From fa29a0add76bd11df0665516368272cb44247416 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 21:38:33 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.39.1` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.4.0` | `7.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `7.1.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `6852f92c20ea7fd3b0c25de3b5112db3a98da050` | `f3360c560367c9daf72b88c0e6164162034c5721` | | [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3.0.1` | `5.0.0` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4.0.5` | `5.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` | | [anchore/scan-action](https://github.com/anchore/scan-action) | `6.5.1` | `7.4.2` | Updates `actions/checkout` from 4.3.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.3.1...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `github/codeql-action/init` from 4.37.9 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.37.9 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `actions/setup-python` from 5.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5.4.0...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `actions/setup-node` from 4.4.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `dorny/paths-filter` from 6852f92c20ea7fd3b0c25de3b5112db3a98da050 to f3360c560367c9daf72b88c0e6164162034c5721 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/6852f92c20ea7fd3b0c25de3b5112db3a98da050...f3360c560367c9daf72b88c0e6164162034c5721) Updates `actions/upload-pages-artifact` from 3.0.1 to 5.0.0 - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](https://github.com/actions/upload-pages-artifact/compare/56afc609e74202658d3ffba0e8f6dda462b719fa...fc324d3547104276b827a68afc52ff2a11cc49c9) Updates `actions/deploy-pages` from 4.0.5 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](https://github.com/actions/deploy-pages/compare/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e...368f82528645a54fb793d4d04e342629a3f51346) Updates `actions/upload-artifact` from 4.6.2 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 4.3.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `anchore/scan-action` from 6.5.1 to 7.4.2 - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/scan-action/compare/1638637db639e0ade3258b51db49a9a137574c3e...27805bf3b4e84b4a5c980df22ed233c00390a439) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: f3360c560367c9daf72b88c0e6164162034c5721 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/upload-pages-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anchore/scan-action dependency-version: 7.4.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 6 +-- .github/workflows/config-drift.yml | 4 +- .github/workflows/dependency-validation.yml | 8 ++-- .github/workflows/deploy-apps.yml | 4 +- .github/workflows/docker-build-and-push.yml | 6 +-- .github/workflows/docs-deploy.yml | 8 ++-- .github/workflows/gdal-runtime-build.yml | 52 ++++++++++----------- .github/workflows/hastegeo-build.yml | 10 ++-- .github/workflows/hastegeo-publish.yml | 18 +++---- .github/workflows/rc-cleanup.yml | 8 ++-- .github/workflows/release.yml | 4 +- .github/workflows/secret-scan.yml | 2 +- .github/workflows/size-limits-tests.yml | 4 +- .github/workflows/titiler-tests.yml | 4 +- .github/workflows/update-size-limits.yml | 2 +- 15 files changed, 70 insertions(+), 70 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 463f0b2f..29bb5a21 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -59,7 +59,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` @@ -69,7 +69,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -98,6 +98,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/config-drift.yml b/.github/workflows/config-drift.yml index 4e2644a0..35bc9504 100644 --- a/.github/workflows/config-drift.yml +++ b/.github/workflows/config-drift.yml @@ -31,11 +31,11 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/dependency-validation.yml b/.github/workflows/dependency-validation.yml index 5690ede2..caec6b03 100644 --- a/.github/workflows/dependency-validation.yml +++ b/.github/workflows/dependency-validation.yml @@ -81,12 +81,12 @@ jobs: functions_worker: false steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python ${{ matrix.python }} - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} @@ -121,12 +121,12 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Node - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "20" diff --git a/.github/workflows/deploy-apps.yml b/.github/workflows/deploy-apps.yml index 93048975..fc9c3556 100644 --- a/.github/workflows/deploy-apps.yml +++ b/.github/workflows/deploy-apps.yml @@ -60,7 +60,7 @@ jobs: contents: read pull-requests: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -122,7 +122,7 @@ jobs: echo "directory=$package_dir" >> "$GITHUB_OUTPUT" - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" - name: Install tools diff --git a/.github/workflows/docker-build-and-push.yml b/.github/workflows/docker-build-and-push.yml index 1fca74f3..17689ffd 100644 --- a/.github/workflows/docker-build-and-push.yml +++ b/.github/workflows/docker-build-and-push.yml @@ -34,10 +34,10 @@ jobs: imageryprep: ${{ steps.filter.outputs.imageryprep }} hastelib: ${{ steps.filter.outputs.hastelib }} steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3 + - uses: dorny/paths-filter@f3360c560367c9daf72b88c0e6164162034c5721 # v3 id: filter # Hastegeo changes are handled by hastegeo-publish.yml so images use # the exact matching RC tag and are not built twice. @@ -67,7 +67,7 @@ jobs: changed: ${{ needs.detect-changes.outputs.imageryprep }} steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml index 51e75dca..69a545e9 100644 --- a/.github/workflows/docs-deploy.yml +++ b/.github/workflows/docs-deploy.yml @@ -27,12 +27,12 @@ jobs: - name: Checkout # Fetch Git LFS objects (docs/_static/**/*.mp4) so the built site # serves real videos, not 132-byte LFS pointer files. - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: lfs: true - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" cache: pip @@ -50,7 +50,7 @@ jobs: run: jupyter-book build docs/ - name: Upload Pages artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: docs/_build/html @@ -63,4 +63,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deploy - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1 diff --git a/.github/workflows/gdal-runtime-build.yml b/.github/workflows/gdal-runtime-build.yml index 716d8da1..f579e599 100644 --- a/.github/workflows/gdal-runtime-build.yml +++ b/.github/workflows/gdal-runtime-build.yml @@ -118,12 +118,12 @@ jobs: contents: read steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -146,7 +146,7 @@ jobs: image: quay.io/pypa/manylinux_2_28_x86_64@sha256:1e102f2e9ed9b7fd8d64b29f798c76078c3fa8f14d34914d7a4045e39419d8e0 steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -204,7 +204,7 @@ jobs: --build "$build" - name: Upload immutable build artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist/* @@ -212,7 +212,7 @@ jobs: retention-days: 7 - name: Upload hash-locked smoke dependency wheels - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: haste-gdal-smoke-deps-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/smoke-wheels/*.whl @@ -238,18 +238,18 @@ jobs: name: smoke-${{ matrix.name }} steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download build wheels - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist - name: Download hash-locked smoke dependencies - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-smoke-deps-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/smoke-wheels @@ -282,7 +282,7 @@ jobs: - name: Download imageryprep test package if: matrix.name == 'imageryprep-python311' - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-function-packages-${{ github.sha }} path: ${{ runner.temp }}/haste-function-packages @@ -321,12 +321,12 @@ jobs: PIP_INDEX_URL: ${{ secrets.PIP_INDEX_URL || 'https://pypi.org/simple' }} steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download native runtime wheels - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist @@ -373,7 +373,7 @@ jobs: --output-dir "$RUNNER_TEMP/haste-function-packages" - name: Upload build-once Function App packages - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: haste-function-packages-${{ github.sha }} path: ${{ runner.temp }}/haste-function-packages/* @@ -388,20 +388,20 @@ jobs: contents: read steps: - name: Checkout scanner configuration - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false sparse-checkout: .grype.yaml sparse-checkout-cone-mode: false - name: Download build inventory - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist - name: Scan the CycloneDX inventory for known vulnerabilities - uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6 + uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2 with: sbom: ${{ runner.temp }}/haste-gdal-runtime/dist/bom.cdx.json fail-build: true @@ -410,7 +410,7 @@ jobs: output-format: table - name: Scan built wheel artifacts for known vulnerabilities - uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6 + uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2 with: path: ${{ runner.temp }}/haste-gdal-runtime/dist fail-build: true @@ -427,18 +427,18 @@ jobs: PIP_INDEX_URL: ${{ secrets.PIP_INDEX_URL || 'https://pypi.org/simple' }} steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download build wheels - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist - name: Download hash-locked smoke dependencies - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-smoke-deps-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/smoke-wheels @@ -512,7 +512,7 @@ jobs: id-token: write steps: - name: Download verified runtime artifacts - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/dist @@ -529,7 +529,7 @@ jobs: sbom-path: ${{ runner.temp }}/haste-gdal-runtime/dist/bom.cdx.json - name: Download build-once Function App packages - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-function-packages-${{ github.sha }} path: ${{ runner.temp }}/haste-function-packages @@ -545,12 +545,12 @@ jobs: contents: read steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -579,17 +579,17 @@ jobs: contents: write steps: - name: Checkout trusted publisher source - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Download the attested runtime bundle - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: haste-gdal-runtime-${{ github.sha }} path: ${{ runner.temp }}/haste-gdal-runtime/release diff --git a/.github/workflows/hastegeo-build.yml b/.github/workflows/hastegeo-build.yml index a93c87bf..9cc72057 100644 --- a/.github/workflows/hastegeo-build.yml +++ b/.github/workflows/hastegeo-build.yml @@ -58,14 +58,14 @@ jobs: already_published: ${{ steps.resolve.outputs.already_published }} steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -119,13 +119,13 @@ jobs: contents: read steps: - name: Checkout source without persisted credentials - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve-version.outputs.source_sha }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -151,7 +151,7 @@ jobs: --validate-only - name: Upload validated wheel artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: hastegeo-wheel-${{ github.run_id }} if-no-files-found: error diff --git a/.github/workflows/hastegeo-publish.yml b/.github/workflows/hastegeo-publish.yml index ef1e0113..67e6425e 100644 --- a/.github/workflows/hastegeo-publish.yml +++ b/.github/workflows/hastegeo-publish.yml @@ -33,14 +33,14 @@ jobs: pr_number: ${{ steps.guard.outputs.pr_number }} steps: - name: Checkout trusted release policy - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -174,13 +174,13 @@ jobs: pr_number: ${{ needs.prepare.outputs.pr_number }} steps: - name: Checkout trusted publisher - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -226,13 +226,13 @@ jobs: contents: write steps: - name: Checkout trusted publisher - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -300,14 +300,14 @@ jobs: contents: write steps: - name: Checkout trusted publisher - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -352,7 +352,7 @@ jobs: image_name: hasteimageryprep steps: - name: Checkout RC source - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.prepare.outputs.source_sha }} persist-credentials: false diff --git a/.github/workflows/rc-cleanup.yml b/.github/workflows/rc-cleanup.yml index aa47d1ef..6b8ff310 100644 --- a/.github/workflows/rc-cleanup.yml +++ b/.github/workflows/rc-cleanup.yml @@ -27,12 +27,12 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" @@ -65,12 +65,12 @@ jobs: contents: write steps: - name: Checkout trusted cleanup policy - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 10bc3410..f726654f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: # contents:write is always the reviewed copy on main. The tag is still # used for permalinks and for the Latest comparison below. - name: Checkout release tooling from the default branch - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} # Full history + tags: the Latest badge decision compares this tag @@ -66,7 +66,7 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 15a02975..91f679da 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/size-limits-tests.yml b/.github/workflows/size-limits-tests.yml index 66837f46..dd529c58 100644 --- a/.github/workflows/size-limits-tests.yml +++ b/.github/workflows/size-limits-tests.yml @@ -27,10 +27,10 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" - name: Compile infrastructure without deploying diff --git a/.github/workflows/titiler-tests.yml b/.github/workflows/titiler-tests.yml index 74b46a27..55005b5e 100644 --- a/.github/workflows/titiler-tests.yml +++ b/.github/workflows/titiler-tests.yml @@ -14,10 +14,10 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.11" # The HASTE GDAL wheels are built and validated by gdal-runtime-build.yml diff --git a/.github/workflows/update-size-limits.yml b/.github/workflows/update-size-limits.yml index b4c5d8b8..f5fb175a 100644 --- a/.github/workflows/update-size-limits.yml +++ b/.github/workflows/update-size-limits.yml @@ -27,7 +27,7 @@ jobs: id-token: write contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false