From a824077c67e61bb8491c4d7979c1c822aee88cce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 18:42:03 +0000 Subject: [PATCH 1/2] Bump the github-actions group across 1 directory with 4 updates Bumps the github-actions group with 4 updates in the / directory: [shivammathur/setup-php](https://github.com/shivammathur/setup-php), [actions/github-script](https://github.com/actions/github-script), [github/codeql-action](https://github.com/github/codeql-action) and [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `shivammathur/setup-php` from 2.35.3 to 2.35.4 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/20529878ed81ef8e78ddf08b480401e6101a850f...ec406be512d7077f68eed36e63f4d91bc006edc4) Updates `actions/github-script` from 7.0.1 to 8.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/60a0d83039c74a4aee543508d2ffcb1c3799cdea...ed597411d8f924073f98dfc5c65a23a2325f34cd) Updates `github/codeql-action` from 3.29.8 to 3.30.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/76621b61decf072c1cee8dd1ce2d2a82d33c17ed...f1f6e5f6af878fb37288ce1c627459e94dbf7d01) Updates `astral-sh/setup-uv` from 6.4.3 to 6.6.1 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/e92bafb6253dcd438e0484186d7669ea7a8ca1cc...557e51de59eb14aaaba2ed9621916900a91d50c6) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.35.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 3.30.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 6.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/github-container-registry.yml | 2 +- .github/workflows/props-bot.yml | 2 +- .github/workflows/reusable-workflow-lint.yml | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/github-container-registry.yml b/.github/workflows/github-container-registry.yml index 88faf3c..24b536d 100644 --- a/.github/workflows/github-container-registry.yml +++ b/.github/workflows/github-container-registry.yml @@ -45,7 +45,7 @@ jobs: persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v.2.35.3 + uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # v.2.35.4 with: php-version: 'latest' diff --git a/.github/workflows/props-bot.yml b/.github/workflows/props-bot.yml index 59f8707..507cd49 100644 --- a/.github/workflows/props-bot.yml +++ b/.github/workflows/props-bot.yml @@ -76,7 +76,7 @@ jobs: format: 'git' - name: Remove the props-bot label - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }} with: retries: 2 diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml index 9c9f610..1d1993e 100644 --- a/.github/workflows/reusable-workflow-lint.yml +++ b/.github/workflows/reusable-workflow-lint.yml @@ -64,7 +64,7 @@ jobs: filter_triggers: '' - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.8 + uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: sarif_file: ${{steps.octoscan.outputs.sarif_output}} category: octoscan @@ -94,7 +94,7 @@ jobs: persist-credentials: false - name: Install the latest version of uv - uses: astral-sh/setup-uv@e92bafb6253dcd438e0484186d7669ea7a8ca1cc # v6.4.3 + uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1 - name: Run zizmor run: uvx zizmor@1.9.0 --format sarif . > results.sarif @@ -102,7 +102,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.8 + uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: sarif_file: results.sarif category: zizmor @@ -134,7 +134,7 @@ jobs: uses: boostsecurityio/poutine-action@84c0a0d32e8d57ae12651222be1eb15351429228 # v0.15.2 - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.8 + uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: sarif_file: results.sarif category: poutine From b5bc68cb542a36d042f3694ebae71c5ae46b1cb3 Mon Sep 17 00:00:00 2001 From: Jonathan Desrosiers Date: Fri, 12 Sep 2025 13:08:54 -0400 Subject: [PATCH 2/2] Update the workflow template file --- templates/workflow.yml-template | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/workflow.yml-template b/templates/workflow.yml-template index c9db6a7..6d65bad 100644 --- a/templates/workflow.yml-template +++ b/templates/workflow.yml-template @@ -63,7 +63,7 @@ jobs: persist-credentials: false - name: Setup PHP - uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v.2.35.3 + uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # v.2.35.4 with: php-version: 'latest'