From a4b455745b5de9b8f40b9c4b563b621361d8683e Mon Sep 17 00:00:00 2001 From: Austin Turner Date: Tue, 14 Jul 2026 16:55:03 -0600 Subject: [PATCH] chore: update GitHub Actions to latest versions and add Dependabot configuration --- .github/dependabot.yml | 14 +++++++++++++ .github/workflows/ci.yml | 20 +++++++++---------- .github/workflows/docs.yml | 6 +++--- .github/workflows/publish-desktop-macos.yml | 6 +++--- .github/workflows/publish-desktop-windows.yml | 8 ++++---- .github/workflows/release.yml | 15 ++++++++------ .github/workflows/sfdx-ci.yml | 2 +- 7 files changed, 44 insertions(+), 27 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2f99a5dcf --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + # Keep GitHub Actions current. Because actions are SHA-pinned (with a version + # comment) in the workflow files, Dependabot updates both the pinned SHA and + # the comment when a new release ships. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + # Collapse all action bumps into a single PR to keep review noise low. + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bd13e82d8..2b4b61627 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,7 +71,7 @@ jobs: - 5432:5432 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 name: Checkout [master] with: fetch-depth: 0 @@ -82,13 +82,13 @@ jobs: run: git branch --track main origin/main - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v5 + uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" @@ -121,7 +121,7 @@ jobs: - name: Uploading artifacts if: github.event_name == 'push' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: dist-artifacts path: dist @@ -153,7 +153,7 @@ jobs: - 5432:5432 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 name: Checkout [master] with: fetch-depth: 0 @@ -164,13 +164,13 @@ jobs: run: git branch --track main origin/main - name: Derive appropriate SHAs for base and head for `nx affected` commands - uses: nrwl/nx-set-shas@v5 + uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" @@ -235,7 +235,7 @@ jobs: - name: Upload test results # Upload even on failure, but only when the suite actually ran. if: always() && steps.guard.outputs.should_run == 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: playwright-report path: | diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d4b34b4d8..77c94dbbe 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -21,16 +21,16 @@ jobs: timeout-minutes: 30 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 name: Checkout with: persist-credentials: false - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" diff --git a/.github/workflows/publish-desktop-macos.yml b/.github/workflows/publish-desktop-macos.yml index d094c6b48..fb0f5b61b 100644 --- a/.github/workflows/publish-desktop-macos.yml +++ b/.github/workflows/publish-desktop-macos.yml @@ -48,16 +48,16 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.ref || github.ref }} persist-credentials: false - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" diff --git a/.github/workflows/publish-desktop-windows.yml b/.github/workflows/publish-desktop-windows.yml index 0f2d877c5..1cb53f005 100644 --- a/.github/workflows/publish-desktop-windows.yml +++ b/.github/workflows/publish-desktop-windows.yml @@ -45,16 +45,16 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ inputs.ref || github.ref }} persist-credentials: false - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" @@ -62,7 +62,7 @@ jobs: # The TrustedSigning PowerShell module that electron-builder installs at # sign time runs on .NET 8. Without it, signing fails with SignTool exit 3. - name: Setup .NET 8 runtime - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: "8.0.x" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 80634eced..fecc07e1a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,8 +29,11 @@ concurrency: group: release cancel-in-progress: false +# The default GITHUB_TOKEN is read-only here: all writes (tags, commits, the +# release branch push, and GitHub Releases) are performed by the GitHub App +# installation token, which is on the main-branch ruleset bypass list. permissions: - contents: write + contents: read # Many of these are only needed for tests in CI environment env: @@ -106,18 +109,18 @@ jobs: exit 1 fi - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 # We override the remote URL later with a GitHub App installation token # so release-it can push as the App (which is on the ruleset bypass list). persist-credentials: false - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: version: 11.9.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: "24" cache: "pnpm" @@ -158,7 +161,7 @@ jobs: # after 1 hour — generating late keeps the lifetime budget on the actual push operations. - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ secrets.CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} @@ -226,7 +229,7 @@ jobs: - name: Upload web extension zips if: ${{ inputs.release_web_extension }} - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: web-extension-zips path: dist/web-extension-build/*.zip diff --git a/.github/workflows/sfdx-ci.yml b/.github/workflows/sfdx-ci.yml index 5010352bf..352459b8e 100644 --- a/.github/workflows/sfdx-ci.yml +++ b/.github/workflows/sfdx-ci.yml @@ -22,7 +22,7 @@ jobs: timeout-minutes: 60 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 name: Checkout with: persist-credentials: false