From aa06d68ca6ee277273cb52ce3a265cd230cc37c5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 23:36:01 -0700 Subject: [PATCH] Bump the actions group with 6 updates (#11305) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build-and-push-bskyweb-aws.yaml | 2 +- .github/workflows/build-and-push-bskyweb-ghcr.yaml | 2 +- .github/workflows/build-and-push-embedr-aws.yaml | 2 +- .github/workflows/build-and-push-link-aws.yaml | 2 +- .github/workflows/build-and-push-ogcard-aws.yaml | 2 +- .github/workflows/build-submit-android.yml | 8 ++++---- .github/workflows/build-submit-ios.yml | 4 ++-- .github/workflows/bundle-deploy-eas-update.yml | 4 ++-- .github/workflows/claude-mention.yml | 4 ++-- .github/workflows/claude-review.yml | 4 ++-- .github/workflows/golang-test-lint.yml | 4 ++-- .github/workflows/lint.yml | 4 ++-- .github/workflows/nightly-build.yml | 2 +- .github/workflows/nightly-e2e.yml | 10 +++++----- .github/workflows/nightly-update-source-languages.yaml | 4 ++-- .github/workflows/pull-request-commit.yml | 10 +++++----- .github/workflows/sync-internal.yaml | 2 +- .github/workflows/verify-pnpm-lock.yml | 2 +- .github/workflows/zizmor.yml | 4 ++-- 19 files changed, 38 insertions(+), 38 deletions(-) diff --git a/.github/workflows/build-and-push-bskyweb-aws.yaml b/.github/workflows/build-and-push-bskyweb-aws.yaml index a7801f2d90..f6d7949825 100644 --- a/.github/workflows/build-and-push-bskyweb-aws.yaml +++ b/.github/workflows/build-and-push-bskyweb-aws.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Setup Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 diff --git a/.github/workflows/build-and-push-bskyweb-ghcr.yaml b/.github/workflows/build-and-push-bskyweb-ghcr.yaml index 4f33c1839e..15e1da8a59 100644 --- a/.github/workflows/build-and-push-bskyweb-ghcr.yaml +++ b/.github/workflows/build-and-push-bskyweb-ghcr.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Setup Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 diff --git a/.github/workflows/build-and-push-embedr-aws.yaml b/.github/workflows/build-and-push-embedr-aws.yaml index 05d5133158..5b7193cf4e 100644 --- a/.github/workflows/build-and-push-embedr-aws.yaml +++ b/.github/workflows/build-and-push-embedr-aws.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Setup Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 diff --git a/.github/workflows/build-and-push-link-aws.yaml b/.github/workflows/build-and-push-link-aws.yaml index 98ec6d4db6..5f3daafd7c 100644 --- a/.github/workflows/build-and-push-link-aws.yaml +++ b/.github/workflows/build-and-push-link-aws.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Setup Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 diff --git a/.github/workflows/build-and-push-ogcard-aws.yaml b/.github/workflows/build-and-push-ogcard-aws.yaml index 8b87c80c18..7c7b228e49 100644 --- a/.github/workflows/build-and-push-ogcard-aws.yaml +++ b/.github/workflows/build-and-push-ogcard-aws.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Setup Docker buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 diff --git a/.github/workflows/build-submit-android.yml b/.github/workflows/build-submit-android.yml index 52bd28caf6..e01402824f 100644 --- a/.github/workflows/build-submit-android.yml +++ b/.github/workflows/build-submit-android.yml @@ -79,7 +79,7 @@ jobs: version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }} steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 5 @@ -88,7 +88,7 @@ jobs: with: expo-token: ${{ secrets.EXPO_TOKEN }} - - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: "temurin" java-version: "17" @@ -141,7 +141,7 @@ jobs: steps: # eas submit reads app config from the repo, so we need a checkout. - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 5 @@ -185,7 +185,7 @@ jobs: # bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly # like the build job so the toolchain is deterministic. - - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: "temurin" java-version: "17" diff --git a/.github/workflows/build-submit-ios.yml b/.github/workflows/build-submit-ios.yml index a1c6b45ec8..be4f779a7e 100644 --- a/.github/workflows/build-submit-ios.yml +++ b/.github/workflows/build-submit-ios.yml @@ -81,7 +81,7 @@ jobs: build-number: ${{ steps.ipa-build-number.outputs.build-number }} steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 5 @@ -218,7 +218,7 @@ jobs: needs: [build] steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # eas submit reads the app config from the repo fetch-depth: 5 diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml index 21393c9973..aceac714c9 100644 --- a/.github/workflows/bundle-deploy-eas-update.yml +++ b/.github/workflows/bundle-deploy-eas-update.yml @@ -66,7 +66,7 @@ jobs: fi - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -232,7 +232,7 @@ jobs: - name: ☁️ Configure AWS credentials (denis) if: ${{ !steps.fingerprint.outputs.includes-changes && !steps.version.outputs.version-changed }} - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish aws-region: us-east-2 diff --git a/.github/workflows/claude-mention.yml b/.github/workflows/claude-mention.yml index e4b84bbe18..c4e4cbcb7d 100644 --- a/.github/workflows/claude-mention.yml +++ b/.github/workflows/claude-mention.yml @@ -54,7 +54,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 @@ -65,7 +65,7 @@ jobs: aws-region: us-east-2 - name: 🤖 Claude - uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171 + uses: anthropics/claude-code-action@b76a0776ae74036e77cd11018083743453d7ad35 # v1.0.179 with: use_bedrock: 'true' additional_permissions: | diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index dbefa1a6bb..de15b75fed 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -40,7 +40,7 @@ jobs: steps: - name: ⬇️ Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 @@ -51,7 +51,7 @@ jobs: aws-region: us-east-2 - name: 🤖 Claude review - uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171 + uses: anthropics/claude-code-action@b76a0776ae74036e77cd11018083743453d7ad35 # v1.0.179 with: use_bedrock: 'true' additional_permissions: | diff --git a/.github/workflows/golang-test-lint.yml b/.github/workflows/golang-test-lint.yml index 1795681738..72956bde09 100644 --- a/.github/workflows/golang-test-lint.yml +++ b/.github/workflows/golang-test-lint.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Git Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Set up Go tooling uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Git Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔧 Set up Go tooling uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 8df2f63a7a..280bf660ad 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -25,7 +25,7 @@ jobs: [lint, prettier, 'typecheck:ios', 'typecheck:android', 'typecheck:web'] steps: - name: ⬇️ Check out Git repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: 🔍 Verify Node version pins match package.json run: | set -euo pipefail @@ -88,7 +88,7 @@ jobs: shard: [1, 2, 3, 4] steps: - name: ⬇️ Check out Git repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - name: 🔧 Install node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml index 53fc480e89..4ef064bc34 100644 --- a/.github/workflows/nightly-build.yml +++ b/.github/workflows/nightly-build.yml @@ -25,7 +25,7 @@ jobs: notes: ${{ steps.notes.outputs.notes }} steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/nightly-e2e.yml b/.github/workflows/nightly-e2e.yml index 8a0c0d521d..53e6f0b03d 100644 --- a/.github/workflows/nightly-e2e.yml +++ b/.github/workflows/nightly-e2e.yml @@ -29,7 +29,7 @@ jobs: timeout-minutes: 120 steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -51,7 +51,7 @@ jobs: expo-token: ${{ secrets.EXPO_TOKEN }} - name: ☕️ Set up Java 17 - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: "17" @@ -159,7 +159,7 @@ jobs: timeout-minutes: 120 steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -176,7 +176,7 @@ jobs: expo-token: ${{ secrets.EXPO_TOKEN }} - name: ☕️ Set up Java 17 - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: "17" @@ -361,7 +361,7 @@ jobs: contents: read steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/nightly-update-source-languages.yaml b/.github/workflows/nightly-update-source-languages.yaml index 075e7fa423..e11ff6b7d4 100644 --- a/.github/workflows/nightly-update-source-languages.yaml +++ b/.github/workflows/nightly-update-source-languages.yaml @@ -16,7 +16,7 @@ jobs: steps: - name: ⬇️ Check out Git repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}} - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 @@ -35,7 +35,7 @@ jobs: commit_message: Nightly source-language update file_pattern: ./src/locale/locales/en/messages.po - name: 🚀 Push source lang to Crowdin - uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3 + uses: crowdin/github-action@e0c8f73cdc0fafde9396e056c5038217000a32d1 # v2.16.4 with: upload_sources: true upload_sources_args: "-b main" diff --git a/.github/workflows/pull-request-commit.yml b/.github/workflows/pull-request-commit.yml index dd194e6300..afa3d4f46c 100644 --- a/.github/workflows/pull-request-commit.yml +++ b/.github/workflows/pull-request-commit.yml @@ -32,7 +32,7 @@ jobs: contents: read steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 @@ -71,7 +71,7 @@ jobs: pull-requests: write steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -166,7 +166,7 @@ jobs: includes-changes: ${{ steps.fingerprint.outputs.includes-changes }} steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 100 @@ -277,7 +277,7 @@ jobs: contents: read steps: - name: ⬇️ Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha }} @@ -308,7 +308,7 @@ jobs: pnpm export - name: ☁️ Configure AWS credentials (denis, PR-scoped) - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1 + uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2 with: role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish-pr aws-region: us-east-2 diff --git a/.github/workflows/sync-internal.yaml b/.github/workflows/sync-internal.yaml index 8a0121ac01..b48aecd719 100644 --- a/.github/workflows/sync-internal.yaml +++ b/.github/workflows/sync-internal.yaml @@ -14,7 +14,7 @@ jobs: if: github.repository == 'bluesky-social/social-app' steps: - name: ⬇️ Checkout public repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Don't persist the checkout auth header; the push below authenticates diff --git a/.github/workflows/verify-pnpm-lock.yml b/.github/workflows/verify-pnpm-lock.yml index be386838ad..74c1cfbb81 100644 --- a/.github/workflows/verify-pnpm-lock.yml +++ b/.github/workflows/verify-pnpm-lock.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Check out PR HEAD - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 9c92d4a203..12ff6ed2c7 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -21,12 +21,12 @@ jobs: runs-on: ubuntu-latest steps: - name: ⬇️ Check out Git repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: 🛡️ Run zizmor - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 with: # Annotate the PR directly instead of uploading SARIF to the # security tab, and fail the check on any finding