diff --git a/.github/workflows/affine-vscode-publish.yml b/.github/workflows/affine-vscode-publish.yml index 02f6a5b..805ceeb 100644 --- a/.github/workflows/affine-vscode-publish.yml +++ b/.github/workflows/affine-vscode-publish.yml @@ -33,7 +33,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify tag matches package version working-directory: packages/affine-vscode run: | diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index d84b090..23bfa84 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -49,9 +49,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout casket-ssg - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: hyperpolymath/casket-ssg path: .casket-ssg diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5d060f9..7194683 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full history so the soundness-ledger gate (property 4) can resolve # :ground-truth-sha: and diff soundness paths against it. A shallow @@ -117,7 +117,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml) run: | sudo apt-get update @@ -146,7 +146,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml) run: | sudo apt-get update @@ -196,7 +196,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up OCaml toolchain (self-hosted; replaces ocaml/setup-ocaml) run: | sudo apt-get update @@ -256,7 +256,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4 with: @@ -301,7 +301,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v4 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c9bd644..caa517f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,7 +35,7 @@ jobs: build-mode: none steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: diff --git a/.github/workflows/governance-baseline-impl.yml b/.github/workflows/governance-baseline-impl.yml index 08724d2..79bcf2d 100644 --- a/.github/workflows/governance-baseline-impl.yml +++ b/.github/workflows/governance-baseline-impl.yml @@ -25,7 +25,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Validate .hypatia-baseline.json (if present) run: | set -euo pipefail diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 08369b8..89f5534 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -26,7 +26,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Fetch base ref (DOC-FORMAT delta) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml old mode 100755 new mode 100644 index 2697b6e..513f8e1 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -19,9 +19,9 @@ jobs: image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff steps: - name: Checkout Site - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Checkout Ddraig SSG - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: hyperpolymath/ddraig-ssg path: .ddraig-ssg @@ -38,7 +38,7 @@ jobs: fi ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/} - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 with: path: '_site' deploy: @@ -51,4 +51,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/panic-attack.yml b/.github/workflows/panic-attack.yml index 93c595d..4badd46 100644 --- a/.github/workflows/panic-attack.yml +++ b/.github/workflows/panic-attack.yml @@ -31,7 +31,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install Rust toolchain (stable) diff --git a/.github/workflows/publish-jsr.yml b/.github/workflows/publish-jsr.yml index d791839..9f39b08 100644 --- a/.github/workflows/publish-jsr.yml +++ b/.github/workflows/publish-jsr.yml @@ -39,7 +39,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: denoland/setup-deno@v2 with: deno-version: v2.x diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 19a41ab..26932c3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create the release as a draft (idempotent) # Immutable releases (enabled on this repo) forbid adding assets to a # *published* release — the v0.2.0 build legs hit "HTTP 422: Cannot @@ -70,9 +70,9 @@ jobs: timeout-minutes: 10 steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up OCaml - uses: ocaml/setup-ocaml@e32b06a3e831ff2fbc6f08cf35be2085e3918014 # v3 + uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3 with: ocaml-compiler: "5.1" - name: Install dependencies diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 241c4a1..026c763 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -27,7 +27,7 @@ jobs: id-token: write steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run analysis diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index bf9cee3..9d2a6e0 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -24,6 +24,6 @@ jobs: timeout-minutes: 5 steps: - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run standalone secret scan run: ./tools/ci/secret-scan-standalone.sh diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 59f68d2..b5b80f6 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -24,7 +24,7 @@ jobs: container: image: semgrep/semgrep steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Semgrep run: semgrep scan --sarif --output=semgrep.sarif --config=auto . env: diff --git a/.github/workflows/stdlib-naming.yml b/.github/workflows/stdlib-naming.yml index 17fb0af..919bc26 100644 --- a/.github/workflows/stdlib-naming.yml +++ b/.github/workflows/stdlib-naming.yml @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Enforce lowercase .affine filenames in stdlib/ run: | BAD=$(find stdlib -maxdepth 1 -type f -name '*.affine' | grep -E '/stdlib/[A-Z]' || true) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 646e0c6..6e8f625 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check SPDX headers run: | errors=0