Skip to content

Pin dependencies #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
renovate wants to merge 1 commit into from
Closed

Pin dependencies #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/PullRequestClosed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
github.event.pull_request.head.repo.full_name == github.repository
steps:
- id: secrets
uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
uses: SonarSource/vault-action-wrapper@a7fa5fd4a4e4e0f2593f6137c0812cac196cf4ce # 3.7.0
with:
secrets: |
development/kv/data/jira user | JIRA_USER;
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/PullRequestCreated.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
github.event.pull_request.head.repo.full_name == github.repository
steps:
- id: secrets
uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
uses: SonarSource/vault-action-wrapper@a7fa5fd4a4e4e0f2593f6137c0812cac196cf4ce # 3.7.0
with:
secrets: |
development/github/token/{REPO_OWNER_NAME_DASH}-jira token | GITHUB_TOKEN;
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/RequestReview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
github.event.pull_request.head.repo.full_name == github.repository
steps:
- id: secrets
uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
uses: SonarSource/vault-action-wrapper@a7fa5fd4a4e4e0f2593f6137c0812cac196cf4ce # 3.7.0
with:
secrets: |
development/github/token/{REPO_OWNER_NAME_DASH}-jira token | GITHUB_TOKEN;
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/SubmitReview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
|| github.event.review.state == 'approved')
steps:
- id: secrets
uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
uses: SonarSource/vault-action-wrapper@a7fa5fd4a4e4e0f2593f6137c0812cac196cf4ce # 3.7.0
with:
secrets: |
development/github/token/{REPO_OWNER_NAME_DASH}-jira token | GITHUB_TOKEN;
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-cache-migration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
actions: write # required to list GitHub cache entries and set the opt-out repository variable

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Setup S3 cache credentials
id: aws-auth
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cleanup-cache.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
contents: read
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Cleanup cache
uses: ./cleanup
Expand Down
54 changes: 27 additions & 27 deletions .github/workflows/test-action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12
- name: Cache Python dependencies
Expand Down Expand Up @@ -49,11 +49,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12
- name: Cache Python dependencies
Expand Down Expand Up @@ -87,8 +87,8 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12
- name: Cache Go modules with fallback branch
Expand Down Expand Up @@ -133,11 +133,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -180,7 +180,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
Expand Down Expand Up @@ -214,11 +214,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -259,11 +259,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -331,11 +331,11 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -372,11 +372,11 @@ jobs:
env:
CI_METRICS_ENABLED: 'true'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand All @@ -394,7 +394,7 @@ jobs:
# This is the sequence that wiped `.actions/cache-metrics` from the workspace between main and post
# in the pre-commit job — recovery is handled by the `symlink-keeper` post step.
- name: Re-run actions/checkout (simulates nested action's checkout)
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Create something to cache
run: |
Expand All @@ -413,11 +413,11 @@ jobs:
# Opt-in to the metrics emission
CI_METRICS_ENABLED: 'true'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -470,8 +470,8 @@ jobs:
env:
CI_METRICS_ENABLED: 'true'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -521,11 +521,11 @@ jobs:
contents: read
# No CI_METRICS_ENABLED env set here — the runner pre-job hook writes the decision file.
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -585,11 +585,11 @@ jobs:
env:
CI_METRICS_ENABLED: 'false'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- uses: SonarSource/ci-github-actions/config-pip@v1
with:
disable-caching: true
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12

Expand Down Expand Up @@ -652,7 +652,7 @@ jobs:
- test-cache-metrics-workflow-false
runs-on: sonar-xs
steps:
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12
mise_toml: |
Expand Down
20 changes: 10 additions & 10 deletions .github/workflows/test-cache-migration-gh2s3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,16 +15,16 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Save GitHub cache entry (for import scenario)
run: mkdir -p ~/.cache/test-migration && echo "github-content" > ~/.cache/test-migration/test-file.txt
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
- uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.cache/test-migration
key: test-migration-gh
- name: Save GitHub cache entry (for S3-hit scenario, to confirm it is NOT restored)
run: echo "github-content" > ~/.cache/test-migration/test-file.txt
- uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
- uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: ~/.cache/test-migration
key: test-migration-s3hit
Expand All @@ -37,7 +37,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Create S3 cache content
run: mkdir -p ~/.cache/test-migration && echo "s3-content" > ~/.cache/test-migration/test-file.txt
- name: Save to S3 cache
Expand All @@ -58,7 +58,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache with migration fallback
id: cache
uses: ./
Expand All @@ -83,7 +83,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache without migration fallback
id: cache
uses: ./
Expand All @@ -109,7 +109,7 @@ jobs:
env:
CACHE_IMPORT_GITHUB: 'false'
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache without migration fallback (via env)
id: cache
uses: ./
Expand All @@ -132,7 +132,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache (S3 hit expected, import enabled)
id: cache
uses: ./
Expand Down Expand Up @@ -160,7 +160,7 @@ jobs:
id-token: write
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Cache (auto-detected backend, no backend input or CACHE_BACKEND env)
id: cache
uses: ./
Expand Down Expand Up @@ -188,7 +188,7 @@ jobs:
- test-auto-public-import-enabled
runs-on: sonar-xs
steps:
- uses: step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae # v4.0.1
- uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
with:
version: 2025.7.12
mise_toml: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-credential-isolation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
steps:
- name: Vault
id: secrets
uses: SonarSource/vault-action-wrapper@0a3114fe1230b784c35b53b099f9ab1f1e538cc7 # 3.5.0
uses: SonarSource/vault-action-wrapper@a7fa5fd4a4e4e0f2593f6137c0812cac196cf4ce # 3.7.0
with:
secrets: |
development/github/token/{REPO_OWNER_NAME_DASH}-sonar-dummy-workflows token | GITHUB_TOKEN;
Expand Down
6 changes: 3 additions & 3 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,7 @@ runs:

- name: Cache with GitHub Actions (public repos)
if: steps.cache-backend.outputs.cache-backend == 'github'
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
id: github-cache
with:
path: ${{ inputs.path }}
Expand Down Expand Up @@ -273,7 +273,7 @@ runs:
steps.s3-probe.outputs.cache-hit != 'true' &&
steps.s3-cache.outputs.cache-hit != 'true' &&
steps.cache-backend.outputs.import-github == 'true'
uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
id: github-import
with:
path: ${{ inputs.path }}
Expand Down Expand Up @@ -402,7 +402,7 @@ runs:
# and cache-metrics-post.
- name: Symlink keeper (preserve .actions/cache-metrics across nested checkouts)
if: steps.cache-metrics-prep.outputs.prepared == 'true'
uses: SonarSource/gh-action_cache/symlink-keeper@symlink-keeper-1.0.0
uses: SonarSource/gh-action_cache/symlink-keeper@a7d13cdd1c9f097a5f8382ccec463be2831e3dbc # symlink-keeper-1.0.0

@gitar-bot gitar-bot Bot Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Quality: symlink-keeper SHA pin breaks README's tag-based dev/release procedure

This PR changes the internal self-reference from @symlink-keeper-1.0.0 to @a7d13cdd… # symlink-keeper-1.0.0. The SHA is correct: it is the commit the annotated tag points to, and the sub-action contents are identical to HEAD. But the README's symlink-keeper section still says the sub-action is "referenced by version tag … (e.g. @symlink-keeper-1.0.0)" and "The tag is what callers pin to in production". Step 2 of its development procedure also tells maintainers to "Update all @symlink-keeper-* references". After this PR, searching for @symlink-keeper- finds nothing, because the version only appears in a trailing comment. A maintainer following step 2 would also swap a SHA pin for a branch ref, which Renovate would then re-pin. You could update the README to describe the @<sha> # symlink-keeper-x.y.z form, including how to point to a dev branch and re-pin after the release tag is created. Or you could exclude this self-reference from Renovate digest pinning.

Was this helpful? React with 👍 / 👎

with:
cache-metrics-action-path: ${{ format('{0}/cache-metrics', github.action_path) }}

Expand Down
Loading