diff --git a/.github/workflows/ci-non-linux.yml b/.github/workflows/ci-non-linux.yml index a432b83df..ccf8a4d28 100644 --- a/.github/workflows/ci-non-linux.yml +++ b/.github/workflows/ci-non-linux.yml @@ -36,8 +36,8 @@ jobs: - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: cache-targets: "false" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Build and archive tests run: cargo nextest archive --config-file .github/nextest.toml --workspace --features full --lib --bins --archive-file nextest-archive.tar.zst env: @@ -72,7 +72,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ inputs.ref || github.ref }} - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Download test archive uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6e41ba9cc..979fb5f3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -209,8 +209,8 @@ jobs: with: cache-targets: "false" shared-key: "ci" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Build and archive tests run: cargo nextest archive --config-file .github/nextest.toml --cargo-profile ci --workspace --features "desktop,ide,server,chat,pdf,scheduler,registry,deep-link" --lib --bins --tests --archive-file nextest-archive.tar.zst - name: Upload test archive @@ -251,8 +251,8 @@ jobs: with: cache-targets: "false" shared-key: "ci" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Build and archive zeph-db postgres integration tests run: cargo nextest archive --config-file .github/nextest.toml --cargo-profile ci -p zeph-db --no-default-features --features test-utils --tests --archive-file nextest-archive-zeph-db-postgres.tar.zst - name: Upload zeph-db postgres test archive @@ -312,7 +312,7 @@ jobs: partition: ["1/8", "2/8", "3/8", "4/8", "5/8", "6/8", "7/8", "8/8"] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Download test archive uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: @@ -375,8 +375,8 @@ jobs: run_args: "-E 'binary(postgres_integration)'" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest - - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -470,9 +470,9 @@ jobs: with: cache-targets: "false" shared-key: "coverage" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 - - uses: taiki-e/install-action@ea361d59ff285fa3ab7cc40dcba421e91017d586 # cargo-llvm-cov - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 + - uses: taiki-e/install-action@eba66cc6f87204a1e73f96e528e759b6c1fcf573 # cargo-llvm-cov + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest - name: Generate coverage run: cargo llvm-cov nextest --config-file .github/nextest.toml --cargo-profile ci --workspace --features full --lib --bins --lcov --output-path lcov.info - name: Upload coverage @@ -524,7 +524,7 @@ jobs: exit-code: '1' limit-severities-for-sarif: true - name: Upload Trivy results to GitHub Security tab - uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4 + uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4 with: sarif_file: trivy-results.sarif @@ -574,7 +574,7 @@ jobs: with: cache-targets: "false" shared-key: "release-build" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: cargo build (release, --all-targets) # `cargo check --release` does not reproduce the release-profile query-depth overflow # class of bug fixed by #5407/#5408 (verified empirically: it passes even without the @@ -601,7 +601,7 @@ jobs: with: cache-targets: "false" shared-key: "release-build-full" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 - name: cargo build (release, --all-targets, full) # Best-effort candle/ml coverage under the release profile, mirroring the # bundle-check `ml` matrix leg (#5418): step-level continue-on-error keeps diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9073ac5dc..f467cc03a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Initialize CodeQL - uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4 + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4 with: languages: ${{ matrix.language }} queries: security-and-quality @@ -41,6 +41,6 @@ jobs: run: cargo build --workspace - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4 + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/openai-integration.yml b/.github/workflows/openai-integration.yml index ab572d29e..64ae38916 100644 --- a/.github/workflows/openai-integration.yml +++ b/.github/workflows/openai-integration.yml @@ -49,7 +49,7 @@ jobs: - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable if: steps.secrets-check.outputs.skip == 'false' - - uses: taiki-e/install-action@37ba67210166984a515120020147f0b4ae3b8667 # nextest + - uses: taiki-e/install-action@4f74fa8a3d358e568049b7b1a7fbb4fceabda454 # nextest if: steps.secrets-check.outputs.skip == 'false' - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 @@ -58,7 +58,7 @@ jobs: cache-targets: "false" shared-key: "openai-integration" - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 if: steps.secrets-check.outputs.skip == 'false' - name: Run OpenAI ignored tests diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 45da1397f..49630fb8e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -59,9 +59,9 @@ jobs: - name: Install musl-tools (Linux native musl builds) if: "!matrix.use_cross && runner.os == 'Linux'" run: sudo apt-get install -y musl-tools - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 if: "!matrix.use_cross" - - uses: taiki-e/install-action@3ec0c1fda8222edd5d4b0561887df0dfc7c53bd8 # cross + - uses: taiki-e/install-action@c968d1ff37748a72063b02e0b07b039cef90e5f6 # cross - name: Build binary (cross) if: matrix.use_cross run: cross build --release --features full --target ${{ matrix.target }} @@ -240,7 +240,7 @@ jobs: ls -lh binaries/ - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.repository_owner }} diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index b92c512f7..923d48783 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: - node-version: "24.18.0" + node-version: "24.18.1" - name: Validate Renovate config run: | @@ -56,7 +56,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: renovatebot/github-action@22e0a16091fc706b04affe6ae53d5e3358ac4023 # v46.1.19 + - uses: renovatebot/github-action@973d3e5a68e735a444e8c03432b66eedb343c302 # v46.2.0 env: RENOVATE_REPOSITORIES: ${{ github.repository }} LOG_LEVEL: ${{ inputs.logLevel || 'info' }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 69584fc1a..9953d40df 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -20,7 +20,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: taiki-e/install-action@af8167eefce493c60337887d7b96ffbc22df840c # cargo-deny + - uses: taiki-e/install-action@f1d783a3a0ed7012c43e2889fbe3519390e9025b # cargo-deny - name: Check advisories and licenses run: cargo deny --config .github/deny.toml check env: diff --git a/.github/workflows/telegram-e2e.yml b/.github/workflows/telegram-e2e.yml index c741a3390..0088e58a5 100644 --- a/.github/workflows/telegram-e2e.yml +++ b/.github/workflows/telegram-e2e.yml @@ -89,7 +89,7 @@ jobs: # sccache caches per-crate compilation results in GHA cache. # telegram-e2e uses --profile ci (same as CI lint/build jobs) so sccache # entries built by CI are reused here, making reruns nearly instant. - - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10 + - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11 if: steps.secrets-check.outputs.skip == 'false' - name: Set up Python