From 5dd68a94b8c8d8080de05dd831fe9bce9215c313 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 18 Oct 2022 06:55:11 +0000 Subject: [PATCH] chore(deps): update github-actions --- .github/actions/checkout-go/action.yml | 2 +- .github/actions/checkout-node/action.yml | 4 ++-- .github/actions/generate-builder/action.yml | 4 ++-- .github/actions/secure-checkout/action.yaml | 2 +- .../secure-download-artifact/action.yml | 2 +- .../actions/secure-upload-artifact/action.yml | 2 +- .github/workflows/builder_go_slsa3.yml | 24 +++++++++---------- .github/workflows/builder_node_slsa3.yml | 20 ++++++++-------- .github/workflows/codeql-analysis.yml | 8 +++---- .../workflows/generator_container_slsa3.yml | 8 +++---- .github/workflows/generator_generic_slsa3.yml | 8 +++---- .github/workflows/pre-submit.actions.yml | 10 ++++---- .github/workflows/pre-submit.base-images.yml | 4 ++-- .../pre-submit.e2e.generic.default.yml | 2 +- ...-submit.e2e.go.config-ldflags-main-dir.yml | 2 +- .github/workflows/pre-submit.lint.yml | 8 +++---- .github/workflows/pre-submit.units.yml | 6 ++--- .github/workflows/scorecards.yml | 4 ++-- 18 files changed, 60 insertions(+), 60 deletions(-) diff --git a/.github/actions/checkout-go/action.yml b/.github/actions/checkout-go/action.yml index b2cadd6b6a..44b890312b 100644 --- a/.github/actions/checkout-go/action.yml +++ b/.github/actions/checkout-go/action.yml @@ -23,7 +23,7 @@ runs: using: "composite" steps: - name: Checkout the repository with user SHA - uses: slsa-framework/slsa-github-generator/.github/actions/secure-checkout@ea457948e6a989e9818304dcb4f15fb4ce6765d6 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-checkout@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: ${{ inputs.repository }} ref: ${{ inputs.ref }} diff --git a/.github/actions/checkout-node/action.yml b/.github/actions/checkout-node/action.yml index 9de01d2eb1..2fff8b0b7e 100644 --- a/.github/actions/checkout-node/action.yml +++ b/.github/actions/checkout-node/action.yml @@ -23,13 +23,13 @@ runs: using: "composite" steps: - name: Checkout the repository with user ref - uses: slsa-framework/slsa-github-generator/.github/actions/secure-checkout@ea457948e6a989e9818304dcb4f15fb4ce6765d6 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-checkout@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: ${{ inputs.repository }} ref: ${{ inputs.ref }} token: ${{ inputs.token }} - name: Set up Node environment - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93 # tag=v3.4.1 + uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3.5.1 with: node-version: ${{ inputs.node-version }} diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index 4caea83669..f99642445c 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -34,7 +34,7 @@ runs: using: "composite" steps: - name: Checkout the Go builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@c2e7da4c53f2703d9af77f8d1483078c8fd3477e + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: ${{ inputs.repository }} ref: ${{ inputs.ref }} @@ -62,7 +62,7 @@ runs: run: ./.github/actions/generate-builder/generate-builder.sh - name: Compute sha256 of builder - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 id: compute with: path: "${{ inputs.binary }}" diff --git a/.github/actions/secure-checkout/action.yaml b/.github/actions/secure-checkout/action.yaml index 5b355697ff..4b21fdddba 100644 --- a/.github/actions/secure-checkout/action.yaml +++ b/.github/actions/secure-checkout/action.yaml @@ -50,7 +50,7 @@ runs: echo "::set-output name=sha::$sha" - name: Checkout the repository - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 with: fetch-depth: 1 ref: ${{ inputs.ref }} diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index 090fd18291..c80c469050 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -36,7 +36,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index 907f3e25dd..d45a24cebe 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -18,7 +18,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: path: "${{ inputs.path }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index 182719e899..c84d47dec8 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -74,7 +74,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -86,7 +86,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 detect-env: outputs: @@ -98,7 +98,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd # tag=v1.2.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@dc705baf82c5178c9d1555594b0652f569e22779 # tag=v1.2.1 ################################################################### # # @@ -113,7 +113,7 @@ jobs: steps: - name: Generate builder id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@325c27afeab313babb4ab9265fa123957da01ac2 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -146,12 +146,12 @@ jobs: needs: [privacy-check, builder, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@c2e7da4c53f2703d9af77f8d1483078c8fd3477e + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -183,12 +183,12 @@ jobs: needs: [privacy-check, builder, build-dry, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@c2e7da4c53f2703d9af77f8d1483078c8fd3477e + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -232,7 +232,7 @@ jobs: - name: Upload generated binary id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" @@ -254,7 +254,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -305,14 +305,14 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download binary - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" sha256: "${{ needs.build.outputs.go-binary-sha256 }}" - name: Download provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.provenance.outputs.go-provenance-name }}" path: "${{ needs.provenance.outputs.go-provenance-name }}" diff --git a/.github/workflows/builder_node_slsa3.yml b/.github/workflows/builder_node_slsa3.yml index 3058e17c5c..49a119b503 100644 --- a/.github/workflows/builder_node_slsa3.yml +++ b/.github/workflows/builder_node_slsa3.yml @@ -133,7 +133,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -145,7 +145,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 detect-env: outputs: @@ -157,7 +157,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd # tag=v1.2.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@dc705baf82c5178c9d1555594b0652f569e22779 # tag=v1.2.1 ################################################################### # # @@ -172,7 +172,7 @@ jobs: steps: - name: Generate builder id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@325c27afeab313babb4ab9265fa123957da01ac2 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -213,7 +213,7 @@ jobs: cache: 'npm' - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -269,7 +269,7 @@ jobs: - name: Upload generated tarball id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ steps.tarball.outputs.filename }}" path: "${{ steps.tarball.outputs.filename }}" @@ -291,7 +291,7 @@ jobs: node-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -350,21 +350,21 @@ jobs: registry-url: ${{ inputs.registry-url }} - name: Download binary - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.build.outputs.node-tarball-name }}" path: "${{ needs.build.outputs.node-tarball-name }}" sha256: "${{ needs.build.outputs.node-tarball-sha256 }}" - name: Download provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.provenance.outputs.node-provenance-name }}" path: "${{ needs.provenance.outputs.node-provenance-name }}" sha256: "${{ needs.provenance.outputs.node-provenance-sha256 }}" - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b996462c4e..59de454de9 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -40,11 +40,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/init@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2.1.27 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -57,7 +57,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/autobuild@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2.1.27 # Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -70,4 +70,4 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/analyze@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2.1.27 diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index 95801d486c..761249d8e7 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -54,7 +54,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -71,7 +71,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -91,7 +91,7 @@ jobs: packages: write # Needed to login and upload attestations to ghcr.io. steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@325c27afeab313babb4ab9265fa123957da01ac2 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -101,7 +101,7 @@ jobs: # NOTE: We are using the generic generator. directory: "${{ env.BUILDER_DIR }}" - - uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # tag=v2.6.0 + - uses: sigstore/cosign-installer@7cc35d7fdbe70d4278a0c96779081e6fac665f88 # tag=v2.8.0 - name: Login env: UNTRUSTED_IMAGE: "${{ inputs.image }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index f1938fc78d..1504867532 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -68,7 +68,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -85,7 +85,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -108,7 +108,7 @@ jobs: actions: read # Needed to read workflow info. steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@325c27afeab313babb4ab9265fa123957da01ac2 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -169,7 +169,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download the provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@2d3d2df4e65ea8ef1ac5e9e13ea7dea87db3b315 with: name: "${{ needs.generator.outputs.provenance-name }}" path: "${{ needs.generator.outputs.provenance-name }}" diff --git a/.github/workflows/pre-submit.actions.yml b/.github/workflows/pre-submit.actions.yml index 86d2f0e7a6..1bb9eb3ffa 100644 --- a/.github/workflows/pre-submit.actions.yml +++ b/.github/workflows/pre-submit.actions.yml @@ -12,7 +12,7 @@ jobs: name: verify no checkout in Actions runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - run: ./.github/workflows/scripts/pre-submit.actions/checkout.sh check-dist-matrix: @@ -21,10 +21,10 @@ jobs: matrix: action: [compute-sha256, privacy-check] steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - name: Set Node.js 16 - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93 # tag=v3.4.1 + uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3.5.1 with: node-version: 16 @@ -66,7 +66,7 @@ jobs: compute-sha256: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - run: | echo "foo" > artifact - id: compute-sha256 @@ -81,7 +81,7 @@ jobs: rng: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - run: | echo "foo" > artifact - id: rng diff --git a/.github/workflows/pre-submit.base-images.yml b/.github/workflows/pre-submit.base-images.yml index 23bc4fa98c..664ea35340 100644 --- a/.github/workflows/pre-submit.base-images.yml +++ b/.github/workflows/pre-submit.base-images.yml @@ -13,8 +13,8 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - name: install cosign - uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # tag=v2.6.0 + uses: sigstore/cosign-installer@7cc35d7fdbe70d4278a0c96779081e6fac665f88 # tag=v2.8.0 - name: verify images run: ./.github/workflows/scripts/verify-base-images.sh diff --git a/.github/workflows/pre-submit.e2e.generic.default.yml b/.github/workflows/pre-submit.e2e.generic.default.yml index 82e28d87a8..c0f2a46742 100644 --- a/.github/workflows/pre-submit.e2e.generic.default.yml +++ b/.github/workflows/pre-submit.e2e.generic.default.yml @@ -31,7 +31,7 @@ jobs: needs: [build] if: ${{ always() }} steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3.0.0 with: name: ${{ needs.build.outputs.provenance-name }} diff --git a/.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml b/.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml index e27a575b62..4f3a5db27f 100644 --- a/.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml +++ b/.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml @@ -48,7 +48,7 @@ jobs: needs: [build] if: ${{ always() }} steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3.0.0 with: name: ${{ needs.build.outputs.go-binary-name }} diff --git a/.github/workflows/pre-submit.lint.yml b/.github/workflows/pre-submit.lint.yml index cd211739cb..31c8bfaa81 100644 --- a/.github/workflows/pre-submit.lint.yml +++ b/.github/workflows/pre-submit.lint.yml @@ -10,7 +10,7 @@ jobs: golangci-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # tag=v3.3.0 with: go-version: "1.18" @@ -34,7 +34,7 @@ jobs: shellcheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - env: SHELLCHECK_VERSION: "0.8.0" run: | @@ -51,7 +51,7 @@ jobs: yamllint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - env: YAMLLINT_VERSION: "1.26.3" run: | @@ -66,7 +66,7 @@ jobs: eslint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - uses: actions/setup-node@v3 with: node-version: 16 diff --git a/.github/workflows/pre-submit.units.yml b/.github/workflows/pre-submit.units.yml index a0e7c9f136..3ffb067f6c 100644 --- a/.github/workflows/pre-submit.units.yml +++ b/.github/workflows/pre-submit.units.yml @@ -20,7 +20,7 @@ jobs: if: ${{ always() }} steps: - name: Checkout - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 - name: setup-go uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # tag=v3.3.0 with: @@ -37,12 +37,12 @@ jobs: if: ${{ always() }} steps: - name: Checkout - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2.4.2 + uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # tag=v2.5.0 with: path: generator - name: Checkout - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e # tag=v2.4.2 + uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # tag=v2.5.0 with: path: verifier repository: slsa-framework/slsa-verifier diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index a6f350f33a..61958207ed 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -25,7 +25,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 + uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 with: persist-credentials: false @@ -57,6 +57,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/upload-sarif@807578363a7869ca324a79039e6db9c843e0e100 # tag=v2.1.27 with: sarif_file: results.sarif