diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1c34cf3fd5..5564499e32 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,8 @@ updates: applies-to: security-updates patterns: - '*' + cooldown: + default-days: 7 - package-ecosystem: 'npm' # Single yarn workspace root: yarn.lock at `/` covers every workspace package. diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml index 6055072e58..bf10e7ce23 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/bump-version.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.CI_GITHUB_TOKEN }} diff --git a/.github/workflows/bundle-size.baseline.yml b/.github/workflows/bundle-size.baseline.yml index 72fa92eaa9..14a6b7e97e 100644 --- a/.github/workflows/bundle-size.baseline.yml +++ b/.github/workflows/bundle-size.baseline.yml @@ -17,11 +17,11 @@ jobs: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -36,7 +36,7 @@ jobs: run: yarn monosize upload-report --branch main --commit-sha ${{ github.sha }} - name: Upload report artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: monosize-report path: dist/bundle-size-report.json diff --git a/.github/workflows/cocoapods-publish.yml b/.github/workflows/cocoapods-publish.yml index e6144142eb..47ae2f1bea 100644 --- a/.github/workflows/cocoapods-publish.yml +++ b/.github/workflows/cocoapods-publish.yml @@ -10,7 +10,7 @@ jobs: runs-on: macos-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Deploy to CocoaPods run: | diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 73e4e0676d..25cde8c7d5 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -19,14 +19,14 @@ jobs: # If you do not check out your code, Copilot will do this for you. steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - run: corepack enable - name: Set up Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' diff --git a/.github/workflows/deploy-docsite.yml b/.github/workflows/deploy-docsite.yml index d8bfec30b3..d9ad338d17 100644 --- a/.github/workflows/deploy-docsite.yml +++ b/.github/workflows/deploy-docsite.yml @@ -38,13 +38,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -58,11 +58,11 @@ jobs: yarn nx run docsite:extract-storybook-llms - name: Setup Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: packages/docsite/storybook-static - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/pr-summary-comment.yml b/.github/workflows/pr-summary-comment.yml index df6e39353c..a07af59018 100644 --- a/.github/workflows/pr-summary-comment.yml +++ b/.github/workflows/pr-summary-comment.yml @@ -49,7 +49,7 @@ jobs: - name: Check for docsite artifact if: steps.pr-info.outputs.pr_number != '' id: check-docsite - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: docsite-storybook-build path: docsite-build diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index b29662f155..d3a8264509 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check asset directories are valid for Windows run: | @@ -33,7 +33,7 @@ jobs: name: Validate Asset Fills runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check that all SVGs have the right fill run: | @@ -52,11 +52,11 @@ jobs: name: Validate PR Title runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -74,11 +74,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -94,11 +94,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -110,7 +110,7 @@ jobs: working-directory: importer - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: temurin java-version: 11 @@ -170,14 +170,14 @@ jobs: actions: 'read' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 filter: tree:0 - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -251,14 +251,14 @@ jobs: fi - name: Upload icon-app build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: icon-app-build path: packages/icon-app/dist/ retention-days: 3 - name: Upload docsite build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: docsite-storybook-build path: packages/docsite/storybook-static/ diff --git a/.github/workflows/publish-prerelease.yml b/.github/workflows/publish-prerelease.yml index 261bb5569c..ce48d5edf2 100644 --- a/.github/workflows/publish-prerelease.yml +++ b/.github/workflows/publish-prerelease.yml @@ -45,7 +45,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -62,7 +62,7 @@ jobs: - run: corepack enable - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' diff --git a/.github/workflows/publish-standalone.yml b/.github/workflows/publish-standalone.yml index 6dd0605b3a..85d3dc44cc 100644 --- a/.github/workflows/publish-standalone.yml +++ b/.github/workflows/publish-standalone.yml @@ -39,12 +39,12 @@ jobs: - name: Generate a token id: generate-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.GH_FLUENT_CI_APP_ID }} private-key: ${{ secrets.GH_FLUENT_CI_PRIVATE_KEY }} - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ steps.generate-token.outputs.token }} # Nx (release changelog / affected) needs the full commit history to resolve @@ -59,7 +59,7 @@ jobs: - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -260,7 +260,7 @@ jobs: - name: Upload changed package files if: ${{ inputs.dry-run }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: changed-packages-files path: /tmp/changed-packages/ diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 013413f5b5..ec441a2e8a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -35,12 +35,12 @@ jobs: steps: - name: Generate a token id: generate-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ secrets.GH_FLUENT_CI_APP_ID }} private-key: ${{ secrets.GH_FLUENT_CI_PRIVATE_KEY }} - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ steps.generate-token.outputs.token }} # Nx (release changelog / affected) needs the full commit history to resolve @@ -98,7 +98,7 @@ jobs: - run: corepack enable - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22.x cache: 'yarn' @@ -197,7 +197,7 @@ jobs: working-directory: importer - name: Setup Java - uses: actions/setup-java@v5 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: distribution: temurin java-version: 11 @@ -320,7 +320,7 @@ jobs: - name: Upload changed package files if: ${{ inputs.dry-run }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: changed-packages-files path: /tmp/changed-packages/