From b17f5dfb07fe1f826ca764b37699ef938c4fa28d Mon Sep 17 00:00:00 2001 From: cjimti Date: Tue, 21 Jul 2026 10:28:27 -0700 Subject: [PATCH] ci: roll up open Dependabot action bumps (#35) Land the five open Dependabot GitHub Action bumps as a single change so the overlapping PRs (two touching codeql.yml, two touching release.yml) do not rebase against each other and burn five CI runs for one mechanical change. - github/codeql-action/init v4.36.2 -> v4.37.0 - github/codeql-action/analyze v4.36.2 -> v4.37.0 - github/codeql-action/upload-sarif v4.36.2 -> v4.37.0 - docker/setup-qemu-action v4.1.0 -> v4.2.0 - docker/login-action v4.2.0 -> v4.4.0 Every SHA was resolved against the upstream repository and matches the commit its tag points at (the codeql-action tag is annotated and was dereferenced). All refs remain pinned to full 40-character SHAs, so validate-action-shas.sh still passes. Supersedes #34, #33, #32, #31, #29. Closes #35 --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 01ac398d..431f5325 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: cache: true - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: languages: go @@ -38,6 +38,6 @@ jobs: run: go build ./... - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: category: "/language:go" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab0bce52..78f9d497 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,13 +34,13 @@ jobs: go mod verify - name: Set up QEMU - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1fd9bfb8..1de45d64 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -38,6 +38,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3 with: sarif_file: results.sarif