From e721c6cf3fc042513d62edc7d809e1e82bdca50e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:18:39 +0000 Subject: [PATCH] build(deps): bump the github-actions group with 5 updates Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `5.0.0` | `7.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 5.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v5...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v8.0.1...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 4 ++-- .../engineering-platform-validation.yml | 8 ++++---- .../workflows/ep-server-production-release.yml | 18 +++++++++--------- .github/workflows/owner-authorization.yml | 2 +- .github/workflows/security-baseline.yml | 2 +- .github/workflows/tde-observe.yml | 2 +- 6 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9510bcdc..c32381ef 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: {languages: python,javascript-typescript} - - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 diff --git a/.github/workflows/engineering-platform-validation.yml b/.github/workflows/engineering-platform-validation.yml index 55076d8a..8acb6afd 100644 --- a/.github/workflows/engineering-platform-validation.yml +++ b/.github/workflows/engineering-platform-validation.yml @@ -243,7 +243,7 @@ jobs: run: npm run test:engineering-dashboard -- --shard=${{ matrix.shard }} - name: Upload Engineering Status browser screenshots if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-status-browser-screenshots-${{ matrix.artifact_suffix }} path: | @@ -257,7 +257,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: {node-version: '24'} - run: npm ci - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 @@ -266,7 +266,7 @@ jobs: path: browser-shard-evidence - name: Enforce all selected production JavaScript files strictly above 80.2 percent run: node tools/qualification/dashboard_js_coverage.mjs . browser-shard-evidence dashboard-executable-coverage.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: dashboard-executable-coverage @@ -279,7 +279,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v22 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v22 with: {node-version: '22'} - name: Install pinned browser validation dependencies run: npm ci --ignore-scripts diff --git a/.github/workflows/ep-server-production-release.yml b/.github/workflows/ep-server-production-release.yml index 671c25d0..e121f2e9 100644 --- a/.github/workflows/ep-server-production-release.yml +++ b/.github/workflows/ep-server-production-release.yml @@ -138,7 +138,7 @@ jobs: "$RUNNER_TEMP/ep-production/bin/engineering-platform-server" --help >/dev/null - name: Generate SBOM for the exact release runtime run: cyclonedx-py environment --output-file dist/engineering-platform.cdx.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-platform-production-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: dist/ @@ -156,7 +156,7 @@ jobs: ref: ${{ needs.release-context.outputs.candidate_sha }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: {python-version: '3.14'} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v22 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v22 with: {node-version: '22'} - run: python3 -m pip install . && npm ci && npx playwright install --with-deps chromium # Execute the same bounded four-part coordinator as local qualification; @@ -178,7 +178,7 @@ jobs: ref: ${{ needs.release-context.outputs.candidate_sha }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: {python-version: '3.14'} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: engineering-platform-production-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: dist @@ -267,7 +267,7 @@ jobs: cmp "$QUALIFIED" "$RUNNER_TEMP/$QUALIFIED" fi rm -f pypi.json "$QUALIFIED" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: | @@ -293,7 +293,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5 with: ref: ${{ needs.release-context.outputs.candidate_sha }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: release-input @@ -398,7 +398,7 @@ jobs: ref: ${{ needs.release-context.outputs.candidate_sha }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: {python-version: '3.14'} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: engineering-platform-qualified-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: release-input @@ -520,7 +520,7 @@ jobs: ep_draft_upload "$DRAFT_ID" "$RECEIPT" "$RECEIPT" fi rm -f "$RECEIPT" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-platform-published-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: | @@ -541,7 +541,7 @@ jobs: ref: ${{ needs.release-context.outputs.candidate_sha }} - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: {python-version: '3.14'} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: engineering-platform-published-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: published-input @@ -771,7 +771,7 @@ jobs: gh release upload "$TAG" "$RECEIPT" gh release download "$TAG" --pattern "$RECEIPT" --output - | cmp "$RECEIPT" - fi - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-platform-release-evidence-${{ needs.release-context.outputs.version }}-${{ needs.release-context.outputs.candidate_sha }} path: engineering-platform-release-complete-*.json diff --git a/.github/workflows/owner-authorization.yml b/.github/workflows/owner-authorization.yml index 4af01a74..ac85c52c 100644 --- a/.github/workflows/owner-authorization.yml +++ b/.github/workflows/owner-authorization.yml @@ -116,7 +116,7 @@ jobs: script: | const [targetOwner, targetRepo] = process.env.TARGET_REPOSITORY.split("/"); await github.rest.repos.createCommitStatus({owner: targetOwner, repo: targetRepo, sha: process.env.TARGET_SHA, context: "Owner Authorization", state: "success", description: "HIGH_RISK authorized for this exact SHA", target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`}); - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: trusted-delivery-owner-authorization-evidence path: owner-authorization-evidence.json diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml index e7a8d35d..983e0f9f 100644 --- a/.github/workflows/security-baseline.yml +++ b/.github/workflows/security-baseline.yml @@ -30,7 +30,7 @@ jobs: python -m build sha256sum dist/* > dist/SHA256SUMS cyclonedx-py environment --output-file dist/engineering-platform.cdx.json - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: engineering-platform-supply-chain-evidence path: dist/ diff --git a/.github/workflows/tde-observe.yml b/.github/workflows/tde-observe.yml index 9b1c5bfe..fb08aeb1 100644 --- a/.github/workflows/tde-observe.yml +++ b/.github/workflows/tde-observe.yml @@ -62,7 +62,7 @@ jobs: printf 'assessment_exit=%s\nqualification_exit=%s\n' "$assessment_exit" "$qualification_exit" > tde-observe/summary.txt - name: Publish TDE observe evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: tde-observe-evidence path: |