From da7008ee998f9f293f79ade9a7f6defd1be1dd04 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 02:34:17 +0000 Subject: [PATCH 1/2] chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/act-image-repin.yml | 2 +- .github/workflows/action-pins.yml | 2 +- .github/workflows/build-cli.yaml | 2 +- .github/workflows/cli-install-selftest.yaml | 2 +- .github/workflows/e2e.yaml | 2 +- .github/workflows/fleet-reconcile.yaml | 2 +- .github/workflows/nightly-release.yaml | 2 +- .github/workflows/pr.yaml | 6 +++--- .github/workflows/release.yaml | 4 ++-- .github/workflows/validate.yaml | 8 ++++---- 10 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/act-image-repin.yml b/.github/workflows/act-image-repin.yml index 7048d89a..1e0aa348 100644 --- a/.github/workflows/act-image-repin.yml +++ b/.github/workflows/act-image-repin.yml @@ -101,7 +101,7 @@ jobs: - name: Set up Go if: steps.resolve.outputs.changed == 'true' - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: e2e/go.mod diff --git a/.github/workflows/action-pins.yml b/.github/workflows/action-pins.yml index 59ed4b39..e1a5d705 100644 --- a/.github/workflows/action-pins.yml +++ b/.github/workflows/action-pins.yml @@ -62,7 +62,7 @@ jobs: with: path: . key: anchor - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml index 7e5cfc9e..65c2c6d5 100644 --- a/.github/workflows/build-cli.yaml +++ b/.github/workflows/build-cli.yaml @@ -31,7 +31,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/cli-install-selftest.yaml b/.github/workflows/cli-install-selftest.yaml index d9965944..a045374e 100644 --- a/.github/workflows/cli-install-selftest.yaml +++ b/.github/workflows/cli-install-selftest.yaml @@ -72,7 +72,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 7f6ac1b2..e0abf087 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -153,7 +153,7 @@ jobs: # that triggered the run so we test what GitHub resolved. ref: ${{ github.event.inputs.ref || github.sha }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: # The e2e module declares its own toolchain (go 1.24). Drive the # installed Go straight from e2e/go.mod so the runner always matches diff --git a/.github/workflows/fleet-reconcile.yaml b/.github/workflows/fleet-reconcile.yaml index 2574165d..5ed71a4a 100644 --- a/.github/workflows/fleet-reconcile.yaml +++ b/.github/workflows/fleet-reconcile.yaml @@ -116,7 +116,7 @@ jobs: ref: ${{ inputs.cascade-ref || github.workflow_sha }} - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml index 68077fe7..7173b4af 100644 --- a/.github/workflows/nightly-release.yaml +++ b/.github/workflows/nightly-release.yaml @@ -202,7 +202,7 @@ jobs: # Check out with the PAT so the tag push below triggers Release. token: ${{ secrets.CASCADE_STATE_TOKEN }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 if: github.event.inputs.dry_run == 'true' with: go-version-file: go.mod diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 2d03c3b8..c4c3016c 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -64,7 +64,7 @@ jobs: fetch-tags: true fetch-depth: 0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -107,7 +107,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -133,7 +133,7 @@ jobs: # the changed governed source files a pin bump would land in. fetch-depth: 0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e500f77b..c8c8206d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -62,7 +62,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod @@ -119,7 +119,7 @@ jobs: - name: Set up Go if: steps.idem.outputs.skip != 'true' - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 28f91d5c..abe5bfff 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -49,7 +49,7 @@ jobs: fetch-tags: true fetch-depth: 0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -95,7 +95,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -111,7 +111,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -137,7 +137,7 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true From 913113b8a285fbcfa25327ba4fc8215007668c10 Mon Sep 17 00:00:00 2001 From: cascade-bot Date: Wed, 22 Jul 2026 02:36:31 +0000 Subject: [PATCH 2/2] ci: reconcile governed action pins Signed-off-by: cascade-bot --- .github/workflows/orchestrate.yaml | 15 +------ internal/generate/action_pins.yaml | 66 +++++++++++++++++++++++++----- 2 files changed, 56 insertions(+), 25 deletions(-) diff --git a/.github/workflows/orchestrate.yaml b/.github/workflows/orchestrate.yaml index 60ef16a9..4afaebae 100644 --- a/.github/workflows/orchestrate.yaml +++ b/.github/workflows/orchestrate.yaml @@ -108,19 +108,7 @@ jobs: if [[ "$HAS_OUTPUTS" == "false" ]]; then echo "_No outputs produced_" >> "$GITHUB_STEP_SUMMARY" fi - - name: Download cascade CLI (from source) - if: needs.build-cli.result == 'success' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: cascade-cli - path: .cascade-bin - - name: Install cascade CLI (from source) - if: needs.build-cli.result == 'success' - run: | - chmod +x .cascade-bin/cascade - echo "$GITHUB_WORKSPACE/.cascade-bin" >> "$GITHUB_PATH" - name: Setup CLI - if: needs.build-cli.result != 'success' uses: stablekernel/cascade/.github/actions/setup-cli@58c3d309faaf5028aa03900aded8424e738afb81 # v0.8.0 with: token: ${{ secrets.CASCADE_STATE_TOKEN }} @@ -145,12 +133,11 @@ jobs: action: update tag: ${{ needs.setup.outputs.version }} create_tag: 'true' - tag_only: 'true' environment: prerelease sha: ${{ needs.setup.outputs.head_sha }} changelog_file: ${{ runner.temp }}/cascade-changelog.md previous_tag: ${{ needs.setup.outputs.previous_tag }} - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ secrets.CASCADE_STATE_TOKEN }} - name: Dispatch Release Candidate Build if: ${{ github.server_url == 'https://github.com' }} env: diff --git a/internal/generate/action_pins.yaml b/internal/generate/action_pins.yaml index 727055ee..ddc11571 100644 --- a/internal/generate/action_pins.yaml +++ b/internal/generate/action_pins.yaml @@ -10,14 +10,58 @@ # sha is the 40-hex commit the tag/version resolves to. version is the precise # release the sha corresponds to, carried as the trailing uses: comment. actions: - actions/checkout: { tag: v7, sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, version: v7.0.0, emit: true } - actions/github-script: { tag: v9, sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3, version: v9.0.0, emit: true } - actions/download-artifact: { tag: v8, sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c, version: v8.0.1, emit: true } - actions/upload-artifact: { tag: v7, sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a, version: v7.0.1, emit: true } - actions/create-github-app-token: { tag: v3, sha: bcd2ba49218906704ab6c1aa796996da409d3eb1, version: v3.2.0, emit: true } - actions/cache: { tag: v6, sha: 55cc8345863c7cc4c66a329aec7e433d2d1c52a9, version: v6.1.0, emit: false } - actions/setup-go: { tag: v6, sha: 924ae3a1cded613372ab5595356fb5720e22ba16, version: v6.5.0, emit: false } - actions/setup-node: { tag: v6, sha: 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e, version: v6.4.0, emit: false } - actions/upload-pages-artifact: { tag: v5, sha: fc324d3547104276b827a68afc52ff2a11cc49c9, version: v5.0.0, emit: false } - actions/deploy-pages: { tag: v5, sha: cd2ce8fcbc39b97be8ca5fce6e763baed58fa128, version: v5.0.0, emit: false } - sigstore/cosign-installer: { tag: v4, sha: 6f9f17788090df1f26f669e9d70d6ae9567deba6, version: v4.1.2, emit: false } + actions/cache: + tag: v6 + sha: 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 + version: v6.1.0 + emit: false + actions/checkout: + tag: v7 + sha: 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + version: v7.0.0 + emit: true + actions/create-github-app-token: + tag: v3 + sha: bcd2ba49218906704ab6c1aa796996da409d3eb1 + version: v3.2.0 + emit: true + actions/deploy-pages: + tag: v5 + sha: cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 + version: v5.0.0 + emit: false + actions/download-artifact: + tag: v8 + sha: 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + version: v8.0.1 + emit: true + actions/github-script: + tag: v9 + sha: 3a2844b7e9c422d3c10d287c895573f7108da1b3 + version: v9.0.0 + emit: true + actions/setup-go: + tag: v6 + sha: b7ad1dad31e06c5925ef5d2fc7ad053ef454303e + version: v7.0.0 + emit: false + actions/setup-node: + tag: v6 + sha: 48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e + version: v6.4.0 + emit: false + actions/upload-artifact: + tag: v7 + sha: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + version: v7.0.1 + emit: true + actions/upload-pages-artifact: + tag: v5 + sha: fc324d3547104276b827a68afc52ff2a11cc49c9 + version: v5.0.0 + emit: false + sigstore/cosign-installer: + tag: v4 + sha: 6f9f17788090df1f26f669e9d70d6ae9567deba6 + version: v4.1.2 + emit: false