Skip to content

Commit bbecf0f

Browse files
authored
Pin GitHub Actions to commit SHAs and extend Dependabot to the 3.8 and 3.7 branches (#767)
1 parent 68cd0b1 commit bbecf0f

11 files changed

Lines changed: 147 additions & 48 deletions

File tree

.github/actions/setup-node/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,6 @@ runs:
55
using: "composite"
66
steps:
77
- name: Setup Node.js
8-
uses: actions/setup-node@v6
8+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
99
with:
1010
node-version: "22.x"

.github/dependabot.yml

Lines changed: 126 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
version: 2
22
updates:
33
- package-ecosystem: "github-actions"
4-
directory: "/"
4+
# Two entries are required: "/" is the special value that scans
5+
# .github/workflows (plus any root action.yml); "/.github/actions/*"
6+
# covers the composite actions, which each have their own action.yml.
7+
directories:
8+
- "/"
9+
- "/.github/actions/*"
510
schedule:
6-
interval: weekly
11+
interval: monthly
712
cooldown:
813
default-days: 7
914
groups:
@@ -15,13 +20,9 @@ updates:
1520
directories:
1621
- "/js/**"
1722
schedule:
18-
interval: "weekly"
19-
open-pull-requests-limit: 5
23+
interval: monthly
2024
cooldown:
2125
default-days: 7
22-
semver-major-days: 30
23-
semver-minor-days: 14
24-
semver-patch-days: 7
2526
groups:
2627
js-minor-and-patch:
2728
update-types: ["minor", "patch"]
@@ -32,13 +33,9 @@ updates:
3233
directories:
3334
- "/python/**"
3435
schedule:
35-
interval: "weekly"
36-
open-pull-requests-limit: 3
36+
interval: monthly
3737
cooldown:
3838
default-days: 7
39-
semver-major-days: 30
40-
semver-minor-days: 14
41-
semver-patch-days: 7
4239
groups:
4340
python-minor-and-patch:
4441
update-types: ["minor", "patch"]
@@ -49,13 +46,9 @@ updates:
4946
directories:
5047
- "/java/**"
5148
schedule:
52-
interval: "weekly"
53-
open-pull-requests-limit: 5
49+
interval: monthly
5450
cooldown:
5551
default-days: 7
56-
semver-major-days: 30
57-
semver-minor-days: 14
58-
semver-patch-days: 7
5952
groups:
6053
java-minor-and-patch:
6154
update-types: ["minor", "patch"]
@@ -66,13 +59,9 @@ updates:
6659
directories:
6760
- "/csharp/**"
6861
schedule:
69-
interval: "weekly"
70-
open-pull-requests-limit: 5
62+
interval: monthly
7163
cooldown:
7264
default-days: 7
73-
semver-major-days: 30
74-
semver-minor-days: 14
75-
semver-patch-days: 7
7665
groups:
7766
dotnet-minor-and-patch:
7867
update-types: ["minor", "patch"]
@@ -83,15 +72,125 @@ updates:
8372
directories:
8473
- "/swift/**"
8574
schedule:
86-
interval: "weekly"
87-
open-pull-requests-limit: 3
75+
interval: monthly
8876
cooldown:
8977
default-days: 7
90-
semver-major-days: 30
91-
semver-minor-days: 14
92-
semver-patch-days: 7
9378
groups:
9479
swift-minor-and-patch:
9580
update-types: ["minor", "patch"]
9681
swift-major:
9782
update-types: ["major"]
83+
84+
# The blocks below mirror the ones above with target-branch: "3.8". 3.8 is a
85+
# stable release branch, so major version updates are ignored there. Dependabot
86+
# reads this config from the default branch only, and security updates always
87+
# target the default branch (they cannot be pointed at 3.8).
88+
- package-ecosystem: "github-actions"
89+
# Two entries are required: "/" is the special value that scans
90+
# .github/workflows (plus any root action.yml); "/.github/actions/*"
91+
# covers the composite actions, which each have their own action.yml.
92+
directories:
93+
- "/"
94+
- "/.github/actions/*"
95+
target-branch: "3.8"
96+
schedule:
97+
interval: monthly
98+
cooldown:
99+
default-days: 7
100+
groups:
101+
github-actions:
102+
patterns:
103+
- "*"
104+
105+
- package-ecosystem: "npm"
106+
directories:
107+
- "/js/**"
108+
target-branch: "3.8"
109+
schedule:
110+
interval: monthly
111+
cooldown:
112+
default-days: 7
113+
ignore:
114+
- dependency-name: "*"
115+
update-types: ["version-update:semver-major"]
116+
groups:
117+
js-minor-and-patch:
118+
update-types: ["minor", "patch"]
119+
120+
- package-ecosystem: "pip"
121+
directories:
122+
- "/python/**"
123+
target-branch: "3.8"
124+
schedule:
125+
interval: monthly
126+
cooldown:
127+
default-days: 7
128+
ignore:
129+
- dependency-name: "*"
130+
update-types: ["version-update:semver-major"]
131+
groups:
132+
python-minor-and-patch:
133+
update-types: ["minor", "patch"]
134+
135+
- package-ecosystem: "gradle"
136+
directories:
137+
- "/java/**"
138+
target-branch: "3.8"
139+
schedule:
140+
interval: monthly
141+
cooldown:
142+
default-days: 7
143+
ignore:
144+
- dependency-name: "*"
145+
update-types: ["version-update:semver-major"]
146+
groups:
147+
java-minor-and-patch:
148+
update-types: ["minor", "patch"]
149+
150+
- package-ecosystem: "nuget"
151+
directories:
152+
- "/csharp/**"
153+
target-branch: "3.8"
154+
schedule:
155+
interval: monthly
156+
cooldown:
157+
default-days: 7
158+
ignore:
159+
- dependency-name: "*"
160+
update-types: ["version-update:semver-major"]
161+
groups:
162+
dotnet-minor-and-patch:
163+
update-types: ["minor", "patch"]
164+
165+
- package-ecosystem: "swift"
166+
directories:
167+
- "/swift/**"
168+
target-branch: "3.8"
169+
schedule:
170+
interval: monthly
171+
cooldown:
172+
default-days: 7
173+
ignore:
174+
- dependency-name: "*"
175+
update-types: ["version-update:semver-major"]
176+
groups:
177+
swift-minor-and-patch:
178+
update-types: ["minor", "patch"]
179+
180+
# 3.7 is in maintenance, so only its GitHub Actions are kept up to date.
181+
- package-ecosystem: "github-actions"
182+
# Two entries are required: "/" is the special value that scans
183+
# .github/workflows (plus any root action.yml); "/.github/actions/*"
184+
# covers the composite actions, which each have their own action.yml.
185+
directories:
186+
- "/"
187+
- "/.github/actions/*"
188+
target-branch: "3.7"
189+
schedule:
190+
interval: monthly
191+
cooldown:
192+
default-days: 7
193+
groups:
194+
github-actions:
195+
patterns:
196+
- "*"

.github/workflows/ci.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,18 @@ jobs:
3030
runs-on: ${{ matrix.os }}
3131
steps:
3232
- name: Checkout repository
33-
uses: actions/checkout@v7.0.0
33+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3434

3535
- name: Setup .NET 8
36-
uses: actions/setup-dotnet@v5.3.0
36+
uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
3737
with:
3838
dotnet-version: 8.x
3939

4040
- name: Setup Node.js
4141
uses: ./.github/actions/setup-node
4242

4343
- name: Setup Java
44-
uses: actions/setup-java@v5.3.0
44+
uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
4545
with:
4646
distribution: "oracle"
4747
java-version: "17"
@@ -170,7 +170,7 @@ jobs:
170170
distro: [ubuntu24.04, ubuntu26.04, debian12, debian13, rocky9, rocky10, amzn2023]
171171
steps:
172172
- name: Checkout repository
173-
uses: actions/checkout@v7.0.0
173+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
174174

175175
- name: Build Docker image
176176
run: |
@@ -199,10 +199,10 @@ jobs:
199199

200200
steps:
201201
- name: Checkout repository
202-
uses: actions/checkout@v7.0.0
202+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
203203

204204
- name: Setup Java
205-
uses: actions/setup-java@v5.3.0
205+
uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
206206
with:
207207
distribution: "oracle"
208208
java-version: "17"

.github/workflows/cpp.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-24.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v7.0.0
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717

1818
- name: Install Clang Format
1919
run: |
@@ -44,7 +44,7 @@ jobs:
4444
clang-tidy-19 --version
4545
4646
- name: Checkout repository
47-
uses: actions/checkout@v7.0.0
47+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
4848

4949
- name: Install Nightly Ice Builds
5050
uses: ./.github/actions/install-nightly-ice
@@ -66,7 +66,7 @@ jobs:
6666
runs-on: ubuntu-24.04
6767
steps:
6868
- name: Checkout repository
69-
uses: actions/checkout@v7.0.0
69+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
7070

7171
# Read .vscode/settings.json. Ensure each entry in cmake.sourceDirectory is valid.
7272
- name: Check .vscode/settings.json cmake.sourceDirectory entries

.github/workflows/devcontainer.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
runs-on: ubuntu-24.04
1616
steps:
1717
- name: Checkout repository
18-
uses: actions/checkout@v7.0.0
18+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1919

2020
- name: Build dev containers
2121
run: |

.github/workflows/dotnet.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-24.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v7.0.0
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717

1818
- name: Run .NET format
1919
working-directory: csharp

.github/workflows/java.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
runs-on: ubuntu-24.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v7.0.0
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717

1818
- name: Setup Java
19-
uses: actions/setup-java@v5.3.0
19+
uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
2020
with:
2121
distribution: "oracle"
2222
java-version: "17"

.github/workflows/javascript.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-24.04
1313
steps:
1414
- name: Checkout repository
15-
uses: actions/checkout@v7.0.0
15+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1616

1717
- name: Setup Node.js
1818
uses: ./.github/actions/setup-node

.github/workflows/markdown.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
runs-on: ubuntu-24.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v7.0.0
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717

1818
- name: Setup Node.js
19-
uses: actions/setup-node@v6
19+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
2020
with:
2121
node-version: "lts/*"
2222

.github/workflows/python.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ubuntu-24.04
1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v7.0.0
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
1717

1818
- name: Install Ruff
1919
run: pip install ruff
@@ -28,13 +28,13 @@ jobs:
2828
runs-on: macos-26
2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@v7.0.0
31+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3232

3333
- name: Install pyright
3434
run: npm install -g pyright
3535

3636
- name: Install the latest version of uv
37-
uses: astral-sh/setup-uv@v7
37+
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
3838

3939
- name: Run pyright on each demo
4040
run: |

0 commit comments

Comments
 (0)