From a2b25e681e18fa67214fc6fdf7e8a0226b4d02f7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 07:15:23 +0000 Subject: [PATCH] ci(deps): bump the actions-minor-patch group with 7 updates Bumps the actions-minor-patch group with 7 updates: | Package | From | To | | --- | --- | --- | | [jdx/mise-action](https://github.com/jdx/mise-action) | `5.1.1` | `5.1.2` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | Updates `jdx/mise-action` from 5.1.1 to 5.1.2 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca...08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8) Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) --- updated-dependencies: - dependency-name: jdx/mise-action dependency-version: 5.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/check.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/docs.yml | 2 +- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/publish.yml | 18 +++++++++--------- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 6 +++--- .github/workflows/security.yml | 6 +++--- 8 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 9e0d72d..84a08b6 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its @@ -73,7 +73,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 07a49d0..5610022 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -53,7 +53,7 @@ jobs: with: persist-credentials: false - - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: # One language: every line of first-party source in this workspace is Python. languages: python @@ -88,6 +88,6 @@ jobs: - ".sarif/**" - ".sbom/**" - - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: /language:python diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 72dce47..d8971ac 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -51,7 +51,7 @@ jobs: persist-credentials: false fetch-depth: 0 - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 2c38f4a..9578ee3 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -47,7 +47,7 @@ jobs: persist-credentials: false # `cache: false`, for the reason security.yml gives: a cached tool directory is a tool # nobody verified, and a cached pipx shebang can point at an interpreter the cache lacks. - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its @@ -64,7 +64,7 @@ jobs: UV_LOCKED: "1" # Only on failure: the inputs that crashed, timed out or ran out of memory, and each # target's whole libFuzzer log, so a finding reproduces from the run that found it. - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: failure() with: name: fuzz-findings diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 36f95d4..e649382 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -89,7 +89,7 @@ jobs: # pull-request run write one the default branch can read, so a release build that # restored a cache would let a fork's run choose bytes that get signed and published. # This job pays the full cold-resolve instead, once per release. - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its @@ -253,7 +253,7 @@ jobs: fi "$bin/atif-sql" schema > /dev/null - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dist path: dist/ @@ -270,7 +270,7 @@ jobs: RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }} run: RELEASE_VERSION="${RELEASE_TAG#v}" mise run release:assets - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-assets path: release/ @@ -293,7 +293,7 @@ jobs: id-token: write # request the Sigstore signing certificate for this workflow's identity attestations: write # store the attestations in the repository's attestation API steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-assets path: release @@ -324,7 +324,7 @@ jobs: jq -c . "$PROVENANCE" "$SBOM" > "attestations/atif_sql-$VERSION.intoto.jsonl" wc -l "attestations/atif_sql-$VERSION.intoto.jsonl" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: attestations path: attestations/ @@ -348,11 +348,11 @@ jobs: permissions: contents: write # upload assets to the existing release steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-assets path: release - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: attestations path: release @@ -467,7 +467,7 @@ jobs: mkdir dist cp "release/atif_sql-$version-py3-none-any.whl" "release/atif_sql-$version.tar.gz" dist/ - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dist path: dist/ @@ -537,7 +537,7 @@ jobs: # publish and the attestation are tied to one identity. id-token: write # exchanged with PyPI for a 15-minute publishing macaroon, and signs the attestations steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: dist path: dist diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a759f3d..c2455c0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -99,7 +99,7 @@ jobs: persist-credentials: true ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }} - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5b8bc3f..b48375d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,7 +61,7 @@ jobs: with: persist-credentials: false - - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: results_file: results.sarif results_format: sarif @@ -71,7 +71,7 @@ jobs: # normalises them; this is the document Scorecard actually emitted, which is what a # score dispute is settled from. Short retention because the next weekly run supersedes # it — unlike the 90-day SBOM in security.yml, nothing answers a CVE question from here. - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: scorecard-sarif @@ -85,7 +85,7 @@ jobs: # `category: scorecard` keeps these alerts in their own analysis set. Without it this # upload and security.yml's would overwrite each other's results for the same ref, # because code scanning keys an analysis on (ref, category). - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif category: scorecard diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 04922b5..88d108e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -68,7 +68,7 @@ jobs: # The SARIF verification in `mise run security` caught it, which is the whole point of # failing on a missing report rather than on findings. Paying a cold install per run is # cheaper than a tier that can report success for a scan that never executed. - - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: # `minimum_release_age` because a mise release exists on GitHub before its assets finish # uploading: the 2026-09-08 scheduled security run asked for the just-cut v2026.9.3, its @@ -84,7 +84,7 @@ jobs: GH_TOKEN: ${{ github.token }} # One upload for the whole directory — each SARIF names its own tool, so code scanning # separates them without a step per scanner. - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 if: always() with: sarif_file: .sarif @@ -93,7 +93,7 @@ jobs: # (what a downstream consumer's tooling is more likely to ingest). 90 days matches the # advisory-response window this exists to serve: when a CVE drops, "did we ship that?" # is answered from here without a rebuild. - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: sbom