From d654028710c59e5f7d7c37f0f2762436c51d5323 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 26 Sep 2026 11:41:45 +0000 Subject: [PATCH] build(deps): bump actions/checkout from 4.4.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/fuzz.yml | 2 +- .github/workflows/mutants.yml | 2 +- .github/workflows/publish-crates.yml | 2 +- .github/workflows/systest.yml | 12 ++++++------ 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ddc8280e..366c306b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: runner: macos-latest runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable with: components: rustfmt, clippy @@ -45,7 +45,7 @@ jobs: name: rivet validate ยท release plan runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 # rivet comes from THIS PROJECT'S PIN, not from a version number # written here (varve#106). It was declared in four places that @@ -124,7 +124,7 @@ jobs: name: MSRV (1.89) runs-on: [self-hosted, linux, x64, rust-cpu] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # 1.89 pinned below with: toolchain: "1.89" @@ -134,7 +134,7 @@ jobs: name: coverage (advisory evidence) runs-on: [self-hosted, linux, x64, rust-cpu] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - name: Install cargo-llvm-cov @@ -175,7 +175,7 @@ jobs: name: cargo deny (supply-chain audit) runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install cargo-deny run: cargo install --locked cargo-deny - name: Audit dependencies (advisories, licenses, sources) @@ -188,7 +188,7 @@ jobs: # required check open indefinitely and there was nothing to end it. timeout-minutes: 20 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -212,7 +212,7 @@ jobs: name: no signing key on disk (REQ-NOKEYDISK-001) runs-on: [self-hosted, linux, x64, light] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # `docs ci` names `echo "$SECRET" > key.tmp` as the thing adopters # wrongly invent, and `docs root-ceremony` says the key must reach varve # through a file descriptor. This repository's own deposit workflow wrote @@ -363,7 +363,7 @@ jobs: -f crates/varve-producer/src/stage.rs -f crates/varve-producer/src/sums.rs steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -473,7 +473,7 @@ jobs: name: SMT obligations (ordeal, certificate-checked) runs-on: [self-hosted, linux, x64, rust-cpu] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - name: Install ordeal (the solver varve itself distributes) run: cargo install --locked ordeal --version 0.14.0 diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 2359fd36..2ab5a0c9 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -30,7 +30,7 @@ jobs: matrix: target: [layer_id, manifest, dsse_verify, pin, realms] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # nightly is required for -Z sanitizer; toolchain action pins the channel below with: toolchain: nightly diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml index 45eb6367..bd6aa808 100644 --- a/.github/workflows/mutants.yml +++ b/.github/workflows/mutants.yml @@ -22,7 +22,7 @@ jobs: runs-on: [self-hosted, linux, x64, lean-mem] timeout-minutes: 90 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml index 4cd13f9b..bca48dee 100644 --- a/.github/workflows/publish-crates.yml +++ b/.github/workflows/publish-crates.yml @@ -42,7 +42,7 @@ jobs: id-token: write # required for trusted publishing contents: read steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable # The guards that made the v0.26.0 failure legible. Keep them BEFORE the diff --git a/.github/workflows/systest.yml b/.github/workflows/systest.yml index ad04eb2b..06799a0f 100644 --- a/.github/workflows/systest.yml +++ b/.github/workflows/systest.yml @@ -35,7 +35,7 @@ jobs: runs-on: [self-hosted, linux, x64, rust-cpu] timeout-minutes: 45 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -64,7 +64,7 @@ jobs: runs-on: [self-hosted, linux, x64, rust-cpu] timeout-minutes: 45 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -77,7 +77,7 @@ jobs: runs-on: [self-hosted, linux, x64, rust-cpu] timeout-minutes: 45 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -121,7 +121,7 @@ jobs: # jobs would be one people learn to ignore. timeout-minutes: 20 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -150,7 +150,7 @@ jobs: # mutated copy of the source, which is a second release build. timeout-minutes: 30 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 with: @@ -180,7 +180,7 @@ jobs: name: the installer names which varve will run (REQ-INSTALLSHADOW-001) runs-on: [self-hosted, linux, x64, rust-cpu] steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # A maintainer followed the documented install and ended up running a # DIFFERENT binary than the one it installed, because being on PATH is # not being first on it. varve refuses to claim success when PATH