diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml index d8b7151..67330b8 100644 --- a/.github/workflows/agent-ci.yml +++ b/.github/workflows/agent-ci.yml @@ -17,7 +17,7 @@ jobs: # Pinned to an immutable core commit SHA, not @main (see release.yml): core's # v0.19.4, the release go.mod requires. Bump the two together, which # TestCorePinsAreOneImmutableCommitMatchingGoMod holds. - uses: codefly-dev/core/.github/workflows/agent-ci.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + uses: codefly-dev/core/.github/workflows/agent-ci.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 with: # The CLI release the gate runs with. agent.codefly.yaml selects the # source-packager version (0.0.69); go.mod selects Go 1.27.3. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f8a2b60..d1dc3b9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,10 +9,10 @@ jobs: build-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -27,10 +27,10 @@ jobs: agent-runtime-e2e: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -47,10 +47,10 @@ jobs: image-sbom: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -58,7 +58,7 @@ jobs: run: docker build -t service-warehouse:e2e . # The daemon holds this image and no registry serves it, so the scan needs # syft on PATH: the managed containerized scanner has no Docker access. - - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: assert the image contract against a real image env: SWH_GATEWAY_IMAGE: service-warehouse:e2e @@ -85,7 +85,7 @@ jobs: exit 0 fi go run ./cmd/image-sbom -image "$(jq -er '.name + "@" + .digest' gateway-image.json)" -out sbom-published - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gateway-image-sbom path: | diff --git a/.github/workflows/publish-gateway-image.yml b/.github/workflows/publish-gateway-image.yml index 03bbff9..524a1db 100644 --- a/.github/workflows/publish-gateway-image.yml +++ b/.github/workflows/publish-gateway-image.yml @@ -33,7 +33,7 @@ jobs: # Full history and the triggering commit, with no `ref`: the action proves # that commit is reachable from the remote's own default branch, and a # shallow clone or a caller-selected ref would decide that question for it. - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -44,9 +44,9 @@ jobs: # before the action, it runs no code from this repository and writes # nothing into the checkout, so the action's guard — a dirty tree, stored # Git credentials, an unmerged commit — still runs before login and build. - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - - uses: codefly-dev/core/.github/actions/publish-service-image@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + - uses: codefly-dev/core/.github/actions/publish-service-image@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 id: publish with: version: ${{ inputs.version }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7cca182..c64ad94 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,8 +34,8 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -48,9 +48,9 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -107,11 +107,11 @@ jobs: exit 1 fi echo "digest=$digest" >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true - - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 # Evidence for every platform the image ships, generated by the same code # path the agent's Builder.SBOM uses, so each document is bound to the child # manifest digest inside the document itself. It scans the recorded digest @@ -121,7 +121,7 @@ jobs: env: DIGEST: ${{ steps.locked.outputs.digest }} run: go run ./cmd/image-sbom -image "$IMAGE@$DIGEST" -out sbom - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gateway-image-sbom-${{ steps.version.outputs.version }} path: sbom/ @@ -157,7 +157,7 @@ jobs: # requires; bump the two together. This version of the workflow keeps the # release PAT out of jobs that run unreviewed code and refuses a tag not # reachable from the default branch. - uses: codefly-dev/core/.github/workflows/go-service-release.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + uses: codefly-dev/core/.github/workflows/go-service-release.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 secrets: inherit # Workflow artifacts expire. Copy the digest-bound documents and index onto @@ -168,7 +168,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: gateway-image-sbom-* merge-multiple: true