From ae579b163c37a9790390dd5d4f44ff1e74cfc893 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 11:15:10 +0000 Subject: [PATCH 1/6] Bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-python` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/Docs.yml | 6 +++--- .github/workflows/Workflow-Test-Default.yml | 2 +- .github/workflows/Workflow-Test-WithManifest.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/Docs.yml b/.github/workflows/Docs.yml index 7b06ccf5..1bdd4435 100644 --- a/.github/workflows/Docs.yml +++ b/.github/workflows/Docs.yml @@ -38,7 +38,7 @@ jobs: pull-requests: write # super-linter: post PR summary comment steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -67,7 +67,7 @@ jobs: contents: read steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -79,7 +79,7 @@ jobs: PrivateKey: ${{ secrets.SCRIBBLER_BOT_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.x diff --git a/.github/workflows/Workflow-Test-Default.yml b/.github/workflows/Workflow-Test-Default.yml index 03ed7cfa..aa563395 100644 --- a/.github/workflows/Workflow-Test-Default.yml +++ b/.github/workflows/Workflow-Test-Default.yml @@ -57,7 +57,7 @@ jobs: - WorkflowTestDefault steps: - name: Checkout repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 diff --git a/.github/workflows/Workflow-Test-WithManifest.yml b/.github/workflows/Workflow-Test-WithManifest.yml index 0340f329..0842ced3 100644 --- a/.github/workflows/Workflow-Test-WithManifest.yml +++ b/.github/workflows/Workflow-Test-WithManifest.yml @@ -57,7 +57,7 @@ jobs: - WorkflowTestWithManifest steps: - name: Checkout repo - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 From 20bbb73edb8328ed24a1a4dffae34b108007cb68 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 12:36:24 +0200 Subject: [PATCH 2/6] Add GitHub Action pin updater Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/scripts/Update-GitHubActionPins.ps1 | 117 ++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .github/scripts/Update-GitHubActionPins.ps1 diff --git a/.github/scripts/Update-GitHubActionPins.ps1 b/.github/scripts/Update-GitHubActionPins.ps1 new file mode 100644 index 00000000..8d426441 --- /dev/null +++ b/.github/scripts/Update-GitHubActionPins.ps1 @@ -0,0 +1,117 @@ +[CmdletBinding(SupportsShouldProcess)] +param( + [Parameter()] + [string]$Path = '.github' +) + +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' + +function Get-CommitShaForTag { + [OutputType([string])] + param( + [Parameter(Mandatory)] + [string]$Repository, + + [Parameter(Mandatory)] + [string]$Tag, + + [Parameter(Mandatory)] + [hashtable]$Headers + ) + + $tagReference = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$Repository/git/ref/tags/$Tag" + while ($tagReference.object.type -eq 'tag') { + $tagReference = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$Repository/git/tags/$($tagReference.object.sha)" + } + + if ($tagReference.object.type -ne 'commit') { + throw "Tag '$Tag' in '$Repository' does not resolve to a commit." + } + + return $tagReference.object.sha +} + +function Get-LatestActionPin { + [OutputType([pscustomobject])] + param( + [Parameter(Mandatory)] + [string]$Action, + + [Parameter(Mandatory)] + [hashtable]$Headers + ) + + if ($Action -notmatch '^(?[^/]+)/(?[^/]+)(?:/.*)?$') { + throw "'$Action' is not a GitHub Action repository reference." + } + + $repository = "$($Matches.owner)/$($Matches.repository)" + $release = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$repository/releases/latest" + + return [pscustomobject]@{ + Repository = $repository + Tag = $release.tag_name + Sha = Get-CommitShaForTag -Repository $repository -Tag $release.tag_name -Headers $Headers + } +} + +$root = (Resolve-Path -LiteralPath $Path).Path +$token = $env:GITHUB_TOKEN +if ([string]::IsNullOrWhiteSpace($token)) { + $token = $env:GH_TOKEN +} + +$headers = @{ + Accept = 'application/vnd.github+json' + 'X-GitHub-Api-Version' = '2022-11-28' + 'User-Agent' = 'Process-PSModule-action-pin-updater' +} +if (-not [string]::IsNullOrWhiteSpace($token)) { + $headers.Authorization = "Bearer $token" +} + +$linePattern = [regex]'(?m)^(?[ \t]*uses:[ \t]*)(?[^@\s]+)@(?[^\s#]+)(?:[ \t]*#.*)?(?\r?)$' +$pins = @{} + +Get-ChildItem -LiteralPath $root -Recurse -File -Include '*.yml', '*.yaml' | ForEach-Object { + $file = $_ + $content = [System.IO.File]::ReadAllText($file.FullName) + $lineMatches = $linePattern.Matches($content) + if ($lineMatches.Count -eq 0) { + return + } + + $updatedContent = $linePattern.Replace($content, { + param($match) + + $action = $match.Groups['action'].Value + if ($action.StartsWith('./', [System.StringComparison]::Ordinal) -or $action.StartsWith('docker://', [System.StringComparison]::OrdinalIgnoreCase)) { + return $match.Value + } + + if (-not $pins.ContainsKey($action)) { + $pins[$action] = Get-LatestActionPin -Action $action -Headers $headers + } + + $pin = $pins[$action] + return "$($match.Groups['prefix'].Value)$action@$($pin.Sha) # $($pin.Tag)$($match.Groups['carriageReturn'].Value)" + }) + + if ($updatedContent -eq $content) { + return + } + + $relativePath = [System.IO.Path]::GetRelativePath((Get-Location).Path, $file.FullName) + $actionNames = $lineMatches | ForEach-Object { $_.Groups['action'].Value } | Sort-Object -Unique + $target = "$relativePath ($($actionNames -join ', '))" + if ($PSCmdlet.ShouldProcess($target, 'Update GitHub Action SHA pins and release tags')) { + $hasUtf8Bom = $content.Length -gt 0 -and $content[0] -eq [char]0xFEFF + [System.IO.File]::WriteAllText($file.FullName, $updatedContent, [System.Text.UTF8Encoding]::new($hasUtf8Bom)) + } + + [pscustomobject]@{ + Path = $relativePath + Actions = $actionNames -join ', ' + } +} From 579fd968da4f80a9089635af6a990352d8d61165 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 12:37:09 +0200 Subject: [PATCH 3/6] Refresh GitHub Action release tags Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/scripts/Update-GitHubActionPins.ps1 | 2 +- .github/workflows/Workflow-Test-Default.yml | 2 +- .github/workflows/Workflow-Test-WithManifest.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/scripts/Update-GitHubActionPins.ps1 b/.github/scripts/Update-GitHubActionPins.ps1 index 8d426441..7d6b4675 100644 --- a/.github/scripts/Update-GitHubActionPins.ps1 +++ b/.github/scripts/Update-GitHubActionPins.ps1 @@ -71,7 +71,7 @@ if (-not [string]::IsNullOrWhiteSpace($token)) { $headers.Authorization = "Bearer $token" } -$linePattern = [regex]'(?m)^(?[ \t]*uses:[ \t]*)(?[^@\s]+)@(?[^\s#]+)(?:[ \t]*#.*)?(?\r?)$' +$linePattern = [regex]'(?m)^(?[ \t]*uses:[ \t]*)(?[^@\s]+)@(?[^\s#]+)(?:[ \t]*#[^\r\n]*)?(?\r?)$' $pins = @{} Get-ChildItem -LiteralPath $root -Recurse -File -Include '*.yml', '*.yaml' | ForEach-Object { diff --git a/.github/workflows/Workflow-Test-Default.yml b/.github/workflows/Workflow-Test-Default.yml index aa563395..c3549cb1 100644 --- a/.github/workflows/Workflow-Test-Default.yml +++ b/.github/workflows/Workflow-Test-Default.yml @@ -63,7 +63,7 @@ jobs: fetch-depth: 0 - name: Download docs artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docs path: tests/srcTestRepo/outputs/docs diff --git a/.github/workflows/Workflow-Test-WithManifest.yml b/.github/workflows/Workflow-Test-WithManifest.yml index 0842ced3..968dfb1c 100644 --- a/.github/workflows/Workflow-Test-WithManifest.yml +++ b/.github/workflows/Workflow-Test-WithManifest.yml @@ -63,7 +63,7 @@ jobs: fetch-depth: 0 - name: Download docs artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docs path: tests/srcWithManifestTestRepo/outputs/docs From 8a4f7742e7d20ed7a708cc425f646b5e6e06a27e Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 14:08:41 +0200 Subject: [PATCH 4/6] Fix updater lint warning Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/scripts/Update-GitHubActionPins.ps1 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/scripts/Update-GitHubActionPins.ps1 b/.github/scripts/Update-GitHubActionPins.ps1 index 7d6b4675..4dc5afc1 100644 --- a/.github/scripts/Update-GitHubActionPins.ps1 +++ b/.github/scripts/Update-GitHubActionPins.ps1 @@ -86,7 +86,8 @@ Get-ChildItem -LiteralPath $root -Recurse -File -Include '*.yml', '*.yaml' | For param($match) $action = $match.Groups['action'].Value - if ($action.StartsWith('./', [System.StringComparison]::Ordinal) -or $action.StartsWith('docker://', [System.StringComparison]::OrdinalIgnoreCase)) { + if ($action.StartsWith('./', [System.StringComparison]::Ordinal) -or + $action.StartsWith('docker://', [System.StringComparison]::OrdinalIgnoreCase)) { return $match.Value } From b661d0efe1300c21f1d0063e8124d11171a817db Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 14:12:47 +0200 Subject: [PATCH 5/6] Add updater function help Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/scripts/Update-GitHubActionPins.ps1 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/scripts/Update-GitHubActionPins.ps1 b/.github/scripts/Update-GitHubActionPins.ps1 index 4dc5afc1..b1aef08d 100644 --- a/.github/scripts/Update-GitHubActionPins.ps1 +++ b/.github/scripts/Update-GitHubActionPins.ps1 @@ -8,6 +8,10 @@ Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' function Get-CommitShaForTag { + <# + .SYNOPSIS + Resolves a GitHub release tag to its commit SHA. + #> [OutputType([string])] param( [Parameter(Mandatory)] @@ -33,6 +37,10 @@ function Get-CommitShaForTag { } function Get-LatestActionPin { + <# + .SYNOPSIS + Gets the latest release tag and commit SHA for a GitHub Action. + #> [OutputType([pscustomobject])] param( [Parameter(Mandatory)] From 81bd31589b14a5adca02b310fe2c64e321d2ce03 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 15:19:33 +0200 Subject: [PATCH 6/6] Remove duplicated action pin updater Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/scripts/Update-GitHubActionPins.ps1 | 126 -------------------- 1 file changed, 126 deletions(-) delete mode 100644 .github/scripts/Update-GitHubActionPins.ps1 diff --git a/.github/scripts/Update-GitHubActionPins.ps1 b/.github/scripts/Update-GitHubActionPins.ps1 deleted file mode 100644 index b1aef08d..00000000 --- a/.github/scripts/Update-GitHubActionPins.ps1 +++ /dev/null @@ -1,126 +0,0 @@ -[CmdletBinding(SupportsShouldProcess)] -param( - [Parameter()] - [string]$Path = '.github' -) - -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' - -function Get-CommitShaForTag { - <# - .SYNOPSIS - Resolves a GitHub release tag to its commit SHA. - #> - [OutputType([string])] - param( - [Parameter(Mandatory)] - [string]$Repository, - - [Parameter(Mandatory)] - [string]$Tag, - - [Parameter(Mandatory)] - [hashtable]$Headers - ) - - $tagReference = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$Repository/git/ref/tags/$Tag" - while ($tagReference.object.type -eq 'tag') { - $tagReference = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$Repository/git/tags/$($tagReference.object.sha)" - } - - if ($tagReference.object.type -ne 'commit') { - throw "Tag '$Tag' in '$Repository' does not resolve to a commit." - } - - return $tagReference.object.sha -} - -function Get-LatestActionPin { - <# - .SYNOPSIS - Gets the latest release tag and commit SHA for a GitHub Action. - #> - [OutputType([pscustomobject])] - param( - [Parameter(Mandatory)] - [string]$Action, - - [Parameter(Mandatory)] - [hashtable]$Headers - ) - - if ($Action -notmatch '^(?[^/]+)/(?[^/]+)(?:/.*)?$') { - throw "'$Action' is not a GitHub Action repository reference." - } - - $repository = "$($Matches.owner)/$($Matches.repository)" - $release = Invoke-RestMethod -Headers $Headers -Uri "https://api.github.com/repos/$repository/releases/latest" - - return [pscustomobject]@{ - Repository = $repository - Tag = $release.tag_name - Sha = Get-CommitShaForTag -Repository $repository -Tag $release.tag_name -Headers $Headers - } -} - -$root = (Resolve-Path -LiteralPath $Path).Path -$token = $env:GITHUB_TOKEN -if ([string]::IsNullOrWhiteSpace($token)) { - $token = $env:GH_TOKEN -} - -$headers = @{ - Accept = 'application/vnd.github+json' - 'X-GitHub-Api-Version' = '2022-11-28' - 'User-Agent' = 'Process-PSModule-action-pin-updater' -} -if (-not [string]::IsNullOrWhiteSpace($token)) { - $headers.Authorization = "Bearer $token" -} - -$linePattern = [regex]'(?m)^(?[ \t]*uses:[ \t]*)(?[^@\s]+)@(?[^\s#]+)(?:[ \t]*#[^\r\n]*)?(?\r?)$' -$pins = @{} - -Get-ChildItem -LiteralPath $root -Recurse -File -Include '*.yml', '*.yaml' | ForEach-Object { - $file = $_ - $content = [System.IO.File]::ReadAllText($file.FullName) - $lineMatches = $linePattern.Matches($content) - if ($lineMatches.Count -eq 0) { - return - } - - $updatedContent = $linePattern.Replace($content, { - param($match) - - $action = $match.Groups['action'].Value - if ($action.StartsWith('./', [System.StringComparison]::Ordinal) -or - $action.StartsWith('docker://', [System.StringComparison]::OrdinalIgnoreCase)) { - return $match.Value - } - - if (-not $pins.ContainsKey($action)) { - $pins[$action] = Get-LatestActionPin -Action $action -Headers $headers - } - - $pin = $pins[$action] - return "$($match.Groups['prefix'].Value)$action@$($pin.Sha) # $($pin.Tag)$($match.Groups['carriageReturn'].Value)" - }) - - if ($updatedContent -eq $content) { - return - } - - $relativePath = [System.IO.Path]::GetRelativePath((Get-Location).Path, $file.FullName) - $actionNames = $lineMatches | ForEach-Object { $_.Groups['action'].Value } | Sort-Object -Unique - $target = "$relativePath ($($actionNames -join ', '))" - if ($PSCmdlet.ShouldProcess($target, 'Update GitHub Action SHA pins and release tags')) { - $hasUtf8Bom = $content.Length -gt 0 -and $content[0] -eq [char]0xFEFF - [System.IO.File]::WriteAllText($file.FullName, $updatedContent, [System.Text.UTF8Encoding]::new($hasUtf8Bom)) - } - - [pscustomobject]@{ - Path = $relativePath - Actions = $actionNames -join ', ' - } -}