From 570b2e2747a419859510b96eaae75594c545eb3a Mon Sep 17 00:00:00 2001 From: Ian Holloway <72767437+IanHollow@users.noreply.github.com> Date: Mon, 28 Sep 2026 10:18:23 -0700 Subject: [PATCH] ci: pin shared CI workflows to v2.9.0 Signed-off-by: Ian Holloway <72767437+IanHollow@users.noreply.github.com> --- .github/workflows/ci.yml | 6 +++--- .github/workflows/codeql.yml | 4 ++-- .github/workflows/dco.yml | 2 +- .github/workflows/reconcile-merge-queue.yml | 2 +- workflow-templates/dependency-review.yml | 2 +- workflow-templates/nix-checks.yml | 10 +++++----- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 987767e..927af6c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,9 +18,9 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: nix-forge/ci/actions/setup-nix@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + - uses: nix-forge/ci/actions/setup-nix@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 - name: Validate workflows and template contracts - uses: nix-forge/ci/actions/validate-workflows@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/validate-workflows@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 queue-completion: continue-on-error: true name: Queue completion callback @@ -32,4 +32,4 @@ jobs: actions: write # Notify the trusted default-branch reconciler. steps: - name: Notify trusted queue reconciler - uses: nix-forge/ci/actions/queue-completion@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aed939e..5f557f1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ jobs: actions: read # Read workflow metadata for Actions analysis. contents: read security-events: write # Upload code scanning results. - uses: nix-forge/ci/.github/workflows/codeql.yml@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/.github/workflows/codeql.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 with: languages: actions queue-completion: @@ -37,4 +37,4 @@ jobs: actions: write # Dispatch trusted queue validation. steps: - name: Notify trusted queue reconciler - uses: nix-forge/ci/actions/queue-completion@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index dc93538..dd25ddf 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -149,4 +149,4 @@ jobs: actions: write # Notify the trusted default-branch reconciler. steps: - name: Notify trusted queue reconciler - uses: nix-forge/ci/actions/queue-completion@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0-compatible + uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0-compatible diff --git a/.github/workflows/reconcile-merge-queue.yml b/.github/workflows/reconcile-merge-queue.yml index f15c3bd..ce19e57 100644 --- a/.github/workflows/reconcile-merge-queue.yml +++ b/.github/workflows/reconcile-merge-queue.yml @@ -32,7 +32,7 @@ jobs: statuses: write # Report verified queue job results. steps: - name: Reconcile verified automation - uses: nix-forge/ci/actions/reconcile-queue@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/reconcile-queue@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 with: workflows: '["ci.yml", "codeql.yml", "dco.yml"]' base-sha-workflows: '["dco.yml"]' diff --git a/workflow-templates/dependency-review.yml b/workflow-templates/dependency-review.yml index 60c12de..c67f95c 100644 --- a/workflow-templates/dependency-review.yml +++ b/workflow-templates/dependency-review.yml @@ -12,4 +12,4 @@ jobs: name: Dependency review permissions: contents: read - uses: nix-forge/ci/.github/workflows/dependency-review.yml@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/.github/workflows/dependency-review.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 diff --git a/workflow-templates/nix-checks.yml b/workflow-templates/nix-checks.yml index 7ff9f48..92e8103 100644 --- a/workflow-templates/nix-checks.yml +++ b/workflow-templates/nix-checks.yml @@ -23,7 +23,7 @@ jobs: with: persist-credentials: false - id: inventory - uses: nix-forge/ci/actions/discover-lockfiles@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/discover-lockfiles@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 lock-health: name: Flake lock health needs: [lock] @@ -45,7 +45,7 @@ jobs: fail-fast: false matrix: lockfile: ${{ fromJSON(needs.discover.outputs.lockfiles) }} - uses: nix-forge/ci/.github/workflows/flake-lock.yml@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/.github/workflows/flake-lock.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 with: lockfile: ${{ matrix.lockfile }} checks: @@ -58,10 +58,10 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: nix-forge/ci/actions/setup-nix@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + - uses: nix-forge/ci/actions/setup-nix@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 - name: Validate workflow contracts - uses: nix-forge/ci/actions/validate-workflows@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/validate-workflows@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 - name: Materialize discovered partitions - uses: nix-forge/ci/actions/materialize-partitions@bb1b39a9082f72dc6c7ce596103ce7a5e4d29b01 # v2.8.0 + uses: nix-forge/ci/actions/materialize-partitions@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0 - name: Run declared repository checks run: nix flake check --keep-going --print-build-logs