From a7bc69556851f1f4a90ae46b873d30220400a3bc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 16:00:20 +0000 Subject: [PATCH] build(deps): bump the actions group across 1 directory with 10 updates Bumps the actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/attest](https://github.com/actions/attest) | `4.2.0` | `4.2.2` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.95.9` | `3.97.0` | | [useblacksmith/stickydisk](https://github.com/useblacksmith/stickydisk) | `1.4.0` | `1.5.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `5.7.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.7` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.7` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.1` | `4.37.7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.3.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [useblacksmith/build-push-action](https://github.com/useblacksmith/build-push-action) | `2.2.0` | `2.3.0` | Updates `actions/attest` from 4.2.0 to 4.2.2 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...1e69f48acb82d1966a394da916b4c1698aa569d6) Updates `trufflesecurity/trufflehog` from 3.95.9 to 3.97.0 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](https://github.com/trufflesecurity/trufflehog/compare/27b0417c16317ca9a472a9a8092acce143b49c55...bcfcf73aaf4759d4dadc2783177c245a02792318) Updates `useblacksmith/stickydisk` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/useblacksmith/stickydisk/releases) - [Commits](https://github.com/useblacksmith/stickydisk/compare/6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494...35ba2e331a80056a42af053ee54968511de2b7c7) Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961) Updates `github/codeql-action/init` from 4.37.1 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd) Updates `docker/setup-buildx-action` from 4.1.0 to 4.3.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v4.1.0...37fe631027851001ddb9b187196cc803df7f5f0e) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v4.2.0...dbcb813823bdd20940b903addbd779551569679f) Updates `useblacksmith/build-push-action` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/useblacksmith/build-push-action/releases) - [Commits](https://github.com/useblacksmith/build-push-action/compare/fb9e3e6a9299c78462bfadd0d93352c316adc9b8...9b0579bbec7a6cad2f171596c57e7ac1e7658850) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.96.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: useblacksmith/build-push-action dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: useblacksmith/stickydisk dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/android-release.yml | 2 +- .github/workflows/ci.yml | 8 +-- .../codeql-android-critical-security.yml | 6 +- .github/workflows/codeql-critical-quality.yml | 60 +++++++++---------- .../codeql-macos-critical-security.yml | 6 +- .github/workflows/codeql.yml | 4 +- .github/workflows/docker-channel-promote.yml | 6 +- .github/workflows/docker-release.yml | 22 +++---- .github/workflows/live-media-runner-image.yml | 4 +- .github/workflows/npm-telegram-beta-e2e.yml | 2 +- .../openclaw-live-and-e2e-checks-reusable.yml | 2 +- .../workflows/openclaw-release-publish.yml | 4 +- .../openclaw-release-telegram-qa.yml | 2 +- .github/workflows/opengrep-precise-full.yml | 2 +- .github/workflows/opengrep-precise.yml | 2 +- .github/workflows/sandbox-common-smoke.yml | 2 +- .../vercel-container-registry-publish.yml | 2 +- 17 files changed, 68 insertions(+), 68 deletions(-) diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml index 3c79b64d694c..f8b31327bf6d 100644 --- a/.github/workflows/android-release.yml +++ b/.github/workflows/android-release.yml @@ -352,7 +352,7 @@ jobs: fi - name: Attest Android APK provenance - uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: dist/OpenClaw-Android.apk diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a2f7cd20ce26..75ab83187210 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1155,7 +1155,7 @@ jobs: - name: Scan pull request for leaked credentials if: github.event_name == 'pull_request' - uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9 + uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318 # v3.97.0 with: base: ${{ steps.diff_base.outputs.sha }} head: ${{ github.sha }} @@ -2577,7 +2577,7 @@ jobs: # protected boundary lane may publish this repository-global snapshot. - name: Mount extension boundary sticky disk if: matrix.task == 'lint' && vars.OPENCLAW_CI_RUNNER_BACKEND != 'github' && vars.OPENCLAW_CI_RUNNER_BACKEND != 'hybrid' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') - uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix) + uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # main (post-v1.4.0 hot-attach fix) with: # One stable disk for the whole repository. The v1 per-PR/per-config # keys minted a new backing disk for every PR and toolchain change @@ -3008,7 +3008,7 @@ jobs: # repository-global snapshots, so they keep the GitHub cache path. - name: Mount extension boundary sticky disk if: matrix.group == 'extension-package-boundary' && vars.OPENCLAW_CI_RUNNER_BACKEND != 'github' && vars.OPENCLAW_CI_RUNNER_BACKEND != 'hybrid' && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') - uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix) + uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # main (post-v1.4.0 hot-attach fix) with: # One stable disk for the whole repository. The v1 per-PR/per-config # keys minted a new backing disk for every PR and toolchain change @@ -4082,7 +4082,7 @@ jobs: # runs-on already selects non-Blacksmith ubuntu-24.04 runners). - name: Mount Gradle sticky disk if: vars.OPENCLAW_CI_RUNNER_BACKEND != 'github' && !(vars.OPENCLAW_CI_RUNNER_BACKEND == 'hybrid' && github.run_attempt > 1) && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') - uses: useblacksmith/stickydisk@6d373c96a74cbde0c99fedc5ea5d3a7ba66ba494 # main (post-v1.4.0 hot-attach fix) + uses: useblacksmith/stickydisk@35ba2e331a80056a42af053ee54968511de2b7c7 # main (post-v1.4.0 hot-attach fix) with: # One stable disk per matrix task. The v1 per-PR/per-dependency-hash # keys minted a new backing disk for every PR and dependency bump diff --git a/.github/workflows/codeql-android-critical-security.yml b/.github/workflows/codeql-android-critical-security.yml index d4845ea53add..85ca135941f7 100644 --- a/.github/workflows/codeql-android-critical-security.yml +++ b/.github/workflows/codeql-android-critical-security.yml @@ -29,7 +29,7 @@ jobs: submodules: false - name: Setup Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: distribution: temurin java-version: "21" @@ -41,7 +41,7 @@ jobs: install-bun: "false" - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: java-kotlin build-mode: manual @@ -52,6 +52,6 @@ jobs: run: ./gradlew --no-daemon :app:assemblePlayDebug - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-security/android" diff --git a/.github/workflows/codeql-critical-quality.yml b/.github/workflows/codeql-critical-quality.yml index 580c1a5e8998..2c5ac063378c 100644 --- a/.github/workflows/codeql-critical-quality.yml +++ b/.github/workflows/codeql-critical-quality.yml @@ -340,13 +340,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-core-auth-secrets-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/core-auth-secrets" @@ -363,13 +363,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-config-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/config-boundary" @@ -386,13 +386,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-gateway-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/gateway-runtime-boundary" @@ -409,13 +409,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-channel-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/channel-runtime-boundary" @@ -488,7 +488,7 @@ jobs: - name: Initialize CodeQL if: ${{ github.event_name != 'pull_request' || steps.network-diff-scan.outputs.full_codeql == 'true' }} - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-network-runtime-boundary-critical-quality.yml @@ -496,7 +496,7 @@ jobs: - name: Analyze id: analyze if: ${{ github.event_name != 'pull_request' || steps.network-diff-scan.outputs.full_codeql == 'true' }} - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: output: sarif-results category: "/codeql-critical-quality/network-runtime-boundary" @@ -546,13 +546,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-agent-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/agent-runtime-boundary" @@ -569,13 +569,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-mcp-process-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/mcp-process-runtime-boundary" @@ -592,13 +592,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-memory-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/memory-runtime-boundary" @@ -615,13 +615,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-session-diagnostics-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/session-diagnostics-boundary" @@ -638,13 +638,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-sdk-reply-runtime-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/plugin-sdk-reply-runtime" @@ -661,13 +661,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-provider-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/provider-runtime-boundary" @@ -683,13 +683,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-ui-control-plane-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/ui-control-plane" @@ -705,13 +705,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/web-media-runtime-boundary" @@ -728,13 +728,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/plugin-boundary" @@ -751,12 +751,12 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-sdk-package-contract-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-critical-quality/plugin-sdk-package-contract" diff --git a/.github/workflows/codeql-macos-critical-security.yml b/.github/workflows/codeql-macos-critical-security.yml index cc7556b67c42..2d118a6fd431 100644 --- a/.github/workflows/codeql-macos-critical-security.yml +++ b/.github/workflows/codeql-macos-critical-security.yml @@ -35,7 +35,7 @@ jobs: swift --version - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: swift build-mode: manual @@ -46,7 +46,7 @@ jobs: - name: Analyze id: analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: output: sarif-results upload: failure-only @@ -83,7 +83,7 @@ jobs: done - name: Upload filtered SARIF - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: sarif_file: sarif-results-filtered category: "/codeql-critical-security/macos" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index dfb845d82f6d..ae0bc663122b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -119,12 +119,12 @@ jobs: .github/codeql - name: Initialize CodeQL - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: ${{ matrix.language }} config-file: ${{ matrix.config_file }} - name: Analyze - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: category: "/codeql-security-high/${{ matrix.category }}" diff --git a/.github/workflows/docker-channel-promote.yml b/.github/workflows/docker-channel-promote.yml index 88927dff8091..56aa55bd6185 100644 --- a/.github/workflows/docker-channel-promote.yml +++ b/.github/workflows/docker-channel-promote.yml @@ -146,17 +146,17 @@ jobs: done - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 82f98897026a..dfd4f3aa48a4 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -239,17 +239,17 @@ jobs: done - name: Set up Docker Builder - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -449,17 +449,17 @@ jobs: - *buildkit_prepull_step - name: Set up Docker Builder - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -665,14 +665,14 @@ jobs: fetch-depth: 0 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -802,17 +802,17 @@ jobs: - *buildkit_prepull_step - name: Set up Docker Builder - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/live-media-runner-image.yml b/.github/workflows/live-media-runner-image.yml index 307b7f87ca28..843b928d293c 100644 --- a/.github/workflows/live-media-runner-image.yml +++ b/.github/workflows/live-media-runner-image.yml @@ -28,7 +28,7 @@ jobs: - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Login to GHCR - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -40,7 +40,7 @@ jobs: max-cache-size-mb: 800000 - name: Build and push live media runner image - uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2 + uses: useblacksmith/build-push-action@9b0579bbec7a6cad2f171596c57e7ac1e7658850 # v2 with: context: .github/images/live-media-runner file: .github/images/live-media-runner/Dockerfile diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index eb3432e388c2..c020bc3c3061 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -214,7 +214,7 @@ jobs: max-cache-size-mb: 800000 - name: Build Docker E2E image - uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2 + uses: useblacksmith/build-push-action@9b0579bbec7a6cad2f171596c57e7ac1e7658850 # v2 with: context: . file: ./scripts/e2e/Dockerfile diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index ac7e64c541ba..1dc37bf0bda5 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -2854,7 +2854,7 @@ jobs: - name: Build shared live-test image if: inputs.shared_image_policy == 'no-push-artifact' - uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2 + uses: useblacksmith/build-push-action@9b0579bbec7a6cad2f171596c57e7ac1e7658850 # v2 with: context: . file: ./Dockerfile diff --git a/.github/workflows/openclaw-release-publish.yml b/.github/workflows/openclaw-release-publish.yml index d065795ba8de..04dc6b739a90 100644 --- a/.github/workflows/openclaw-release-publish.yml +++ b/.github/workflows/openclaw-release-publish.yml @@ -880,7 +880,7 @@ jobs: - name: Attest ClawHub bootstrap approval if: ${{ steps.clawhub_plan.outputs.bootstrap_should_dispatch == 'true' }} - uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: ${{ runner.temp }}/clawhub-bootstrap-approval/approval.json @@ -943,7 +943,7 @@ jobs: - name: Attest Android release approval if: ${{ inputs.publish_openclaw_npm && !contains(inputs.tag, '-alpha.') && !contains(inputs.tag, '-beta.') }} - uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: ${{ runner.temp }}/android-release-approval/approval.json diff --git a/.github/workflows/openclaw-release-telegram-qa.yml b/.github/workflows/openclaw-release-telegram-qa.yml index 49c0fba311d6..65e583305161 100644 --- a/.github/workflows/openclaw-release-telegram-qa.yml +++ b/.github/workflows/openclaw-release-telegram-qa.yml @@ -708,7 +708,7 @@ jobs: - name: Attest exact candidate archive bytes id: attest - uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-path: ${{ steps.verify_candidate.outputs.archive_path }} diff --git a/.github/workflows/opengrep-precise-full.yml b/.github/workflows/opengrep-precise-full.yml index 16d2467b8cd9..a3a84979fd97 100644 --- a/.github/workflows/opengrep-precise-full.yml +++ b/.github/workflows/opengrep-precise-full.yml @@ -61,7 +61,7 @@ jobs: scripts/run-opengrep.sh --sarif --error - name: Upload SARIF to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # Only upload if the scan actually produced a SARIF file. if: always() && hashFiles('.opengrep-out/precise.sarif') != '' with: diff --git a/.github/workflows/opengrep-precise.yml b/.github/workflows/opengrep-precise.yml index 5b6269b2f403..7c43579a29a5 100644 --- a/.github/workflows/opengrep-precise.yml +++ b/.github/workflows/opengrep-precise.yml @@ -92,7 +92,7 @@ jobs: scripts/run-opengrep.sh --changed --sarif --error - name: Upload SARIF to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # Only upload if the scan actually produced a SARIF file. if: always() && hashFiles('.opengrep-out/precise.sarif') != '' with: diff --git a/.github/workflows/sandbox-common-smoke.yml b/.github/workflows/sandbox-common-smoke.yml index ad8faaa000bc..3c286f219c37 100644 --- a/.github/workflows/sandbox-common-smoke.yml +++ b/.github/workflows/sandbox-common-smoke.yml @@ -36,7 +36,7 @@ jobs: submodules: false - name: Set up Docker Builder - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - name: Build minimal sandbox base (USER sandbox) shell: bash diff --git a/.github/workflows/vercel-container-registry-publish.yml b/.github/workflows/vercel-container-registry-publish.yml index 144ed113711f..33762660f7e3 100644 --- a/.github/workflows/vercel-container-registry-publish.yml +++ b/.github/workflows/vercel-container-registry-publish.yml @@ -46,7 +46,7 @@ jobs: persist-credentials: false - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Setup trusted Node runtime uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0