From d90b82b06b7ccbedd23622f7eda4908f55e7cc0d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 15:31:33 +0000 Subject: [PATCH] [DEPS] bump the github-actions group across 1 directory with 12 updates Bumps the github-actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6` | `7` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.1.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.2` | `4.0.3` | | [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `3.0.2` | `3.0.5` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.6.0` | `10.3.3` | | [actions/cache](https://github.com/actions/cache) | `5` | `6` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.7.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | | [docker/bake-action](https://github.com/docker/bake-action) | `7.3.0` | `7.5.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` | | [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.1` | `4.0.0` | Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) Updates `actions/setup-python` from 6.3.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...6d4fd22b20465ccc0f7354476588e8df7c9ca0e0) Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d) Updates `marocchino/sticky-pull-request-comment` from 3.0.2 to 3.0.5 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/70d2764d1a7d5d9560b100cbea0077fc8f633987...5770ad5eb8f42dd2c4f34da00c94c5381e49af88) Updates `astral-sh/setup-uv` from 7.6.0 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/37802adc94f370d6bfd71619e3f0bf239e1f3b78...68559e99cc807c1eb7e9238fd43a15bba460eec2) Updates `actions/cache` from 5 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v5...v6) Updates `actions/upload-artifact` from 4.6.2 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...v7.0.2) Updates `docker/login-action` from 4.4.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v4.4.0...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v4.2.0...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/bake-action` from 7.3.0 to 7.5.0 - [Release notes](https://github.com/docker/bake-action/releases) - [Commits](https://github.com/docker/bake-action/compare/v7.3.0...59cb1203cd42bcefd40a1b6d73b589e48c86040e) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) Updates `slackapi/slack-github-action` from 3.0.1 to 4.0.0 - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/slackapi/slack-github-action/compare/af78098f536edbc4de71162a307590698245be95...dcb1066f776dd043e64d0e8ba94ca15cc7e1875d) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/bake-action dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: slackapi/slack-github-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/backport.yaml | 6 +-- .github/workflows/ci-frontend-lint.yaml | 12 ++--- .github/workflows/ci-test.yaml | 46 +++++++++---------- .../workflows/docker-tools-build-push.yaml | 2 +- .github/workflows/lint-pr.yaml | 2 +- .github/workflows/production-build.yaml | 8 ++-- .github/workflows/release-branch-ci.yaml | 4 +- .github/workflows/release-branch-only.yaml | 4 +- .github/workflows/release-notification.yaml | 2 +- .github/workflows/state.yaml | 4 +- .github/workflows/uv-lock-automation.yaml | 4 +- 11 files changed, 47 insertions(+), 47 deletions(-) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index 8e7aacf0f6..cad25b441a 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -60,7 +60,7 @@ jobs: client-id: ${{ vars.PUSH_TO_MAIN_APP_CLIENT_ID }} private-key: ${{ secrets.PUSH_TO_MAIN_APP_PRIVATE_KEY }} - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 token: ${{ steps.bot.outputs.token }} @@ -69,7 +69,7 @@ jobs: # A late push run checks out its event sha as origin/main; rescan the real tip instead. run: git fetch origin +refs/heads/main:refs/remotes/origin/main - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" # relstate uses dt.UTC (3.11+) @@ -110,7 +110,7 @@ jobs: client-id: ${{ vars.PUSH_TO_MAIN_APP_CLIENT_ID }} private-key: ${{ secrets.PUSH_TO_MAIN_APP_PRIVATE_KEY }} - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: main fetch-depth: 0 # the decline reads the pick from the head and the base's history diff --git a/.github/workflows/ci-frontend-lint.yaml b/.github/workflows/ci-frontend-lint.yaml index 9cb464f306..f0ae869a41 100644 --- a/.github/workflows/ci-frontend-lint.yaml +++ b/.github/workflows/ci-frontend-lint.yaml @@ -35,13 +35,13 @@ jobs: frontend: ${{ github.event_name != 'pull_request' || steps.filter.outputs.frontend == 'true' }} steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check for frontend changes if: github.event_name == 'pull_request' - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: filter with: filters: | @@ -59,7 +59,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false @@ -96,7 +96,7 @@ jobs: fi - name: Render lint report to PR - uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 if: always() && hashFiles('frontend/biome-report.md') != '' && github.event.pull_request.head.repo.fork == false with: header: frontend-lint-results @@ -120,7 +120,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false @@ -171,7 +171,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/ci-test.yaml b/.github/workflows/ci-test.yaml index c6ea4f117b..fc78fe8896 100644 --- a/.github/workflows/ci-test.yaml +++ b/.github/workflows/ci-test.yaml @@ -47,13 +47,13 @@ jobs: release: ${{ github.event_name != 'pull_request' || steps.release_filter.outputs.release == 'true' }} steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Check for changes outside ignored paths if: github.event_name == 'pull_request' - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: filter with: # `every`: a file counts as relevant only if it matches ALL the @@ -77,7 +77,7 @@ jobs: # A separate step: `every` above would need one file to match all release paths at once. - name: Check for release tooling changes if: github.event_name == 'pull_request' - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: release_filter with: predicate-quantifier: some @@ -104,20 +104,20 @@ jobs: tier: [unit, integration] steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # rig --changed-only needs git history persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.6.14" python-version: 3.12.9 enable-cache: true - name: Cache tox environments - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: .tox/ # Tier in the key: legs build different tox envs, and parallel saves @@ -170,7 +170,7 @@ jobs: - name: Upload tier reports artifact if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: reports-${{ matrix.tier }} path: reports/ @@ -193,7 +193,7 @@ jobs: UNSTRACT_TEST_VERSION: ${{ github.sha }} steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -204,20 +204,20 @@ jobs: # Dependabot triggers (they get only Dependabot secrets, none set), so # both pull anonymously and can hit Docker Hub's rate limit. if: (github.event.pull_request == null || github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]' - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.6.14" python-version: 3.12.9 enable-cache: true - name: Cache tox environments - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: .tox/ key: ${{ runner.os }}-tox-uv-e2e-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }} @@ -242,14 +242,14 @@ jobs: run: ./run-platform.sh -e - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 # Bake instead of `compose build` so each ephemeral runner restores layers # from the GHA cache the release workflow also writes (matching per-service # scopes), instead of building cold every run. `load` exports the images # into the daemon so the compose stack can boot them. - name: Build service images - uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0 + uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0 with: files: ./docker/docker-compose.build.yaml load: true @@ -290,7 +290,7 @@ jobs: - name: Upload e2e reports artifact if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: reports-e2e path: reports/ @@ -304,7 +304,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false @@ -332,19 +332,19 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: "0.6.14" python-version: 3.12.9 enable-cache: true - name: Cache tox environments - uses: actions/cache@v5 + uses: actions/cache@v6 with: path: .tox/ key: ${{ runner.os }}-tox-uv-rig-${{ hashFiles('**/pyproject.toml', '**/tox.ini') }} @@ -364,7 +364,7 @@ jobs: - name: Restore main-branch test baseline (for regression detection) # One unified baseline across all tiers; this job is its sole # reader+writer. Restore-only here, save below on green main. - uses: actions/cache/restore@v5 + uses: actions/cache/restore@v6 with: path: reports/previous-summary.json key: unstract-test-baseline-main-${{ github.run_id }} @@ -372,7 +372,7 @@ jobs: unstract-test-baseline-main- - name: Download tier reports - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: pattern: reports-* path: reports/ @@ -395,7 +395,7 @@ jobs: # actions/cache saves only on a miss; the run id keys each main build a # fresh entry, and restore-keys' prefix pulls the latest next run. if: github.ref == 'refs/heads/main' - uses: actions/cache/save@v5 + uses: actions/cache/save@v6 with: path: reports/previous-summary.json key: unstract-test-baseline-main-${{ github.run_id }} @@ -403,7 +403,7 @@ jobs: - name: Render combined test report to PR # Dependabot runs get a read-only GITHUB_TOKEN, so the comment would be # refused; skip it there like forks. The job summary still carries it. - uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2 + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 if: always() && hashFiles('reports/combined-test-report.md') != '' && github.event.pull_request.head.repo.fork == false && github.actor != 'dependabot[bot]' with: header: test-results @@ -417,7 +417,7 @@ jobs: - name: Upload combined reports artifact if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-reports path: reports/ diff --git a/.github/workflows/docker-tools-build-push.yaml b/.github/workflows/docker-tools-build-push.yaml index 3e186978e3..f0e294b4e6 100644 --- a/.github/workflows/docker-tools-build-push.yaml +++ b/.github/workflows/docker-tools-build-push.yaml @@ -37,7 +37,7 @@ jobs: run: echo "${{ toJSON(github.event.inputs) }}" - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/lint-pr.yaml b/.github/workflows/lint-pr.yaml index 88988ba70d..77c232b688 100644 --- a/.github/workflows/lint-pr.yaml +++ b/.github/workflows/lint-pr.yaml @@ -18,7 +18,7 @@ jobs: timeout-minutes: 20 steps: # Rule read from main, so a PR cannot weaken relmgr; it can still edit this workflow. - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: main sparse-checkout: .github/release diff --git a/.github/workflows/production-build.yaml b/.github/workflows/production-build.yaml index 63d8429365..06d34e939a 100644 --- a/.github/workflows/production-build.yaml +++ b/.github/workflows/production-build.yaml @@ -114,14 +114,14 @@ jobs: steps: - name: Checkout code for release if: github.event_name == 'release' - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ github.event.release.tag_name }} persist-credentials: false - name: Checkout code for branch if: github.event_name != 'release' - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: persist-credentials: false @@ -207,7 +207,7 @@ jobs: # Upload status for summary job - name: Upload build status if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v7.0.2 with: name: build-status-${{ matrix.service_name }} path: build-status/${{ matrix.service_name }}.json @@ -360,7 +360,7 @@ jobs: # Send summary notification to Slack - name: Send Slack summary notification if: always() - uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: webhook-type: incoming-webhook payload: | diff --git a/.github/workflows/release-branch-ci.yaml b/.github/workflows/release-branch-ci.yaml index c36e2282c2..6b1ac49061 100644 --- a/.github/workflows/release-branch-ci.yaml +++ b/.github/workflows/release-branch-ci.yaml @@ -22,14 +22,14 @@ jobs: env: BRANCH: ${{ github.base_ref || github.ref_name }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 persist-credentials: false # Classifier read from main, so a PR cannot weaken relmgr. - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: main path: .relmgr diff --git a/.github/workflows/release-branch-only.yaml b/.github/workflows/release-branch-only.yaml index 6c4d1b8b98..9f1c55dd46 100644 --- a/.github/workflows/release-branch-only.yaml +++ b/.github/workflows/release-branch-only.yaml @@ -40,13 +40,13 @@ jobs: esac # The head's tip SHA, so a push to the head after the label makes the bot push fail, not skip a check. - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 # every branch, so origin/ is current persist-credentials: false - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: main path: .relmgr diff --git a/.github/workflows/release-notification.yaml b/.github/workflows/release-notification.yaml index cf5d23882b..b4d8014884 100644 --- a/.github/workflows/release-notification.yaml +++ b/.github/workflows/release-notification.yaml @@ -13,7 +13,7 @@ jobs: steps: - name: Send Slack notification - uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1 + uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 with: webhook-type: incoming-webhook payload: | diff --git a/.github/workflows/state.yaml b/.github/workflows/state.yaml index 141edc103b..0b0e1fda57 100644 --- a/.github/workflows/state.yaml +++ b/.github/workflows/state.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -25,7 +25,7 @@ jobs: python3 .github/release/relstate.py > state.json cat state.json - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@v7.0.2 with: name: relstate path: state.json diff --git a/.github/workflows/uv-lock-automation.yaml b/.github/workflows/uv-lock-automation.yaml index 38756b9765..d0351fba63 100644 --- a/.github/workflows/uv-lock-automation.yaml +++ b/.github/workflows/uv-lock-automation.yaml @@ -33,12 +33,12 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: ${{ github.head_ref }} - name: Install uv - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: # Install a specific version of uv. version: "0.6.14"