From b107e1814b779ac9009e45c198e3d7ed58de4555 Mon Sep 17 00:00:00 2001 From: Rex Lorenzo Date: Wed, 3 Jun 2026 17:49:57 -0700 Subject: [PATCH] chore(deps): bump actions group and pin all actions to SHA Bump the actions group (checkout 6->6.0.2, codeql-action 4.35.2->4.36.0, setup-dotnet 4->5, upload-artifact 4->7), then pin every workflow action to a full commit SHA with the version in a trailing comment. A tag is mutable and can be re-pointed at malicious code; a SHA cannot. setup-dotnet v5 and upload-artifact v7 are major bumps to the Node 24 runtime (need Actions Runner >=2.327.1, met by ubuntu-latest); no workflow-facing behavior changes for this repo. Also pins setup-node and codecov-action (untouched this round) so the whole .github/workflows tree is consistent. updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-dotnet dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/code-quality.yml | 20 ++++++++++---------- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/tests.yml | 16 ++++++++-------- 3 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml index fa64c635..ce6e0c7d 100644 --- a/.github/workflows/code-quality.yml +++ b/.github/workflows/code-quality.yml @@ -18,11 +18,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR head - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 cache: npm @@ -50,11 +50,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR head - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 cache: npm @@ -86,11 +86,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR head - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 cache: npm @@ -119,17 +119,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout PR head - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 cache: npm cache-dependency-path: package-lock.json - - uses: actions/setup-dotnet@v4 + - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 with: global-json-file: global.json @@ -149,7 +149,7 @@ jobs: - name: Upload SARIF report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: resharper-sarif path: inspect-report/inspect.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4d5caa6e..c836d4e6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,11 +40,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4.35.2 + uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: languages: ${{ matrix.language }} config-file: ./.github/codeql/codeql-config.yml @@ -52,7 +52,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v4.35.2 + uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -65,6 +65,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.35.2 + uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 97fba25c..70cec341 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -16,9 +16,9 @@ jobs: run: working-directory: VueApp steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 cache: npm @@ -37,7 +37,7 @@ jobs: - name: Upload coverage to Codecov if: ${{ !cancelled() && env.HAS_CODECOV_TOKEN == 'true' }} - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./VueApp/coverage/cobertura-coverage.xml @@ -45,7 +45,7 @@ jobs: - name: Upload test results to Codecov if: ${{ !cancelled() && env.HAS_CODECOV_TOKEN == 'true' }} - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./VueApp/test-report.junit.xml @@ -58,9 +58,9 @@ jobs: env: HAS_CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN != '' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-dotnet@v5 + - uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0 with: dotnet-version: 10.0.x @@ -73,7 +73,7 @@ jobs: - name: Upload coverage to Codecov if: ${{ !cancelled() && env.HAS_CODECOV_TOKEN == 'true' }} - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage/**/coverage.cobertura.xml @@ -81,7 +81,7 @@ jobs: - name: Upload test results to Codecov if: ${{ !cancelled() && env.HAS_CODECOV_TOKEN == 'true' }} - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./test-report.junit.xml