diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 511ba4bb..167bd938 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: name: Convention rules runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: # 插件 manifest 检查以最近的 v* 标签为基准 fetch-depth: 0 @@ -40,7 +40,7 @@ jobs: matrix: os: [ubuntu-22.04, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install Linux dependencies if: runner.os == 'Linux' run: | @@ -59,9 +59,9 @@ jobs: name: Web runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7 + - uses: actions/checkout@v7.0.1 + - uses: pnpm/action-setup@v6.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version: 22 cache: pnpm @@ -91,8 +91,8 @@ jobs: run: working-directory: apps/server steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 + - uses: actions/checkout@v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: # setup-go v6 exports GOTOOLCHAIN=local, so pin the exact version # go.mod requires; '1.26.x' may resolve to an older patch. @@ -120,14 +120,14 @@ jobs: matrix: os: [ubuntu-22.04, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install Linux dependencies if: runner.os == 'Linux' run: | sudo apt-get update sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7 + - uses: pnpm/action-setup@v6.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version: 22 cache: pnpm diff --git a/.github/workflows/plugin-stats-deploy.yml b/.github/workflows/plugin-stats-deploy.yml index bd143668..12354b15 100644 --- a/.github/workflows/plugin-stats-deploy.yml +++ b/.github/workflows/plugin-stats-deploy.yml @@ -30,10 +30,10 @@ jobs: run: working-directory: apps/server steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.26.10' check-latest: true diff --git a/.github/workflows/plugins.yml b/.github/workflows/plugins.yml index 774d7d3b..a37b74e5 100644 --- a/.github/workflows/plugins.yml +++ b/.github/workflows/plugins.yml @@ -44,14 +44,14 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 - - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Install WASM target and build trusted tools without signing secrets run: | # Pin a specific toolchain: a channel name (stable) makes rustup sync @@ -204,7 +204,7 @@ jobs: while IFS= read -r slug; do target/release/xtask plugin pack "$slug" --unsigned --out dist/unsigned done < dist/plugins/pending.txt - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: plugin-candidates-${{ github.run_id }} path: | @@ -222,7 +222,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Build the trusted signing tool on a clean runner @@ -230,7 +230,7 @@ jobs: cargo build --locked --release -p xtask cargo test --locked -p xtask shellcheck scripts/cos-setup.sh scripts/publish-plugins.sh scripts/migrate-plugin-assets.sh - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: plugin-candidates-${{ github.run_id }} path: dist diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3e53d84b..4136b020 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,7 +24,7 @@ jobs: outputs: body: ${{ steps.notes.outputs.body }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - uses: dtolnay/rust-toolchain@stable @@ -68,14 +68,14 @@ jobs: target: x86_64-unknown-linux-gnu runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install Linux dependencies if: runner.os == 'Linux' run: | sudo apt-get update sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf - - uses: pnpm/action-setup@v6 - - uses: actions/setup-node@v7 + - uses: pnpm/action-setup@v6.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version: 22 cache: pnpm diff --git a/.github/workflows/site-deploy.yml b/.github/workflows/site-deploy.yml index 471f184e..929f3bd8 100644 --- a/.github/workflows/site-deploy.yml +++ b/.github/workflows/site-deploy.yml @@ -34,16 +34,16 @@ jobs: name: Build website runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: # 插件详情页的版本历史来自 git 提交记录 fetch-depth: 0 - - uses: pnpm/action-setup@v6 + - uses: pnpm/action-setup@v6.1.0 with: # docs 是独立 workspace（自带 pnpm-workspace.yaml 与锁文件）， # 版本仍取自根 package.json 的 packageManager 声明 working-directory: docs - - uses: actions/setup-node@v6 + - uses: actions/setup-node@v7.1.0 with: node-version: 22 cache: pnpm @@ -60,7 +60,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: pnpm build - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@v5 with: path: docs/out @@ -74,4 +74,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5