diff --git a/.github/workflows/build-fleetctl-msi.yml b/.github/workflows/build-fleetctl-msi.yml index 3ba706624a..57fc1fbc63 100644 --- a/.github/workflows/build-fleetctl-msi.yml +++ b/.github/workflows/build-fleetctl-msi.yml @@ -199,7 +199,7 @@ jobs: - name: Attest MSI continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: dist/fleetctl_v${{ steps.extract_version.outputs.msi_version }}_windows_${{ matrix.arch }}.msi push-to-registry: false diff --git a/.github/workflows/build-fleetctl-pkg.yml b/.github/workflows/build-fleetctl-pkg.yml index f306167831..ba0e6ff5da 100644 --- a/.github/workflows/build-fleetctl-pkg.yml +++ b/.github/workflows/build-fleetctl-pkg.yml @@ -219,7 +219,7 @@ jobs: retention-days: 7 - name: Attest package - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: dist/fleetctl_v${{ steps.extract_version.outputs.version }}_mac.pkg push-to-registry: false diff --git a/.github/workflows/build-fleetd-base-msi.yml b/.github/workflows/build-fleetd-base-msi.yml index af33536dfc..2b69620a88 100644 --- a/.github/workflows/build-fleetd-base-msi.yml +++ b/.github/workflows/build-fleetd-base-msi.yml @@ -65,7 +65,7 @@ jobs: mv fleet-osquery*.msi fleetd-base.msi - name: Upload fleetd-base.msi for code signing - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows path: fleetd-base.msi @@ -117,7 +117,7 @@ jobs: jq -e . >/dev/null 2>&1 <<< $(cat meta.json) - name: Upload meta.json - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: meta.json path: meta.json \ No newline at end of file diff --git a/.github/workflows/check-automated-doc.yml b/.github/workflows/check-automated-doc.yml index 5926edd8c9..54ee07df79 100644 --- a/.github/workflows/check-automated-doc.yml +++ b/.github/workflows/check-automated-doc.yml @@ -41,7 +41,7 @@ jobs: egress-policy: audit - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false diff --git a/.github/workflows/code-sign-windows.yml b/.github/workflows/code-sign-windows.yml index 3a1a185ef8..d2861f91db 100644 --- a/.github/workflows/code-sign-windows.yml +++ b/.github/workflows/code-sign-windows.yml @@ -100,12 +100,12 @@ jobs: - name: Attest binary if: ${{ inputs.attest }} continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: ${{ inputs.filename }} - name: Upload signed artifact - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: ${{ inputs.upload_name }} path: ${{ inputs.filename }} diff --git a/.github/workflows/collect-eng-metrics-test.yml b/.github/workflows/collect-eng-metrics-test.yml index 804010436c..8644a68a7b 100644 --- a/.github/workflows/collect-eng-metrics-test.yml +++ b/.github/workflows/collect-eng-metrics-test.yml @@ -37,12 +37,12 @@ jobs: egress-policy: audit - name: Checkout repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24.14.0' cache: 'npm' diff --git a/.github/workflows/collect-eng-metrics.yml b/.github/workflows/collect-eng-metrics.yml index c861c93261..5253a9f2dd 100644 --- a/.github/workflows/collect-eng-metrics.yml +++ b/.github/workflows/collect-eng-metrics.yml @@ -28,12 +28,12 @@ jobs: egress-policy: audit - name: Checkout code - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: '24.14.0' cache: 'npm' diff --git a/.github/workflows/db-upgrade-test.yml b/.github/workflows/db-upgrade-test.yml index 93d4f63079..287620619e 100644 --- a/.github/workflows/db-upgrade-test.yml +++ b/.github/workflows/db-upgrade-test.yml @@ -31,7 +31,7 @@ jobs: egress-policy: audit - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: persist-credentials: false diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 16ac6989f3..b3f2033fc2 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -47,7 +47,7 @@ jobs: fi - name: Check links - uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1.0.15 + uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # 1.0.15 with: use-quiet-mode: 'yes' config-file: .github/workflows/config/markdown-link-check-config.json diff --git a/.github/workflows/fleetd-tuf.yml b/.github/workflows/fleetd-tuf.yml index dd5f5346dc..e8a7ec2b2c 100644 --- a/.github/workflows/fleetd-tuf.yml +++ b/.github/workflows/fleetd-tuf.yml @@ -31,7 +31,7 @@ jobs: egress-policy: audit - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml index 8f273a7743..555c4753d6 100644 --- a/.github/workflows/generate-desktop-targets.yml +++ b/.github/workflows/generate-desktop-targets.yml @@ -92,7 +92,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "extracted/Fleet\ Desktop.app/Contents/MacOS/*" @@ -102,7 +102,7 @@ jobs: tar -czf ../desktop.app.tar.gz ./* - name: Upload desktop.app.tar.gz - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: desktop.app.tar.gz path: desktop.app.tar.gz @@ -134,7 +134,7 @@ jobs: make desktop-windows - name: Upload fleet-desktop.exe - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows path: fleet-desktop.exe @@ -184,7 +184,7 @@ jobs: make desktop-windows-arm64 - name: Upload fleet-desktop.exe - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows-arm64 path: fleet-desktop.exe @@ -240,12 +240,12 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "desktop.tar.gz" - name: Upload desktop.tar.gz - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: desktop.tar.gz path: desktop.tar.gz @@ -282,12 +282,12 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: 'desktop.tar.gz' - name: Upload desktop.tar.gz - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: desktop-arm64.tar.gz path: desktop.tar.gz diff --git a/.github/workflows/generate-osqueryd-targets.yml b/.github/workflows/generate-osqueryd-targets.yml index 280552b23f..5cedf4e397 100644 --- a/.github/workflows/generate-osqueryd-targets.yml +++ b/.github/workflows/generate-osqueryd-targets.yml @@ -59,7 +59,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "extracted/osquery.app/Contents/MacOS/*" @@ -101,7 +101,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "opt/osquery/bin/osqueryd" @@ -142,7 +142,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "opt/osquery/bin/osqueryd" @@ -181,7 +181,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: C:\temp\osquery\osqueryd\osqueryd.exe @@ -224,7 +224,7 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: osqueryd.exe diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml index e41ed94e9e..9811e27821 100644 --- a/.github/workflows/goreleaser-fleet.yaml +++ b/.github/workflows/goreleaser-fleet.yaml @@ -96,7 +96,7 @@ jobs: APPLE_APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }} - name: Attest binaries and archives - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "dist/**" @@ -117,7 +117,7 @@ jobs: echo "digest_fleetctl=$digest_fleetctl" >> "$GITHUB_OUTPUT" - name: Attest Fleet image - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 continue-on-error: true with: subject-digest: ${{steps.image_digests.outputs.digest_fleet}} @@ -125,7 +125,7 @@ jobs: push-to-registry: true - name: Attest FleetCtl image - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 continue-on-error: true with: subject-digest: ${{steps.image_digests.outputs.digest_fleetctl}} @@ -276,7 +276,7 @@ jobs: - name: Attest package continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: dist/fleetctl_v*_mac.pkg @@ -385,7 +385,7 @@ jobs: - name: Attest MSI continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: dist/fleetctl_v${{ steps.version.outputs.version }}_windows_${{ diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml index 8499c6d79f..e72ca48026 100644 --- a/.github/workflows/goreleaser-orbit.yaml +++ b/.github/workflows/goreleaser-orbit.yaml @@ -70,12 +70,12 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "dist/orbit-macos_darwin_all/orbit" - name: Upload - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: orbit-macos path: dist/orbit-macos_darwin_all/orbit @@ -118,12 +118,12 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "dist/orbit_linux_amd64_v1/orbit" - name: Upload - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: orbit-linux path: dist/orbit_linux_amd64_v1/orbit @@ -163,12 +163,12 @@ jobs: - name: Attest binary continue-on-error: true - uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0 + uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0 with: subject-path: "dist/orbit_linux_arm64_v8.0/orbit" - name: Upload - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: orbit-linux-arm64 path: dist/orbit_linux_arm64_v8.0/orbit @@ -207,7 +207,7 @@ jobs: run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows.yml # v2.4.4 - name: Upload - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows path: dist/orbit_windows_amd64_v1/orbit.exe @@ -264,7 +264,7 @@ jobs: run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows-arm64.yml # v2.4.4 - name: Upload - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows-arm64 path: dist/orbit_windows_arm64_v8.0/orbit.exe diff --git a/.github/workflows/release-fleetd-base.yml b/.github/workflows/release-fleetd-base.yml index b49987070d..2f2f2cf97a 100644 --- a/.github/workflows/release-fleetd-base.yml +++ b/.github/workflows/release-fleetd-base.yml @@ -251,7 +251,7 @@ jobs: mv fleet-osquery*.msi fleetd-base.msi - name: Upload fleetd-base.msi for code signing - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: unsigned-windows path: fleetd-base.msi diff --git a/.github/workflows/test-db-changes.yml b/.github/workflows/test-db-changes.yml index 9c272effd2..a4ddc694a3 100644 --- a/.github/workflows/test-db-changes.yml +++ b/.github/workflows/test-db-changes.yml @@ -36,7 +36,7 @@ jobs: egress-policy: audit - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/test-mock-changes.yml b/.github/workflows/test-mock-changes.yml index 5f74a61019..276d1a60b5 100644 --- a/.github/workflows/test-mock-changes.yml +++ b/.github/workflows/test-mock-changes.yml @@ -35,7 +35,7 @@ jobs: egress-policy: audit - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/test-puppet.yml b/.github/workflows/test-puppet.yml index 76ec953ab8..3fee05d86e 100644 --- a/.github/workflows/test-puppet.yml +++ b/.github/workflows/test-puppet.yml @@ -37,7 +37,7 @@ jobs: run: brew install --cask puppetlabs/puppet/pdk - name: Checkout Code - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml index 97c136277a..66b92823cb 100644 --- a/.github/zizmor-gate.yml +++ b/.github/zizmor-gate.yml @@ -25,7 +25,5 @@ rules: - fleet-and-orbit.yml - generate-osqueryd-targets.yml - goreleaser-fleet.yaml - ref-version-mismatch: # 44 findings (online audit) - disable: true template-injection: # 234 findings disable: true