From cffe57cc6468a3a70bcbf32d77529837078bcdd1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Curro=20Campuzano=20Jim=C3=A9nez?= Date: Wed, 22 Jul 2026 10:38:53 +0200 Subject: [PATCH 1/3] CI: Point to specific commit hashes --- .github/workflows/tests.yml | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 11ecc55a..9272da69 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -11,13 +11,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Cancel previous runs - uses: styfle/cancel-workflow-action@0.12.1 + uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1 coverage: if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'messerlab/slim') runs-on: ubuntu-24.04 steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Set up GCC run: | sudo apt-get install gcc-12 g++-12 && \ @@ -37,7 +37,7 @@ jobs: lcov --gcov-tool gcov-12 --ignore-errors gcov,mismatch --rc geninfo_unexecuted_blocks=1 --capture --directory Coverage --output-file coverage.info && \ lcov --gcov-tool gcov-12 --ignore-errors gcov,mismatch,unused --remove coverage.info '/usr/*' '*/gsl/*' '*/eidos_zlib/*' --output-file coverage.info - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 with: token: ${{ secrets.CODECOV_TOKEN }} files: coverage.info @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Miniforge - uses: conda-incubator/setup-miniconda@v3 + uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 with: miniforge-version: latest activate-environment: anaconda-client-env @@ -73,7 +73,7 @@ jobs: run: echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT shell: bash - name: Cache Conda env - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: path: ${{ env.CONDA }}/envs key: @@ -138,9 +138,9 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup MSYS2 ${{matrix.sys}} - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{matrix.sys}} update: true @@ -151,7 +151,7 @@ jobs: mingw-w64-${{matrix.env}}-toolchain mingw-w64-${{matrix.env}}-cmake - name: Setup Miniforge - uses: conda-incubator/setup-miniconda@v3 + uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 with: miniforge-version: latest activate-environment: anaconda-client-env @@ -162,7 +162,7 @@ jobs: run: echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT shell: bash - name: Cache Conda env - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 env: # Increase this value to reset cache if treerec/tests/environment.yml has not changed CACHE_NUMBER: 0 @@ -175,7 +175,7 @@ jobs: steps.get-date.outputs.today }}-${{ hashFiles('treerec/tests/environment.yml') }}-${{ env.CACHE_NUMBER}} id: cache - - uses: conda-incubator/setup-miniconda@v3 + - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 with: activate-environment: anaconda-client-env environment-file: treerec/tests/environment.yml @@ -245,7 +245,7 @@ jobs: shell: bash steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Workaround for gcc-11 if: startsWith(matrix.os, 'ubuntu') && matrix.gcc == 11 run: | @@ -260,7 +260,7 @@ jobs: --slave /usr/bin/g++ g++ /usr/bin/g++-${{ matrix.gcc }} - name: Install Qt - uses: jurplel/install-qt-action@v4 + uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1 with: version: ${{ matrix.qt }} - name: Release build with SLiMGUI @@ -286,9 +286,9 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup MSYS2 ${{matrix.sys}} - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{matrix.sys}} update: true @@ -325,9 +325,9 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup MSYS2 ${{matrix.sys}} - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{matrix.sys}} update: true From 6a6f3e19c436e75fcf347d29e59000b776322182 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Curro=20Campuzano=20Jim=C3=A9nez?= Date: Wed, 22 Jul 2026 11:23:21 +0200 Subject: [PATCH 2/3] CI: Add dependabot --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..4ded9275 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + # Batch minor/patch GitHub Actions into a single PR. + gha-bump: + applies-to: version-updates + update-types: + - "patch" + - "minor" \ No newline at end of file From 3673b62705153a0f554e3836b9fe9fcf0124c6d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Curro=20Campuzano=20Jim=C3=A9nez?= Date: Wed, 22 Jul 2026 11:54:21 +0200 Subject: [PATCH 3/3] CI: bump pinned GitHub Actions via Dependabot Squashed some automated PRs: ======================================== Bump styfle/cancel-workflow-action in the gha-bump group Bumps the gha-bump group with 1 update: [styfle/cancel-workflow-action](https://github.com/styfle/cancel-workflow-action). Updates `styfle/cancel-workflow-action` from 0.12.1 to 0.13.1 - [Release notes](https://github.com/styfle/cancel-workflow-action/releases) - [Commits](https://github.com/styfle/cancel-workflow-action/compare/85880fa0301c86cca9da44039ee3bb12d3bedbfa...d07a454dad7609a92316b57b23c9ccfd4f59af66) --- updated-dependencies: - dependency-name: styfle/cancel-workflow-action dependency-version: 0.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-bump ... Signed-off-by: dependabot[bot] ======================================== Bump actions/cache from 3.5.0 to 6.1.0 Bumps [actions/cache](https://github.com/actions/cache) from 3.5.0 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/6f8efc29b200d32929f49075959781ed54ec270c...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] ======================================== Bump actions/checkout from 4.4.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11d5960a326750d5838078e36cf38b85af677262...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] ======================================== Bump codecov/codecov-action from 5.5.5 to 7.0.0 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.5 to 7.0.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/0fb7174895f61a3b6b78fc075e0cd60383518dac...fb8b3582c8e4def4969c97caa2f19720cb33a72f) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] ======================================== Bump conda-incubator/setup-miniconda from 3.3.0 to 4.0.1 Bumps [conda-incubator/setup-miniconda](https://github.com/conda-incubator/setup-miniconda) from 3.3.0 to 4.0.1. - [Release notes](https://github.com/conda-incubator/setup-miniconda/releases) - [Changelog](https://github.com/conda-incubator/setup-miniconda/blob/main/CHANGELOG.md) - [Commits](https://github.com/conda-incubator/setup-miniconda/compare/fc2d68f6413eb2d87b895e92f8584b5b94a10167...8ee1f361103df19b6f8c8655fd3967a8ecb162d5) --- updated-dependencies: - dependency-name: conda-incubator/setup-miniconda dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] ======================================== Merge pull request #1 from currocam/dependabot/github_actions/gha-bump-ca51f02dbf Bump styfle/cancel-workflow-action from 0.12.1 to 0.13.1 in the gha-bump group ======================================== Merge pull request #2 from currocam/dependabot/github_actions/actions/cache-6.1.0 Bump actions/cache from 3.5.0 to 6.1.0 ======================================== Merge pull request #3 from currocam/dependabot/github_actions/actions/checkout-7.0.1 Bump actions/checkout from 4.4.0 to 7.0.1 ======================================== Merge pull request #4 from currocam/dependabot/github_actions/codecov/codecov-action-7.0.0 Bump codecov/codecov-action from 5.5.5 to 7.0.0 ======================================== Merge pull request #5 from currocam/dependabot/github_actions/conda-incubator/setup-miniconda-4.0.1 Bump conda-incubator/setup-miniconda from 3.3.0 to 4.0.1 --- .github/workflows/tests.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 9272da69..76427664 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -11,13 +11,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Cancel previous runs - uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 coverage: if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'messerlab/slim') runs-on: ubuntu-24.04 steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up GCC run: | sudo apt-get install gcc-12 g++-12 && \ @@ -37,7 +37,7 @@ jobs: lcov --gcov-tool gcov-12 --ignore-errors gcov,mismatch --rc geninfo_unexecuted_blocks=1 --capture --directory Coverage --output-file coverage.info && \ lcov --gcov-tool gcov-12 --ignore-errors gcov,mismatch,unused --remove coverage.info '/usr/*' '*/gsl/*' '*/eidos_zlib/*' --output-file coverage.info - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} files: coverage.info @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Miniforge - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 + uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 with: miniforge-version: latest activate-environment: anaconda-client-env @@ -73,7 +73,7 @@ jobs: run: echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT shell: bash - name: Cache Conda env - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ env.CONDA }}/envs key: @@ -138,7 +138,7 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup MSYS2 ${{matrix.sys}} uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: @@ -151,7 +151,7 @@ jobs: mingw-w64-${{matrix.env}}-toolchain mingw-w64-${{matrix.env}}-cmake - name: Setup Miniforge - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 + uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 with: miniforge-version: latest activate-environment: anaconda-client-env @@ -162,7 +162,7 @@ jobs: run: echo "today=$(/bin/date -u '+%Y%m%d')" >> $GITHUB_OUTPUT shell: bash - name: Cache Conda env - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 env: # Increase this value to reset cache if treerec/tests/environment.yml has not changed CACHE_NUMBER: 0 @@ -175,7 +175,7 @@ jobs: steps.get-date.outputs.today }}-${{ hashFiles('treerec/tests/environment.yml') }}-${{ env.CACHE_NUMBER}} id: cache - - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0 + - uses: conda-incubator/setup-miniconda@8ee1f361103df19b6f8c8655fd3967a8ecb162d5 # v4.0.1 with: activate-environment: anaconda-client-env environment-file: treerec/tests/environment.yml @@ -245,7 +245,7 @@ jobs: shell: bash steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Workaround for gcc-11 if: startsWith(matrix.os, 'ubuntu') && matrix.gcc == 11 run: | @@ -286,7 +286,7 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup MSYS2 ${{matrix.sys}} uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: @@ -325,7 +325,7 @@ jobs: shell: msys2 {0} steps: - name: Check out repository code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup MSYS2 ${{matrix.sys}} uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: