diff --git a/.github/workflows/easyp.yml b/.github/workflows/easyp.yml index 7d2aa4e..3ca07d7 100644 --- a/.github/workflows/easyp.yml +++ b/.github/workflows/easyp.yml @@ -20,7 +20,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: EasyP Lint uses: easyp-tech/actions/lint@v1.1.1 with: @@ -36,7 +36,7 @@ jobs: if: github.ref_type != 'tag' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: EasyP Breaking diff --git a/.github/workflows/edge.yml b/.github/workflows/edge.yml index 2ae6d67..31b72da 100644 --- a/.github/workflows/edge.yml +++ b/.github/workflows/edge.yml @@ -45,18 +45,18 @@ jobs: needs: verify runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v3 + - uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ghcr.io/${{ github.repository }} tags: | @@ -70,7 +70,7 @@ jobs: # Not goreleaser: it builds from a tag and would refuse here. The # Dockerfile is the same one the release build uses. - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@v7 with: context: . push: true diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index e7afd40..02ffb94 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -32,9 +32,9 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: # Read the version from go.mod so this never drifts from the module. go-version-file: go.mod @@ -50,9 +50,9 @@ jobs: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -64,9 +64,9 @@ jobs: name: Tidy runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -101,9 +101,9 @@ jobs: --health-retries 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -117,9 +117,9 @@ jobs: name: Vulnerabilities runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -135,9 +135,9 @@ jobs: name: Chart runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: azure/setup-helm@v4 + - uses: azure/setup-helm@v5 # Templates are code nothing else compiles. These checks cover the two # ways that has bitten: a value rendered in a form the service cannot @@ -152,7 +152,7 @@ jobs: name: Secret scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -160,7 +160,7 @@ jobs: # organisation repositories, and refusing to run is worse than the scan # taking a few seconds longer. --redact so a finding does not print the # credential into a public build log. - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -174,15 +174,15 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true - name: Lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@v9 with: # golangci-lint refuses to start when it is built with an older Go # than the one go.mod targets, so this has to keep up with go.mod. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ebe840a..91e92b3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,24 +29,24 @@ jobs: # certificate, so nothing long-lived has to be stored as a secret. id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: # Read the version from go.mod: the pinned 1.24 had drifted from the # module's 1.26 and only worked via toolchain auto-download. @@ -82,7 +82,7 @@ jobs: uses: anchore/sbom-action/download-syft@v0 - name: Create release - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: # A major-series pin, not `latest`: an unpinned tool is how the lint # job broke, and a release pipeline is the worst place to find that @@ -118,9 +118,9 @@ jobs: permissions: packages: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: azure/setup-helm@v4 + - uses: azure/setup-helm@v5 - name: Package and push the chart run: |