From 7df6a3354f145c7b9764817187e37132dc7627a4 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 21 Sep 2022 17:18:25 +0000 Subject: [PATCH] Update github-actions --- .github/actions/checkout-go/action.yml | 2 +- .github/actions/generate-builder/action.yml | 4 ++-- .../secure-download-artifact/action.yml | 2 +- .../actions/secure-upload-artifact/action.yml | 2 +- .github/workflows/builder_go_slsa3.yml | 22 +++++++++---------- .github/workflows/codeql-analysis.yml | 6 ++--- .../workflows/generator_container_slsa3.yml | 6 ++--- .github/workflows/generator_generic_slsa3.yml | 8 +++---- .github/workflows/scorecards.yml | 2 +- 9 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/actions/checkout-go/action.yml b/.github/actions/checkout-go/action.yml index 9274c37a64..29c5450dbc 100644 --- a/.github/actions/checkout-go/action.yml +++ b/.github/actions/checkout-go/action.yml @@ -57,7 +57,7 @@ runs: token: "${{ inputs.token }}" - name: Verify checkout - uses: slsa-framework/slsa-github-generator/.github/actions/verify-checkout@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/verify-checkout@22155a9f17555d7df73d4374ad32e34e9cdb94d1 - name: Set up Go environment uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # tag=v3.3.0 diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index baefe6292e..2e82b376f1 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -34,7 +34,7 @@ runs: using: "composite" steps: - name: Checkout the Go builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: repository: "${{ inputs.repository }}" ref: "${{ inputs.ref }}" @@ -62,7 +62,7 @@ runs: run: ./.github/actions/generate-builder/generate-builder.sh - name: Compute sha256 of builder - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@22155a9f17555d7df73d4374ad32e34e9cdb94d1 id: compute with: path: "${{ inputs.binary }}" diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index 090fd18291..12c1e15f80 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -36,7 +36,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index 907f3e25dd..4e94b38eee 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -18,7 +18,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: path: "${{ inputs.path }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index 929de7469d..7e588c083f 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -70,7 +70,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -82,7 +82,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@22155a9f17555d7df73d4374ad32e34e9cdb94d1 detect-env: outputs: @@ -109,7 +109,7 @@ jobs: steps: - name: Generate builder id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -142,12 +142,12 @@ jobs: needs: [privacy-check, builder, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -180,12 +180,12 @@ jobs: needs: [privacy-check, builder, build-dry, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -231,7 +231,7 @@ jobs: - name: Upload generated binary id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" @@ -253,7 +253,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -305,14 +305,14 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download binary - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" sha256: "${{ needs.build.outputs.go-binary-sha256 }}" - name: Download provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ needs.provenance.outputs.go-provenance-name }}" path: "${{ needs.provenance.outputs.go-provenance-name }}" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b996462c4e..838a91cc25 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -44,7 +44,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/init@904260d7d935dff982205cbdb42025ce30b7a34f # tag=v2.1.24 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -57,7 +57,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/autobuild@904260d7d935dff982205cbdb42025ce30b7a34f # tag=v2.1.24 # Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -70,4 +70,4 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/analyze@904260d7d935dff982205cbdb42025ce30b7a34f # tag=v2.1.24 diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index 86b2e3cf08..773879e722 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -54,7 +54,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -71,7 +71,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@22155a9f17555d7df73d4374ad32e34e9cdb94d1 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -91,7 +91,7 @@ jobs: packages: write # Needed to login and upload attestations to ghcr.io. steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index e0a3877be5..acf67ef6c2 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -68,7 +68,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ inputs.private-repository }} @@ -85,7 +85,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@22155a9f17555d7df73d4374ad32e34e9cdb94d1 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -108,7 +108,7 @@ jobs: actions: read # Needed to read workflow info. steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -169,7 +169,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download the provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@22155a9f17555d7df73d4374ad32e34e9cdb94d1 with: name: "${{ needs.generator.outputs.provenance-name }}" path: "${{ needs.generator.outputs.provenance-name }}" diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index a6f350f33a..e92232e6c1 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -57,6 +57,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@b398f525a5587552e573b247ac661067fafa920b # tag=v2.1.22 + uses: github/codeql-action/upload-sarif@904260d7d935dff982205cbdb42025ce30b7a34f # tag=v2.1.24 with: sarif_file: results.sarif