From e6add3fc1039d6ff348e5448045e0a5d5eac94df Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 21:54:03 +0000
Subject: [PATCH] Bump the actions group across 1 directory with 3 updates

Bumps the actions group with 3 updates in the /slsa_with_provenance directory: [actions/checkout](https://github.com/actions/checkout), [carabiner-dev/actions/go/versions](https://github.com/carabiner-dev/actions) and [carabiner-dev/actions/ampel/verify](https://github.com/carabiner-dev/actions).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `carabiner-dev/actions/go/versions` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/carabiner-dev/actions/releases)
- [Commits](https://github.com/carabiner-dev/actions/compare/94f29392187fe5082d1195a7d4cae3a7ddf09d9c...2a4b2cd115ede14629b03ef7e77586d3269d4c72)

Updates `carabiner-dev/actions/ampel/verify` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/carabiner-dev/actions/releases)
- [Commits](https://github.com/carabiner-dev/actions/compare/94f29392187fe5082d1195a7d4cae3a7ddf09d9c...2a4b2cd115ede14629b03ef7e77586d3269d4c72)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: carabiner-dev/actions/go/versions
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: carabiner-dev/actions/ampel/verify
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 slsa_with_provenance/action.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/slsa_with_provenance/action.yml b/slsa_with_provenance/action.yml
index 6731ef0..19fe42a 100644
--- a/slsa_with_provenance/action.yml
+++ b/slsa_with_provenance/action.yml
@@ -33,9 +33,9 @@ runs:
       shell: bash
 
     # This needs to persis its credentials to store the attestations
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       id: checkout_sourcetool_code
       if: inputs.build-from-source == 'true'
       with:
@@ -47,7 +47,7 @@ runs:
 
     - id: go_versions
       if: inputs.build-from-source == 'true'
-      uses: carabiner-dev/actions/go/versions@94f29392187fe5082d1195a7d4cae3a7ddf09d9c # v1.2.1
+      uses: carabiner-dev/actions/go/versions@2a4b2cd115ede14629b03ef7e77586d3269d4c72 # v1.2.3
       with:
         go-mod-path: ${{ github.workspace }}/.bin/build/go.mod
 
@@ -90,7 +90,7 @@ runs:
 
     - id: verify_binary
       if: inputs.build-from-source == 'false'
-      uses: carabiner-dev/actions/ampel/verify@94f29392187fe5082d1195a7d4cae3a7ddf09d9c # v1.2.1
+      uses: carabiner-dev/actions/ampel/verify@2a4b2cd115ede14629b03ef7e77586d3269d4c72 # v1.2.3
       env:
         # This is the SLSA builder ID we will verify before running the sourcetool binary
         AMPEL_BUILDERID: "https://github.com/slsa-framework/source-tool/.github/workflows/release.yaml"