diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 729134c..40c63c8 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -43,14 +43,14 @@ jobs: steps: # The cargo-test pre-commit hook links libodbc via odbc-sys. - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: unixodbc-dev # A cache key, not a runner label, but it tracks the runner image so # that bumping the image invalidates the cached .deb files. version: ubuntu-24.04 - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -61,14 +61,14 @@ jobs: components: rustfmt, clippy - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Install cargo-deny and cargo-sort - uses: taiki-e/install-action@97a5807a604e12de3a13b52d868ebecaeeea757c # v2.75.4 + uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2.85.8 with: tool: cargo-deny,cargo-sort - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" @@ -85,12 +85,12 @@ jobs: needs: [pre-commit] steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: unixodbc-dev unixodbc sqlite3 version: ubuntu-24.04 - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -100,10 +100,10 @@ jobs: toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }} - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Install uv - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Run SQLite integration tests run: | @@ -116,7 +116,7 @@ jobs: runs-on: windows-2022 timeout-minutes: 30 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -129,7 +129,7 @@ jobs: # A separate cache key: the Linux job's artefacts are a different target # triple and sharing the key would thrash both. - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: key: windows-gnu-test @@ -167,7 +167,7 @@ jobs: - name: Install MinGW cross-compiler run: sudo apt-get update && sudo apt-get install -y gcc-mingw-w64-x86-64 unixodbc-dev - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -178,7 +178,7 @@ jobs: targets: x86_64-pc-windows-gnu - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: key: windows-gnu diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9ac04e4..3d2306d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -33,7 +33,7 @@ jobs: outputs: version: ${{ steps.extract.outputs.version }} steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -58,12 +58,12 @@ jobs: needs: [verify-version] steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: unixodbc-dev unixodbc sqlite3 version: ubuntu-24.04 - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -73,10 +73,10 @@ jobs: toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }} - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Install uv - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Run SQLite integration tests run: | @@ -100,7 +100,7 @@ jobs: sudo apt-get update sudo apt-get install -y unixodbc-dev gcc-mingw-w64-x86-64 zip - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -111,7 +111,7 @@ jobs: targets: x86_64-pc-windows-gnu - name: Setup Rust Cache - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: key: release @@ -119,7 +119,7 @@ jobs: # refuses an artifact without one. Both tools are therefore preconditions # of packaging, not optional extras. - name: Install cargo-auditable - uses: taiki-e/install-action@97a5807a604e12de3a13b52d868ebecaeeea757c # v2.75.4 + uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2.85.8 with: tool: cargo-auditable@${{ env.CARGO_AUDITABLE_VERSION }} @@ -212,7 +212,7 @@ jobs: sbom-path: packaging/dist/stackable-odbc-sqlite-${{ needs.verify-version.outputs.version }}-windows-x64.cdx.json - name: Upload archives as workflow artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: release-archives path: packaging/dist/* @@ -227,7 +227,7 @@ jobs: contents: write steps: - name: Download archives - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: release-archives path: dist @@ -244,7 +244,7 @@ jobs: fi - name: Create GitHub Release - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: ${{ github.ref_name }} name: stackable-odbc-sqlite ${{ needs.verify-version.outputs.version }} diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index 01c3cca..900ed73 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -32,7 +32,7 @@ jobs: contents: read actions: read steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -44,6 +44,6 @@ jobs: publish_results: true - name: Upload results to code scanning - uses: github/codeql-action/upload-sarif@a2983b8bed1923f44751c5c43237f479442827b3 # v3.37.4 + uses: github/codeql-action/upload-sarif@404bd795832c959ffb8efae2b1b4cc1aafc82058 # v3.37.6 with: sarif_file: results.sarif diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml index ef7afc1..fb62f23 100644 --- a/.github/workflows/security_audit.yaml +++ b/.github/workflows/security_audit.yaml @@ -7,17 +7,35 @@ on: - cron: '15 4 * * *' workflow_dispatch: +# rustsec/audit-check reports findings by opening a GitHub issue, and records a +# check run. With contents:read alone it cannot do either, so a new advisory +# would fail silently and the job's green status would mean nothing. permissions: contents: read + issues: write + checks: write jobs: audit: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + # rustsec/audit-check looks for `cargo-audit` on PATH and falls back to a + # bare `cargo install cargo-audit` when it is missing. That fallback + # passes no `--locked`, so it resolves cargo-audit's dependencies fresh + # and pulls in whatever versions are current, several of which now + # require a newer rustc than the 1.95.0 that rust-toolchain.toml pins for + # this repository. Installing a prebuilt binary first satisfies the PATH + # lookup, so the action never compiles cargo-audit and the pin no longer + # constrains a tool that only ever reads Cargo.lock. + - name: Install cargo-audit + uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2.85.8 + with: + tool: cargo-audit + # This `token` is the action's own input, not checkout's: audit-check # needs it to post the advisory annotations onto the run. - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0