Skip to content

chore(deps): bump the actions group across 1 directory with 4 updates #736

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 3 commits into
base: main
Choose a base branch
from
Open

chore(deps): bump the actions group across 1 directory with 4 updates #736

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1fb498e
chore(deps): bump the actions group across 1 directory with 4 updates
dependabot[bot] Aug 27, 2026
9d83a4c
fix(ci): regenerate actions.lock for the four bumped actions
hyperpolymath Aug 28, 2026
3f1349c
Merge branch 'main' into dependabot/github_actions/actions-e6b38edb2c
hyperpolymath Aug 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ workflows:
- 'actions/setup-node@v7.0.0'
- 'actions/upload-artifact@v7.0.1'
- 'dtolnay/rust-toolchain@master'
- 'taiki-e/install-action@v2.86.5'
- 'taiki-e/install-action@v2.86.7'
'.github/workflows/ci-health-sweep.yml':
- 'actions/checkout@v7.0.1'
'.github/workflows/ci.yml':
Expand All @@ -24,7 +24,7 @@ workflows:
- 'haskell-actions/hlint-setup@v2.4.10'
- 'haskell-actions/setup@v2.12.0'
- 'swatinem/rust-cache@v2.9.2'
- 'taiki-e/install-action@v2.86.5'
- 'taiki-e/install-action@v2.86.7'
'.github/workflows/clusterfuzzlite.yml':
- 'actions/checkout@v7.0.1'
- 'google/clusterfuzzlite@v1'
Expand Down Expand Up @@ -60,7 +60,7 @@ workflows:
- 'actions/deploy-pages@v5.0.0'
- 'actions/upload-pages-artifact@v5.0.0'
'.github/workflows/push-email-notify.yml':
- 'dawidd6/action-send-mail@v3.12.0'
- 'dawidd6/action-send-mail@v18'
'.github/workflows/quality.yml':
- 'actions/checkout@v7.0.1'
- 'actions/deploy-pages@v5.0.0'
Expand Down Expand Up @@ -98,8 +98,8 @@ workflows:
- 'github/codeql-action@v4.37.8'
- 'gitleaks/gitleaks-action@v3.0.0'
- 'returntocorp/semgrep-action@v1'
- 'taiki-e/install-action@v2.86.5'
- 'trufflesecurity/trufflehog@v3.97.0'
- 'taiki-e/install-action@v2.86.7'
- 'trufflesecurity/trufflehog@v3.97.1'
'.github/workflows/tests.yml':
- 'actions/cache@v6.1.0'
- 'actions/checkout@v7.0.1'
Expand All @@ -111,11 +111,11 @@ workflows:
- 'dtolnay/rust-toolchain@master'
- 'erlef/setup-beam@v1.24.1'
- 'swatinem/rust-cache@v2.9.2'
- 'taiki-e/install-action@v2.86.5'
- 'taiki-e/install-action@v2.86.7'
'.github/workflows/verify-proofs.yml':
- 'actions/cache@v6.1.0'
- 'actions/checkout@v7.0.1'
- 'actions/setup-java@v5.7.0'
- 'actions/setup-java@v6.0.0'
- 'actions/upload-artifact@v7.0.1'
dependencies:
'actions/attest-build-provenance@v4.2.2':
Expand Down Expand Up @@ -170,9 +170,9 @@ dependencies:
commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
owner_id: 44036562
repo_id: 205262760
'actions/setup-java@v5.7.0':
ref: 'v5.7.0'
commit: 'sha1-b6effb05e454b25005698d916606bdc6ffcbf961'
'actions/setup-java@v6.0.0':
ref: 'v6.0.0'
commit: 'sha1-dd06d9cba3e5552c54d9f8ea23572deb30010f7c'
owner_id: 44036562
repo_id: 196057608
'actions/setup-node@v7.0.0':
Expand Down Expand Up @@ -220,8 +220,8 @@ dependencies:
repo_id: 200299178
uses:
- 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
'dawidd6/action-send-mail@v3.12.0':
ref: 'v3.12.0'
'dawidd6/action-send-mail@v18':
ref: 'v18'
commit: 'sha1-94de994a9f6fffee200243214e17002e2920bb59'
owner_id: 9713907
repo_id: 222439721
Expand Down Expand Up @@ -330,13 +330,13 @@ dependencies:
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
owner_id: 580492
repo_id: 298565987
'taiki-e/install-action@v2.86.5':
ref: 'v2.86.5'
commit: 'sha1-ba47c86ac325773530516bb756137ac718732518'
'taiki-e/install-action@v2.86.7':
ref: 'v2.86.7'
commit: 'sha1-b6ff580856c41316412a0b9b60540fbc6f8c82cc'
owner_id: 43724913
repo_id: 442947557
'trufflesecurity/trufflehog@v3.97.0':
ref: 'v3.97.0'
commit: 'sha1-bcfcf73aaf4759d4dadc2783177c245a02792318'
'trufflesecurity/trufflehog@v3.97.1':
ref: 'v3.97.1'
commit: 'sha1-20652fbbdefffcdaa493a5bf57ab2ac6b1db715b'
owner_id: 79229934
repo_id: 77726177
2 changes: 1 addition & 1 deletion .github/workflows/build-gossamer-gui.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@
targets: wasm32-unknown-unknown

- name: Install just
uses: taiki-e/install-action@v2.86.5
uses: taiki-e/install-action@v2.86.7
with:
# Pin an explicit modern just: the Justfile uses `import?`
# (optional import, just >= 1.19.0). Unversioned `tool: just`
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@
components: llvm-tools-preview

- name: Install cargo-llvm-cov
uses: taiki-e/install-action@v2.86.5
uses: taiki-e/install-action@v2.86.7
with:
tool: cargo-llvm-cov

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/push-email-notify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
timeout-minutes: 5
steps:
- name: Send push notification email
uses: dawidd6/action-send-mail@v3.12.0
uses: dawidd6/action-send-mail@v18

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 HIGH RISK

This step handles sensitive SMTP secrets. To protect against credential theft via supply chain compromise, pin the action to a full 40-character commit SHA instead of the v18 tag.

See Issue in Codacy

with:
server_address: ${{ secrets.SMTP_HOST }}
server_port: ${{ secrets.SMTP_PORT }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/security-policy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
uses: actions/checkout@v7.0.1

- name: Install cargo-deny
uses: taiki-e/install-action@v2.86.5
uses: taiki-e/install-action@v2.86.7
with:
tool: cargo-deny

Expand All @@ -91,7 +91,7 @@
fetch-depth: 0

- name: TruffleHog Secret Scan
uses: trufflesecurity/trufflehog@v3.97.0
uses: trufflesecurity/trufflehog@v3.97.1

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 HIGH RISK

Pinning the secret scanner action to a commit SHA is critical. Since this tool actively scans for credentials, ensuring the code being executed is immutable prevents a scenario where a compromised action harvests the very secrets it is intended to detect.

See Issue in Codacy

with:
path: ./
base: ${{ github.event.repository.default_branch }}
Expand Down Expand Up @@ -331,7 +331,7 @@
uses: actions/checkout@v7.0.1

- name: Install cargo-deny
uses: taiki-e/install-action@v2.86.5
uses: taiki-e/install-action@v2.86.7
with:
tool: cargo-deny

Expand Down Expand Up @@ -527,7 +527,7 @@
fetch-depth: 0

- name: TruffleHog Secret Scan
uses: trufflesecurity/trufflehog@v3.97.0
uses: trufflesecurity/trufflehog@v3.97.1
with:
path: ./
base: ${{ github.event.repository.default_branch }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,7 +519,7 @@
components: llvm-tools-preview

- name: Install cargo-llvm-cov
uses: taiki-e/install-action@v2.86.5
uses: taiki-e/install-action@v2.86.7

@codacy-production codacy-production Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 HIGH RISK

Pinning third-party actions to a specific commit SHA is the only way to guarantee the action's code hasn't been tampered with after the version was released. Tags can be moved by repository owners, whereas a SHA is immutable. For a tool like install-action that fetches binaries, this ensures integrity of the build tools.

See Issue in Codacy

with:
tool: cargo-llvm-cov

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/verify-proofs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ jobs:
uses: actions/checkout@v7.0.1

- name: Set up Eclipse Temurin 21 JRE
uses: actions/setup-java@v5.7.0
uses: actions/setup-java@v6.0.0
with:
distribution: temurin
java-version: '21'
Expand Down
Loading