diff --git a/.github/workflows/architecture-guardian.yml b/.github/workflows/architecture-guardian.yml index 7689dc0d..4b49a6fd 100644 --- a/.github/workflows/architecture-guardian.yml +++ b/.github/workflows/architecture-guardian.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/cga-attestation.yml b/.github/workflows/cga-attestation.yml index 5b3846ac..5d3adf49 100644 --- a/.github/workflows/cga-attestation.yml +++ b/.github/workflows/cga-attestation.yml @@ -54,7 +54,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # full history needed for git_stats during indexing persist-credentials: false @@ -169,7 +169,7 @@ jobs: contents: read id-token: write # required only for keyless OIDC signing steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/dogfood.yml b/.github/workflows/dogfood.yml index 6e689fda..d33ca44e 100644 --- a/.github/workflows/dogfood.yml +++ b/.github/workflows/dogfood.yml @@ -45,7 +45,7 @@ jobs: pull-requests: write # post the sticky PR comment steps: - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 50 # enough for pr-prep churn analysis persist-credentials: false diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4356f465..d6fbbf35 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -141,7 +141,7 @@ jobs: artifact_digest: ${{ steps.upload_bundle.outputs.artifact-digest }} manifest_sha256: ${{ steps.release_manifest.outputs.sha256 }} steps: - - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false @@ -326,7 +326,7 @@ jobs: artifact_digest: ${{ steps.upload_subset.outputs.artifact-digest }} steps: - name: Check out the resolved recovery helper - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false @@ -684,7 +684,7 @@ jobs: id-token: write # obtain the keyless Fulcio certificate for cosign steps: - name: Check out the resolved verifier lock - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false @@ -1382,7 +1382,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 30 steps: - - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: ${{ needs.resolve-ref.outputs.sha }} persist-credentials: false diff --git a/.github/workflows/roam-ci.yml b/.github/workflows/roam-ci.yml index 86ec0c66..11e0390e 100644 --- a/.github/workflows/roam-ci.yml +++ b/.github/workflows/roam-ci.yml @@ -59,7 +59,7 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # full history needed for git-stats and pr-risk tests persist-credentials: false @@ -106,7 +106,7 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -165,7 +165,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false @@ -203,7 +203,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -245,7 +245,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # for the test that uses git ls-files persist-credentials: false @@ -304,7 +304,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -389,7 +389,7 @@ jobs: pull-requests: write # sticky PR comment from the local action security-events: write # SARIF upload from the local action steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # full history required for pr-risk and git analysis persist-credentials: false diff --git a/.github/workflows/roam.yml b/.github/workflows/roam.yml index 0be72617..337ad29f 100644 --- a/.github/workflows/roam.yml +++ b/.github/workflows/roam.yml @@ -38,7 +38,7 @@ jobs: pull-requests: write # post the configured PR comment security-events: write # upload configured SARIF to Code Scanning steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 # Full history needed for pr-risk and git analysis persist-credentials: false diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 2ecdcb2b..f7b674a5 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 persist-credentials: false