chore(deps): update github-actions

camunda · Jan 30, 2025 · b32bdf9 · b32bdf9
1 parent 9794469
commit b32bdf9
Show file tree

Hide file tree

Showing 21 changed files with 50 additions and 50 deletions.
diff --git a/.github/actions/generate-chart-matrix/action.yml b/.github/actions/generate-chart-matrix/action.yml
@@ -13,7 +13,7 @@ runs:
   steps:
     - name: Get changed dirs
       id: changed-files
-      uses: tj-actions/changed-files@48d8f15b2aaa3d255ca5af3eba4870f807ce6b3c # v45
+      uses: tj-actions/changed-files@d6e91a2266cdb9d62096cebf1e8546899c6aa18f # v45
       with:
         dir_names: "true"
     - name: Generate matrix

diff --git a/.github/actions/gke-login/action.yml b/.github/actions/gke-login/action.yml
@@ -22,18 +22,18 @@ runs:
   steps:
   - name: Authenticate to Google Cloud - Workload Identity
     if: ${{ inputs.auth-method == 'workload-identity' }}
-    uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2
+    uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
     with:
       token_format: 'access_token'
       workload_identity_provider: ${{ inputs.workload-identity-provider }}
       service_account: ${{ inputs.service-account }}
   - name: Authenticate to Google Cloud - Service Account Key
     if: ${{ inputs.auth-method == 'credentials-json' }}
-    uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2
+    uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
     with:
       credentials_json: '${{ inputs.credentials-json }}'
   - name: Get GKE credentials
-    uses: google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116 # v2
+    uses: google-github-actions/get-gke-credentials@9025e8f90f2d8e0c3dafc3128cc705a26d992a6a # v2
     with:
       cluster_name: ${{ inputs.cluster-name }}
       location: ${{ inputs.cluster-location }}

diff --git a/.github/workflows/chart-chores.yaml b/.github/workflows/chart-chores.yaml
@@ -50,7 +50,7 @@ jobs:
           app_id: ${{ secrets.GH_APP_ID_DISTRO_CI }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
@@ -67,7 +67,7 @@ jobs:
       - name: Add Helm repos
         run: |
           make helm.repos-add
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             ~/.cache/go-build

diff --git a/.github/workflows/chart-public-files.yaml b/.github/workflows/chart-public-files.yaml
@@ -23,10 +23,10 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: gh-pages
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: main
       - name: Copy files

diff --git a/.github/workflows/chart-release-candidate.yaml b/.github/workflows/chart-release-candidate.yaml
@@ -37,7 +37,7 @@ jobs:
           app_id: "${{ secrets.GH_APP_ID_DISTRO_CI }}"
           private_key: "${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}"
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: main
           token: "${{ steps.generate-github-token.outputs.token }}"

diff --git a/.github/workflows/chart-release-chores.yml b/.github/workflows/chart-release-chores.yml
@@ -33,7 +33,7 @@ jobs:
           app_id: ${{ secrets.GH_APP_ID_DISTRO_CI }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
@@ -49,7 +49,7 @@ jobs:
       - name: Add Helm repos
         run: |
           make helm.repos-add
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             ~/.cache/go-build

diff --git a/.github/workflows/chart-release-template.yaml b/.github/workflows/chart-release-template.yaml
@@ -71,7 +71,7 @@ jobs:
       CHART_NAME: "camunda-platform"
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.branch }}
@@ -132,7 +132,7 @@ jobs:
       # Security signature.
       - name: Install Cosign CLI
         if: env.PUBLISH_ARTIFACT == 'true'
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
       - name: Sign Helm chart with Cosign
         if: env.PUBLISH_ARTIFACT == 'true'
         run: |
@@ -154,7 +154,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Install ORAS CLI
         if: env.PUBLISH_ARTIFACT == 'true'
-        uses: oras-project/setup-oras@ca28077386065e263c03428f4ae0c09024817c93 # v1
+        uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1
       - name: Upload Helm chart Cosign bundle
         if: env.PUBLISH_ARTIFACT == 'true'
         run: |

diff --git a/.github/workflows/chart-release-update-config.yml b/.github/workflows/chart-release-update-config.yml
@@ -29,7 +29,7 @@ jobs:
           app_id: ${{ secrets.GH_APP_ID_DISTRO_CI }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           token: ${{ steps.generate-github-token.outputs.token }}

diff --git a/.github/workflows/chart-release.yaml b/.github/workflows/chart-release.yaml
@@ -48,7 +48,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
       - name: Install env dependencies
@@ -64,7 +64,7 @@ jobs:
           done
           echo "Dev comments removed:"
           git --no-pager diff
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             ~/.cache/go-build
@@ -78,7 +78,7 @@ jobs:
           git config user.name "$GITHUB_ACTOR"
           git config user.email "[email protected]"
       - name: Install Chart Releaser
-        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           install_only: true
         env:
@@ -92,7 +92,7 @@ jobs:
           chartPath="$(ct list-changed | tr '\n' ' ')" \
             make helm.dependency-update
       - name: cosign-installer
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
       - name: Tidy up
         run: |
           # Clean up badges from readme to avoid showing them in Artifact Hub.
@@ -116,7 +116,7 @@ jobs:
           rm -rf ${LATEST_CHART_VERSION_DIR}
           rm -rf charts/camunda-platform-alpha
       - name: Run Chart Releaser - Previous versions
-        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           config: .github/config/chart-releaser.yaml
         env:
@@ -133,7 +133,7 @@ jobs:
           rm -rf $(ls -d1 charts/camunda-platform-8* | head -n -1)
           rm -rf charts/camunda-platform-alpha
       - name: Run Chart Releaser - Latest version
-        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           config: .github/config/chart-releaser.yaml
         env:
@@ -190,7 +190,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           # The verification step happens in the release branch before merging into the "main" branch.
           fetch-depth: 0

diff --git a/.github/workflows/chart-validate-template.yaml b/.github/workflows/chart-validate-template.yaml
@@ -36,7 +36,7 @@ jobs:
           echo "${GITHUB_CONTEXT}"
       # Checkout.
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           ref: "${{ inputs.camunda-helm-git-ref }}"
@@ -51,7 +51,7 @@ jobs:
         run: |
           echo "check-version-increment: false" >> .github/config/chart-testing.yaml
       # Dependencies.
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: 3.8
       - name: Install dependencies
@@ -60,7 +60,7 @@ jobs:
         run: |
           make helm.repos-add
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
+        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
       - name: Get Helm dependency
         run: |
           export chartPath="charts/${{ inputs.camunda-helm-dir }}"

diff --git a/.github/workflows/prepare-chart-release-candidate.yaml b/.github/workflows/prepare-chart-release-candidate.yaml
@@ -57,7 +57,7 @@ jobs:
           app_id: ${{ secrets.GH_APP_ID_DISTRO_CI }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.inputs.releaseCandidateBranchName }}
           fetch-depth: 0

diff --git a/.github/workflows/renovate-config-check.yaml b/.github/workflows/renovate-config-check.yaml
@@ -17,7 +17,7 @@ jobs:
     name: Check renovate config 
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Validate renovate config
       uses: docker://renovate/renovate
       with:

diff --git a/.github/workflows/renovate-post-upgrade.yaml b/.github/workflows/renovate-post-upgrade.yaml
@@ -31,7 +31,7 @@ jobs:
         with:
           app_id: ${{ secrets.GH_APP_ID_DISTRO_CI }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           token: '${{ steps.generate-github-token.outputs.token }}'
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -44,7 +44,7 @@ jobs:
         run: npm install -g @bitnami/readme-generator-for-helm
       - name: Install dependencies
         uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: |
             ~/.cache/go-build

diff --git a/.github/workflows/sec-codeql.yml b/.github/workflows/sec-codeql.yml
@@ -44,11 +44,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@3c13be0632d1e2a15d39da6ede780272c022b84f
+      uses: github/codeql-action/init@0701025a8b1600e416be4f3bb5a830b1aa6af01e
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -62,7 +62,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@3c13be0632d1e2a15d39da6ede780272c022b84f
+      uses: github/codeql-action/autobuild@0701025a8b1600e416be4f3bb5a830b1aa6af01e
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -75,6 +75,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@3c13be0632d1e2a15d39da6ede780272c022b84f
+      uses: github/codeql-action/analyze@0701025a8b1600e416be4f3bb5a830b1aa6af01e
       with:
         category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/sec-scorecard.yml b/.github/workflows/sec-scorecard.yml
@@ -55,14 +55,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
+        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test-integration-cleanup-template.yaml b/.github/workflows/test-integration-cleanup-template.yaml
@@ -54,7 +54,7 @@ jobs:
         - distro:
             if: false
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         # This is needed to load repo GH composite actions if the workflow triggered by workflow_call.
         repository: camunda/camunda-platform-helm

diff --git a/.github/workflows/test-integration-rosa-cleanup.yml b/.github/workflows/test-integration-rosa-cleanup.yml
@@ -27,13 +27,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.head_ref }}
           fetch-depth: 0
 
       - name: Checkout Repository rosa modules
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: "camunda/camunda-tf-rosa"
           ref: "main"

diff --git a/.github/workflows/test-integration-rosa-template.yaml b/.github/workflows/test-integration-rosa-template.yaml
@@ -65,7 +65,7 @@ jobs:
     outputs:
       platform-matrix: ${{ steps.matrix.outputs.platform-matrix }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
@@ -101,7 +101,7 @@ jobs:
         distro: ${{ fromJson(needs.clusters-info.outputs.platform-matrix).distro }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
@@ -112,7 +112,7 @@ jobs:
           aws configure set aws_access_key_id ${{ secrets.DISTRO_CI_AWS_ACCESS_KEY }} --profile=${{ secrets.DISTRO_CI_AWS_PROFILE }}
 
       - name: Create ROSA cluster and login
-        uses: camunda/camunda-tf-rosa/.github/actions/rosa-create-cluster@d0471d28cb3eb13cd2212b63cc8e50d457d829c4 # main
+        uses: camunda/camunda-tf-rosa/.github/actions/rosa-create-cluster@1d0758bbd701572d120cdd6e392e9beaaef5d853 # main
         timeout-minutes: 125
         env:
           AWS_PROFILE: ${{ secrets.DISTRO_CI_AWS_PROFILE }}
@@ -135,7 +135,7 @@ jobs:
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY_DISTRO_CI }}
 
       - name: Clone the distribution GitOps repo
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: "camunda/distribution"
           ref: "main"
@@ -281,7 +281,7 @@ jobs:
           aws configure set aws_access_key_id ${{ secrets.DISTRO_CI_AWS_ACCESS_KEY }} --profile=${{ secrets.DISTRO_CI_AWS_PROFILE }}
 
       - name: Delete on-demand ROSA HCP Cluster
-        uses: camunda/camunda-tf-rosa/.github/actions/rosa-delete-cluster@d0471d28cb3eb13cd2212b63cc8e50d457d829c4 # main
+        uses: camunda/camunda-tf-rosa/.github/actions/rosa-delete-cluster@1d0758bbd701572d120cdd6e392e9beaaef5d853 # main
         if: always()
         timeout-minutes: 125
         env:

diff --git a/.github/workflows/test-integration-template.yaml b/.github/workflows/test-integration-template.yaml
@@ -115,7 +115,7 @@ jobs:
     outputs:
       matrix: ${{ steps.generate-workflow-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           # This is needed if the workflow is triggered by workflow_call.
           repository: camunda/camunda-platform-helm
@@ -165,7 +165,7 @@ jobs:
           echo "${GITHUB_CONTEXT}" | jq '."extra-values" = "<Check below>"'
           echo "Workflow Inputs - Extra Values:"
           echo "${GITHUB_CONTEXT}" | jq -r '."extra-values"'
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           # This is needed to load repo GH composite actions if the workflow triggered by workflow_call.
           repository: camunda/camunda-platform-helm
@@ -174,7 +174,7 @@ jobs:
       # and populate environment variables from Vault
       - name: Import Vault secrets
         id: secrets
-        uses: hashicorp/vault-action@d1720f055e0635fd932a1d2a48f87a666a57906c # v3.0.0
+        uses: hashicorp/vault-action@a1b77a09293a4366e48a5067a86692ac6e94fdc0 # v3.1.0
         if: inputs.vault-secret-mapping != ''
         with:
           url: ${{ secrets.VAULT_ADDR }}