Skip to content

chore(deps): Bump the actions group with 3 updates #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Sep 17, 2026
Merged

chore(deps): Bump the actions group with 3 updates #116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/boj-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/boj-build.yml:14 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- name: Trigger BoJ Server (Casket/ssg-mcp)
run: |
# Send a secure trigger to boj-server to build this repository
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/cargo-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/cargo-audit.yml:26 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Install cargo-audit
run: cargo install cargo-audit --locked
Expand All @@ -46,7 +46,7 @@
permissions:
issues: write
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/cargo-audit.yml:49 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Create vulnerability issue
env:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/casket-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/casket-pages.yml:26 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Checkout casket-ssg
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/casket-pages.yml:29 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
with:
repository: hyperpolymath/casket-ssg
path: .casket-ssg
Expand Down Expand Up @@ -117,4 +117,4 @@
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5.0.0
uses: actions/deploy-pages@v5.0.1

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/casket-pages.yml:120 pins actions/deploy-pages@v5.0.1 to a tag/branch — mutable ref allows upstream takeover
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,15 @@

steps:
- name: Checkout
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/codeql.yml:46 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Initialize CodeQL
uses: github/codeql-action/init@v4.37.8
uses: github/codeql-action/init@v4.38.0

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/codeql.yml:49 pins github/codeql-action/init@v4.38.0 to a tag/branch — mutable ref allows upstream takeover
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4.37.8
uses: github/codeql-action/analyze@v4.38.0

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/codeql.yml:55 pins github/codeql-action/analyze@v4.38.0 to a tag/branch — mutable ref allows upstream takeover
with:
category: "/language:${{ matrix.language }}"
2 changes: 1 addition & 1 deletion .github/workflows/dashboard-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
timeout-minutes: 15
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dashboard-check.yml:27 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- uses: dtolnay/rust-toolchain@v1

Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/dogfood-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dogfood-gate.yml:31 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Check for A2ML files
id: detect
Expand Down Expand Up @@ -73,7 +73,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dogfood-gate.yml:76 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Check for K9 files
id: detect
Expand Down Expand Up @@ -123,7 +123,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dogfood-gate.yml:126 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Scan for invisible characters
id: lint
Expand Down Expand Up @@ -188,7 +188,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dogfood-gate.yml:191 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Check for Groove manifest
id: groove
Expand Down Expand Up @@ -249,7 +249,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/dogfood-gate.yml:252 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Generate dogfooding scorecard
run: |
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:20 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- uses: dtolnay/rust-toolchain@v1
- uses: Swatinem/rust-cache@v2.9.2
- name: Build
Expand All @@ -34,7 +34,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:37 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- uses: dtolnay/rust-toolchain@v1
- uses: Swatinem/rust-cache@v2.9.2
- name: Run benchmarks
Expand All @@ -45,7 +45,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:48 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- uses: dtolnay/rust-toolchain@v1
- uses: Swatinem/rust-cache@v2.9.2
- name: Build release
Expand All @@ -58,7 +58,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:61 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- name: Run aspect tests
run: bash tests/aspect/cross_cutting_test.sh

Expand All @@ -67,7 +67,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:70 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- name: Install Zig
run: |
wget -q https://ziglang.org/download/0.13.0/zig-linux-x86_64-0.13.0.tar.xz
Expand All @@ -84,7 +84,7 @@
timeout-minutes: 15
if: github.event_name == 'push'
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/e2e.yml:87 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- uses: dtolnay/rust-toolchain@v1
- name: Install panic-attack
run: cargo install --git https://github.com/hyperpolymath/panic-attacker.git 2>/dev/null || echo "panic-attack unavailable"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/main-estate-audit.yml
100755 → 100644
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
estate-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/main-estate-audit.yml:13 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Required Files Gate
uses: hyperpolymath/cicd-suite/actions/required-files-check@main
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@
image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
steps:
- name: Checkout Site
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/pages.yml:24 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
- name: Checkout Ddraig SSG
uses: actions/checkout@v7.0.1
uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/pages.yml:26 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover
with:
repository: hyperpolymath/ddraig-ssg
path: .ddraig-ssg
Expand Down Expand Up @@ -53,4 +53,4 @@
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5.0.0
uses: actions/deploy-pages@v5.0.1

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/pages.yml:56 pins actions/deploy-pages@v5.0.1 to a tag/branch — mutable ref allows upstream takeover
4 changes: 2 additions & 2 deletions .github/workflows/semgrep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@
container:
image: semgrep/semgrep
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/semgrep.yml:28 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Run Semgrep
run: semgrep scan --sarif --output=semgrep.sarif --config=auto .

- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v4.37.8
uses: github/codeql-action/upload-sarif@v4.38.0

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/semgrep.yml:34 pins github/codeql-action/upload-sarif@v4.38.0 to a tag/branch — mutable ref allows upstream takeover
with:
sarif_file: semgrep.sarif
if: always()
2 changes: 1 addition & 1 deletion .github/workflows/workflow-linter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@v7.0.1
- uses: actions/checkout@v7

Check warning

Code scanning / Hypatia

Hypatia workflow_hardening: WH004 Warning

workflow .github/workflows/workflow-linter.yml:21 pins actions/checkout@v7 to a tag/branch — mutable ref allows upstream takeover

- name: Check SPDX headers
run: |
Expand Down
Loading