From 6117697197d9339c0c2a3277a5a1ff1db847cd9b Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 20:24:17 +0000 Subject: [PATCH] chore(deps): update github-actions --- .github/actions/ai-pr-review/action.yml | 4 ++-- .github/actions/comment-triggered-check/action.yml | 2 +- .github/actions/govulncheck/action.yml | 2 +- .github/actions/prerelease-setup/action.yml | 2 +- .github/actions/secret-broker-request/action.yml | 2 +- .github/workflows/actionlint.yaml | 2 +- .github/workflows/claude-code-review.yaml | 2 +- .github/workflows/claude.yaml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/test-linear-cve-summary.yaml | 2 +- .github/workflows/test-release-notification.yaml | 2 +- .github/workflows/test-release-summary.yaml | 2 +- .github/workflows/test-secret-broker-request.yaml | 2 +- .github/workflows/test-secret-broker-response.yaml | 2 +- 14 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/actions/ai-pr-review/action.yml b/.github/actions/ai-pr-review/action.yml index abbdc33c..6c5fbedf 100644 --- a/.github/actions/ai-pr-review/action.yml +++ b/.github/actions/ai-pr-review/action.yml @@ -95,7 +95,7 @@ runs: - name: Claude PR review if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'anthropic' - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1.0.233 + uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1.0.251 with: anthropic_api_key: ${{ inputs.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret github_token: ${{ inputs.github-token }} @@ -144,7 +144,7 @@ runs: - name: Codex PR review id: codex if: steps.cfg.outputs.proceed == 'true' && inputs.provider == 'openai' - uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.12 + uses: openai/codex-action@bdf19a4a223ec2549a3e2274a0cf61556bc07675 # v1.13 with: openai-api-key: ${{ inputs.openai-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via composite input, not a repo secret model: ${{ steps.cfg.outputs.model }} diff --git a/.github/actions/comment-triggered-check/action.yml b/.github/actions/comment-triggered-check/action.yml index 8cf0daf2..da2f9e58 100644 --- a/.github/actions/comment-triggered-check/action.yml +++ b/.github/actions/comment-triggered-check/action.yml @@ -176,7 +176,7 @@ runs: id: app-token if: inputs.app-client-id != '' && inputs.app-private-key != '' continue-on-error: true - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: client-id: ${{ inputs.app-client-id }} private-key: ${{ inputs.app-private-key }} diff --git a/.github/actions/govulncheck/action.yml b/.github/actions/govulncheck/action.yml index 7c391af5..2e52b282 100644 --- a/.github/actions/govulncheck/action.yml +++ b/.github/actions/govulncheck/action.yml @@ -88,7 +88,7 @@ runs: steps.govulncheck.conclusion == 'failure' && inputs.notify == 'true' && github.event_name == 'schedule' - uses: loft-sh/github-actions/.github/actions/ci-test-notify@c6a76f19cc302d63d1631853496bce5bf76a4e0a # ci-test-notify/v1 + uses: loft-sh/github-actions/.github/actions/ci-test-notify@d15a1df8ea70c58cf70343f7c3687a6014ed63f8 # ci-test-notify/v1 with: test-name: ${{ inputs.test-name }} status: failure diff --git a/.github/actions/prerelease-setup/action.yml b/.github/actions/prerelease-setup/action.yml index f585ca17..b5cda3a9 100644 --- a/.github/actions/prerelease-setup/action.yml +++ b/.github/actions/prerelease-setup/action.yml @@ -62,7 +62,7 @@ runs: cache: true - name: Setup kubectl - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0 + uses: azure/setup-kubectl@bda439f5f36b99b262ebdcd3613869bddb064c8e # v5.2.0 - name: Setup helm uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 diff --git a/.github/actions/secret-broker-request/action.yml b/.github/actions/secret-broker-request/action.yml index 70a481ea..06c2ca37 100644 --- a/.github/actions/secret-broker-request/action.yml +++ b/.github/actions/secret-broker-request/action.yml @@ -29,7 +29,7 @@ runs: - name: Create organization membership token id: app-token if: ${{ inputs.authorization == '' }} - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3 with: client-id: ${{ inputs.app-client-id }} private-key: ${{ inputs.app-private-key }} diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml index 5a73459a..554a9ef2 100644 --- a/.github/workflows/actionlint.yaml +++ b/.github/workflows/actionlint.yaml @@ -35,7 +35,7 @@ jobs: - name: Run actionlint with reviewdog if: steps.changed-files.outputs.workflows == 'true' - uses: reviewdog/action-actionlint@2085657ab2c7f48c58edcc767fba576f63bea76b # v1.77.0 + uses: reviewdog/action-actionlint@3cbf14efd750961dba35fccbf00f9e14028cb1f5 # v1.80.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} reporter: ${{ inputs.reporter }} diff --git a/.github/workflows/claude-code-review.yaml b/.github/workflows/claude-code-review.yaml index 4d36d772..688e257b 100644 --- a/.github/workflows/claude-code-review.yaml +++ b/.github/workflows/claude-code-review.yaml @@ -54,7 +54,7 @@ jobs: git checkout -B "${PR_HEAD_REF}" "origin/${PR_HEAD_REF}" - name: Claude Code Review - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml index 05e65675..c53d78f9 100644 --- a/.github/workflows/claude.yaml +++ b/.github/workflows/claude.yaml @@ -27,6 +27,6 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1 with: anthropic_api_key: ${{ secrets.anthropic-api-key }} # zizmor: ignore[secrets-outside-env] -- API key passed via workflow_call, not a repo secret diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index dd066809..7125b960 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -33,7 +33,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@8cf3482550831fb35a4fc3fbf7ca139cf8028b4c # v1 + uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env] -- OAuth token for Claude, no dedicated environment needed diff --git a/.github/workflows/test-linear-cve-summary.yaml b/.github/workflows/test-linear-cve-summary.yaml index 8add01d5..717777fa 100644 --- a/.github/workflows/test-linear-cve-summary.yaml +++ b/.github/workflows/test-linear-cve-summary.yaml @@ -18,7 +18,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run Linear CVE summary tests run: uv run --with pytest==8.3.3 pytest .github/actions/linear-cve-summary/test/ -q - name: Start fake Linear server diff --git a/.github/workflows/test-release-notification.yaml b/.github/workflows/test-release-notification.yaml index a3039ad8..c083d9ae 100644 --- a/.github/workflows/test-release-notification.yaml +++ b/.github/workflows/test-release-notification.yaml @@ -22,7 +22,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run release-notification pytest run: uv run --with pytest==8.3.3 pytest .github/actions/release-notification/test/ -q diff --git a/.github/workflows/test-release-summary.yaml b/.github/workflows/test-release-summary.yaml index 362356e4..880a421f 100644 --- a/.github/workflows/test-release-summary.yaml +++ b/.github/workflows/test-release-summary.yaml @@ -22,7 +22,7 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run release-summary pytest run: uv run --with pytest==8.3.3 pytest .github/actions/release-summary/test/ -q diff --git a/.github/workflows/test-secret-broker-request.yaml b/.github/workflows/test-secret-broker-request.yaml index 438a1da2..ca044c63 100644 --- a/.github/workflows/test-secret-broker-request.yaml +++ b/.github/workflows/test-secret-broker-request.yaml @@ -18,6 +18,6 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run secret broker request tests run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-request/test/ -q diff --git a/.github/workflows/test-secret-broker-response.yaml b/.github/workflows/test-secret-broker-response.yaml index 72952f96..199329c2 100644 --- a/.github/workflows/test-secret-broker-response.yaml +++ b/.github/workflows/test-secret-broker-response.yaml @@ -18,6 +18,6 @@ jobs: with: persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Run secret broker response tests run: uv run --with pytest==8.3.3 pytest .github/actions/secret-broker-response/test/ -q