enable-cache: true cache-dependency-glob: "uv.lock" @@ -132,5 +132,5 @@ jobs: working-directory: examples/gradle - name: Upload test results - uses: cloudbees-oss/smart-tests-results-upload-action@v1 + uses: cloudbees-oss/smart-tests-results-upload-action@v1.3.0 if: always() diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index d1ef0bb7a..0112ebbe5 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -9,8 +9,8 @@ jobs: pre-commit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@v6.1.0 + - uses: actions/setup-python@v6.3.0 with: python-version-file: .python-version - uses: pre-commit/action@v3.0.1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index fab7c0d66..516c57b9b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -22,9 +22,9 @@ jobs: outputs: tag: ${{ steps.run-tagpr.outputs.tag }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@v4.2.2 - id: run-tagpr - uses: Songmu/tagpr@7191605433b03e11b313dbbc0efb80185170de4b # v1.9.0 + uses: Songmu/tagpr@v1.9.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -35,11 +35,11 @@ jobs: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - name: Install uv - uses: astral-sh/setup-uv@v3 + uses: astral-sh/setup-uv@v3.2.4 - name: Build package run: uv build @@ -59,20 +59,20 @@ jobs: id-token: write steps: - name: Check out the repo - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@v4.2.2 - name: Log in to Docker Hub - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@v3.4.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@v3.10.0 - name: Build and push Docker image id: push - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@v6.18.0 with: context: . file: ./Dockerfile @@ -81,7 +81,7 @@ jobs: tags: ${{ env.IMAGE_NAME }}:latest,${{ env.IMAGE_NAME }}:${{ needs.tagpr.outputs.tag }} - name: Generate artifact attestation - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 + uses: actions/attest-build-provenance@v2.4.0 with: subject-name: index.docker.io/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fa47fada6..f14e34feb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -38,18 +38,18 @@ jobs: os: [ubuntu-22.04, windows-latest] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - name: Install uv - uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3 + uses: astral-sh/setup-uv@v3.2.4 with: enable-cache: true cache-dependency-glob: "uv.lock" - name: Set up JDK 1.8 - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 + uses: actions/setup-java@v4.7.1 with: java-version: 8 distribution: "temurin" @@ -107,5 +107,5 @@ jobs: shell: bash - name: Upload test results - uses: cloudbees-oss/smart-tests-results-upload-action@v1 + uses: cloudbees-oss/smart-tests-results-upload-action@v1.3.0 if: always() diff --git a/.github/workflows/update_maven_install_json.yml b/.github/workflows/update_maven_install_json.yml index 1e30a009d..de477952c 100644 --- a/.github/workflows/update_maven_install_json.yml +++ b/.github/workflows/update_maven_install_json.yml @@ -9,18 +9,18 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: ref: ${{ github.event.pull_request.head.ref }} - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v4.9.1 with: distribution: temurin java-version: '17' - name: Setup Bazel - uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3.0.0 + uses: bazelbuild/setup-bazelisk@v3.0.0 - name: Cache Bazel outputs - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + uses: actions/cache@v4.2.3 with: path: "~/.cache/bazel" key: bazel @@ -29,7 +29,7 @@ jobs: REPIN=1 bazel run @unpinned_maven//:pin - name: Commit updated files if: ${{ !cancelled() }} - uses: iarekylew00t/verified-bot-commit@33985d44b7719dcaf0b854a0f4b0caad9bdc5b86 # v2 + uses: iarekylew00t/verified-bot-commit@v2.3.3 with: token: ${{ secrets.GITHUB_TOKEN }} files: src/maven_install.json diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml new file mode 100644 index 000000000..16cdfccc6 --- /dev/null +++ b/.github/workflows/verify-lockfile.yml @@ -0,0 +1,28 @@ +# Fails when .github/workflows/actions.lock is out of sync with the +# workflows or a locked pin no longer verifies upstream. + +name: verify-lockfile + +on: + pull_request: + push: + branches: + - main + schedule: + # Weekly, to catch upstream tags that were re-pointed after locking. + - cron: "0 0 * * 1" + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - run: gh extension install github/gh-actions-lock --pin v0.4.0 + - run: gh actions-lock --verify