From afeae003de382e62cdd7ff45de4b0070dcba2c12 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 13:49:22 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions group across 1 directory with 6 updates Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.3.2` | `9.0.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` | Updates `astral-sh/setup-uv` from 8.3.2 to 9.0.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9) Updates `github/codeql-action/init` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/autobuild` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/public-codeql.yml | 10 +++++----- .github/workflows/public-scorecard-json.yml | 2 +- .github/workflows/public-scorecard.yml | 4 ++-- .github/workflows/python-ci.yml | 2 +- .github/workflows/semgrep-ci.yml | 2 +- .github/workflows/sql-ci.yml | 2 +- .github/workflows/zizmor-no-sarif.yml | 2 +- .github/workflows/zizmor-sarif.yml | 4 ++-- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 23a2dff..e2eb17c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -53,7 +53,7 @@ jobs: with: python-version: "3.13" - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: 0.11.30 - name: Install validator dependencies diff --git a/.github/workflows/public-codeql.yml b/.github/workflows/public-codeql.yml index 7867981..ad34b11 100644 --- a/.github/workflows/public-codeql.yml +++ b/.github/workflows/public-codeql.yml @@ -78,31 +78,31 @@ jobs: - name: Initialize CodeQL if: ${{ inputs.config_file == '' }} - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} queries: ${{ inputs.queries }} - name: Initialize CodeQL with config if: ${{ inputs.config_file != '' }} - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} config-file: ${{ inputs.config_file }} - name: Autobuild if: ${{ inputs.autobuild }} - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 - name: Analyze if: ${{ inputs.output_directory == '' }} - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{ matrix.language }}" - name: Analyze with output directory if: ${{ inputs.output_directory != '' }} - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{ matrix.language }}" output: ${{ inputs.output_directory }} diff --git a/.github/workflows/public-scorecard-json.yml b/.github/workflows/public-scorecard-json.yml index b65708f..00189c0 100644 --- a/.github/workflows/public-scorecard-json.yml +++ b/.github/workflows/public-scorecard-json.yml @@ -49,7 +49,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.json results_format: json diff --git a/.github/workflows/public-scorecard.yml b/.github/workflows/public-scorecard.yml index ff041cc..e066fd8 100644 --- a/.github/workflows/public-scorecard.yml +++ b/.github/workflows/public-scorecard.yml @@ -39,7 +39,7 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif @@ -53,6 +53,6 @@ jobs: retention-days: 5 - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: results.sarif diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index 06faa58..750cd09 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -55,7 +55,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: ${{ inputs.uv_version }} enable-cache: true diff --git a/.github/workflows/semgrep-ci.yml b/.github/workflows/semgrep-ci.yml index d62aebe..54704d3 100644 --- a/.github/workflows/semgrep-ci.yml +++ b/.github/workflows/semgrep-ci.yml @@ -51,7 +51,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: 0.11.30 diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml index 274967e..c5233ce 100644 --- a/.github/workflows/sql-ci.yml +++ b/.github/workflows/sql-ci.yml @@ -59,7 +59,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: 0.11.30 diff --git a/.github/workflows/zizmor-no-sarif.yml b/.github/workflows/zizmor-no-sarif.yml index 3a8cf78..155582f 100644 --- a/.github/workflows/zizmor-no-sarif.yml +++ b/.github/workflows/zizmor-no-sarif.yml @@ -47,7 +47,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: 0.11.30 diff --git a/.github/workflows/zizmor-sarif.yml b/.github/workflows/zizmor-sarif.yml index 9a5cf6b..7e845f0 100644 --- a/.github/workflows/zizmor-sarif.yml +++ b/.github/workflows/zizmor-sarif.yml @@ -54,7 +54,7 @@ jobs: persist-credentials: false - name: Set up uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 with: version: 0.11.30 @@ -76,7 +76,7 @@ jobs: "${ZIZMOR_TARGET}" > zizmor.sarif - name: Upload SARIF to code scanning - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: zizmor.sarif category: zizmor From 0a67385e9f30f31701cd2a96ca41e5f1bbd5db6b Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Sat, 1 Aug 2026 18:54:56 +0500 Subject: [PATCH 2/2] chore(catalog): sync tool pins with the grouped action bump Dependabot rewrites the uses: pins inside the workflows but knows nothing about catalog/tools.yml, so validate_catalog fails on every grouped bump until the catalog is synced by hand. Syncs the two that drifted: scorecard-action 4eaacf05 -> 2d114668 v2.4.3 -> v2.4.4 setup-uv 11f9893b -> c771a70e v8.3.2 -> v9.0.0 setup-uv crosses a major boundary (v8 -> v9); the static-validators job runs through ci.yml, which uses it, so a green run here is the compatibility evidence rather than an assumption. --- catalog/tools.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/catalog/tools.yml b/catalog/tools.yml index 77f0ae4..a1b1f37 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -98,8 +98,8 @@ tools: name: ossf/scorecard-action homepage: "https://github.com/ossf/scorecard-action" kind: action - current_version: "v2.4.3" - pin: "ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a" + current_version: "v2.4.4" + pin: "ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc" used_by: - .github/workflows/public-scorecard.yml - .github/workflows/public-scorecard-json.yml @@ -403,8 +403,8 @@ tools: name: astral-sh/setup-uv homepage: "https://github.com/astral-sh/setup-uv" kind: action - current_version: "v8.3.2" - pin: "astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990" + current_version: "v9.0.0" + pin: "astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9" used_by: - .github/workflows/ci.yml - .github/workflows/python-ci.yml