From dec4bee4345b2eb261a167b81ccbd9afba56feff Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:17 +0000 Subject: [PATCH 01/13] Pinning workflow .github/workflows/build_and_test.yml --- .github/workflows/build_and_test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml index 0f87078..8d97982 100644 --- a/.github/workflows/build_and_test.yml +++ b/.github/workflows/build_and_test.yml @@ -28,11 +28,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: 'recursive' - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: java-version: '17' distribution: 'temurin' From 6567740146295987a78e1845a925d3f33629e667 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:18 +0000 Subject: [PATCH 02/13] Pinning workflow .github/workflows/build_deploy.yml --- .github/workflows/build_deploy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build_deploy.yml b/.github/workflows/build_deploy.yml index 4b733ac..33249ab 100644 --- a/.github/workflows/build_deploy.yml +++ b/.github/workflows/build_deploy.yml @@ -25,12 +25,12 @@ jobs: contents: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: 'recursive' - name: Set up Apache Maven Central - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: # configure settings.xml distribution: 'temurin' java-version: '17' From 409ead969546ec371074a6d97e239a3ca73cab7b Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:20 +0000 Subject: [PATCH 03/13] Pinning workflow .github/workflows/codeql.yml --- .github/workflows/codeql.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a6ebf0b..f184283 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,13 +46,13 @@ jobs: build-mode: autobuild steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: 'recursive' # Setup java 17. - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: java-version: '17' distribution: 'temurin' @@ -60,12 +60,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1 with: category: "/language:${{matrix.language}}" From fc27d3b2f3e7af2b630c75769c387a3725b01567 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:21 +0000 Subject: [PATCH 04/13] Pinning workflow .github/workflows/coverage.yml --- .github/workflows/coverage.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index d90c556..30492f8 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -34,7 +34,7 @@ jobs: run: sudo apt-get update && sudo apt-get install -y libxml2-utils - name: Set up Java with Maven - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: # configure settings.xml distribution: 'temurin' java-version: '17' @@ -70,7 +70,7 @@ jobs: path: target/site/jacoco - name: Generate coverage comment - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const fs = require('fs'); From 4bc49e2f0e8991472f61a50f06671afebd4d893c Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:22 +0000 Subject: [PATCH 05/13] Pinning workflow .github/workflows/latest-up-spec-compatibility.yaml --- .github/workflows/latest-up-spec-compatibility.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/latest-up-spec-compatibility.yaml b/.github/workflows/latest-up-spec-compatibility.yaml index 90f5ef8..561abb0 100644 --- a/.github/workflows/latest-up-spec-compatibility.yaml +++ b/.github/workflows/latest-up-spec-compatibility.yaml @@ -35,7 +35,7 @@ jobs: requirements-tracing: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: "recursive" - name: Fast-Forward to HEAD revision of uProtocol Spec main branch @@ -49,7 +49,7 @@ jobs: cd "${{ github.workspace }}" - name: "Determine OpenFastTrace file patterns from .env file" - uses: xom9ikk/dotenv@v2.3.0 + uses: xom9ikk/dotenv@ac290ca23a42155a0cba1031d23afa46240116a9 # v2.3.0 with: mode: "oft-latest" load-mode: strict From b35633f4d8c4dea23322c3488d1970fb9eb7d73f Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:23 +0000 Subject: [PATCH 06/13] Pinning workflow .github/workflows/lint.yml --- .github/workflows/lint.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 3a5e7e4..a62a600 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,12 +26,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: 'recursive' - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: java-version: '17' distribution: 'temurin' @@ -47,17 +47,17 @@ jobs: # check links contained in markdown and source code files runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: "recursive" - name: Restore lychee cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: .lycheecache key: cache-lychee-${{ github.sha }} restore-keys: cache-lychee- - name: Run lychee - uses: lycheeverse/lychee-action@v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: "--cache --max-cache-age 1d --verbose --no-progress --exclude-path './target/' --exclude-path './up-spec/' -- './**/*.md' './**/*.java'" From 0254d0e05ed3d7ccc00268d592565cc625e1801e Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 10:15:25 +0000 Subject: [PATCH 07/13] Pinning workflow .github/workflows/release.yml --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 87d52e1..e88a02c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,13 +30,13 @@ jobs: git config --global user.name 'eclipse-uprotocol-bot' git config --global user.email 'uprotocol-bot@eclipse.org' - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: submodules: 'recursive' token: ${{ secrets.BOT_GITHUB_TOKEN }} - name: Set up Apache Maven Central - uses: actions/setup-java@v4 + uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 with: # configure settings.xml distribution: 'temurin' java-version: '17' From 7f4646af8ea7281e615d0a80d06ccdad299a29d8 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:15 +0000 Subject: [PATCH 08/13] Pinning workflow .github/workflows/build_and_test.yml --- .github/workflows/build_and_test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml index 8d97982..9e09c46 100644 --- a/.github/workflows/build_and_test.yml +++ b/.github/workflows/build_and_test.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: 'recursive' - name: Set up JDK 17 From ffda92183c8beee7226fa2f6732f66731aaa6fe4 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:16 +0000 Subject: [PATCH 09/13] Pinning workflow .github/workflows/build_deploy.yml --- .github/workflows/build_deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_deploy.yml b/.github/workflows/build_deploy.yml index 33249ab..8aa5ccc 100644 --- a/.github/workflows/build_deploy.yml +++ b/.github/workflows/build_deploy.yml @@ -25,7 +25,7 @@ jobs: contents: write steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: 'recursive' From 743da68fc1c18e3a6b481d6080604236a46991f5 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:17 +0000 Subject: [PATCH 10/13] Pinning workflow .github/workflows/codeql.yml --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f184283..75f78d6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,7 +46,7 @@ jobs: build-mode: autobuild steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: 'recursive' @@ -60,12 +60,12 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1 + uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1 + uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3.37.3 with: category: "/language:${{matrix.language}}" From e755b7936688fbf680e51d48b768a287286920d1 Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:19 +0000 Subject: [PATCH 11/13] Pinning workflow .github/workflows/latest-up-spec-compatibility.yaml --- .github/workflows/latest-up-spec-compatibility.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/latest-up-spec-compatibility.yaml b/.github/workflows/latest-up-spec-compatibility.yaml index 561abb0..1f92b56 100644 --- a/.github/workflows/latest-up-spec-compatibility.yaml +++ b/.github/workflows/latest-up-spec-compatibility.yaml @@ -35,7 +35,7 @@ jobs: requirements-tracing: runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" - name: Fast-Forward to HEAD revision of uProtocol Spec main branch From 37cd898b41c65d0a364c479456ccc0487d61798e Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:20 +0000 Subject: [PATCH 12/13] Pinning workflow .github/workflows/lint.yml --- .github/workflows/lint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index a62a600..d1f1104 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: 'recursive' @@ -47,7 +47,7 @@ jobs: # check links contained in markdown and source code files runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: "recursive" - name: Restore lychee cache @@ -58,6 +58,6 @@ jobs: restore-keys: cache-lychee- - name: Run lychee - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 with: args: "--cache --max-cache-age 1d --verbose --no-progress --exclude-path './target/' --exclude-path './up-spec/' -- './**/*.md' './**/*.java'" From 4546e2ebee2bf7bcf9bf48c9a0bfb2c84703168f Mon Sep 17 00:00:00 2001 From: "eclipse-otterdog[bot]" <158182605+eclipse-otterdog[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 15:20:21 +0000 Subject: [PATCH 13/13] Pinning workflow .github/workflows/release.yml --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e88a02c..5b5b58d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,7 +30,7 @@ jobs: git config --global user.name 'eclipse-uprotocol-bot' git config --global user.email 'uprotocol-bot@eclipse.org' - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: submodules: 'recursive' token: ${{ secrets.BOT_GITHUB_TOKEN }}