From 33ecd2ae11e1c3cf33b8d0c898cfd1146349566e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:52:37 +0000 Subject: [PATCH 1/2] chore(deps): bump the github-actions group across 1 directory with 6 updates Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6` | `7` | | [extractions/setup-just](https://github.com/extractions/setup-just) | `3` | `4` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2` | `3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5` | `7` | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `4` | `6` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `astral-sh/setup-uv` from 6 to 7 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/v6...v7) Updates `extractions/setup-just` from 3 to 4 - [Release notes](https://github.com/extractions/setup-just/releases) - [Commits](https://github.com/extractions/setup-just/compare/v3...v4) Updates `softprops/action-gh-release` from 2 to 3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) Updates `actions/upload-artifact` from 5 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v5...v7) Updates `aws-actions/configure-aws-credentials` from 4 to 6 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: extractions/setup-just dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/main.yml | 36 +++++++++++++-------------- .github/workflows/preview-docs.yml | 6 ++--- .github/workflows/snyk.yml | 4 +-- .github/workflows/uv-lock-upgrade.yml | 2 +- 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 40fc6e580..dc14595ee 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -33,13 +33,13 @@ jobs: runs-on: ${{ matrix.os }} name: test (py${{ matrix.python-version }} ${{ matrix.os }}) steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" - - uses: extractions/setup-just@v3 + - uses: extractions/setup-just@v4 # Fail fast if uv.lock has drifted from pyproject.toml. - run: uv lock --locked - run: just lint @@ -55,13 +55,13 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" - - uses: extractions/setup-just@v3 + - uses: extractions/setup-just@v4 - run: just lint # --upgrade forces a fresh resolve (ignoring the lock) so prereleases are # actually exercised; plain `--prerelease allow` against the lock is a no-op. @@ -75,13 +75,13 @@ jobs: package_name: ["rsconnect_python", "rsconnect"] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" - - uses: extractions/setup-just@v3 + - uses: extractions/setup-just@v4 - run: uv sync --group test - name: assert tag matches pyproject version if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') @@ -114,7 +114,7 @@ jobs: uv run --no-project --with "$WHL" rsconnect version uv run --no-project --with "$WHL" rsconnect --help - name: create github release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && matrix.package_name == 'rsconnect_python' with: files: | @@ -127,20 +127,20 @@ jobs: needs: test-python-versions runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" - - uses: extractions/setup-just@v3 + - uses: extractions/setup-just@v4 - name: build docs run: just docs - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v7 with: name: docs path: site/ - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@v6 id: creds with: role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} @@ -148,7 +148,7 @@ jobs: - if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: just sync-latest-docs-to-s3 - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: role-to-assume: ${{ secrets.DOCS_AWS_ROLE }} aws-region: us-east-1 @@ -174,8 +174,8 @@ jobs: env: python-version: '3.13' steps: - - uses: actions/checkout@v6 - - uses: astral-sh/setup-uv@v6 + - uses: actions/checkout@v7 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" # Prepare the environment on the runner BEFORE entering with-connect, so diff --git a/.github/workflows/preview-docs.yml b/.github/workflows/preview-docs.yml index c85ffeb3e..522048f10 100644 --- a/.github/workflows/preview-docs.yml +++ b/.github/workflows/preview-docs.yml @@ -16,13 +16,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v6 + - uses: astral-sh/setup-uv@v7 with: version: ">=0.9.0" - - uses: extractions/setup-just@v3 + - uses: extractions/setup-just@v4 - name: Install and Build if: github.event.action != 'closed' # skip the build if the PR has been closed diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 2425aac84..4311cddaf 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -16,10 +16,10 @@ jobs: snyk-monitor: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up uv and Python - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@v7 with: python-version: '3.11' activate-environment: true diff --git a/.github/workflows/uv-lock-upgrade.yml b/.github/workflows/uv-lock-upgrade.yml index 35b73ba93..5b5b73ae3 100644 --- a/.github/workflows/uv-lock-upgrade.yml +++ b/.github/workflows/uv-lock-upgrade.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@v7 with: persist-credentials: false - - uses: astral-sh/setup-uv@v10.3.0 + - uses: astral-sh/setup-uv@v7 - name: Upgrade uv.lock id: upgrade run: | From f2dde93da8501adf2766b73898f772b141da3825 Mon Sep 17 00:00:00 2001 From: Neal Richardson Date: Wed, 14 Oct 2026 10:03:24 -0400 Subject: [PATCH 2/2] ci: pin all actions to commit SHAs; use setup-uv v10.3.0 setup-uv stopped publishing major tags after v7, so dependabot proposed @v7 everywhere (downgrading uv-lock-upgrade's v10.3.0). Pin every action to a full commit SHA with a version comment, which dependabot tracks by full semver tag. Also unify actions/checkout on v7.0.1, and move snyk/actions/setup off @master to v1.0.0. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/main.yml | 42 +++++++++++++-------------- .github/workflows/preview-docs.yml | 8 ++--- .github/workflows/snyk.yml | 6 ++-- .github/workflows/uv-lock-upgrade.yml | 8 ++--- 4 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index dc14595ee..0dd80a1ff 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -33,20 +33,20 @@ jobs: runs-on: ${{ matrix.os }} name: test (py${{ matrix.python-version }} ${{ matrix.os }}) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" - - uses: extractions/setup-just@v4 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 # Fail fast if uv.lock has drifted from pyproject.toml. - run: uv lock --locked - run: just lint - run: uv run --python ${{ matrix.python-version }} --group test rsconnect version - run: just test ${{ matrix.python-version }} - if: github.event_name == 'pull_request' && matrix.python-version == '3.8' - uses: orgoro/coverage@v3 + uses: orgoro/coverage@d77626a5fa35d39123e86d6c62907fabe2491496 # v3 with: coverageFile: coverage.xml token: ${{ secrets.GITHUB_TOKEN }} @@ -55,13 +55,13 @@ jobs: runs-on: ubuntu-latest continue-on-error: true steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" - - uses: extractions/setup-just@v4 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 - run: just lint # --upgrade forces a fresh resolve (ignoring the lock) so prereleases are # actually exercised; plain `--prerelease allow` against the lock is a no-op. @@ -75,13 +75,13 @@ jobs: package_name: ["rsconnect_python", "rsconnect"] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" - - uses: extractions/setup-just@v4 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 - run: uv sync --group test - name: assert tag matches pyproject version if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') @@ -114,33 +114,33 @@ jobs: uv run --no-project --with "$WHL" rsconnect version uv run --no-project --with "$WHL" rsconnect --help - name: create github release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && matrix.package_name == 'rsconnect_python' with: files: | dist/*.whl token: ${{ secrets.GITHUB_TOKEN }} - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 docs: needs: test-python-versions runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" - - uses: extractions/setup-just@v4 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 - name: build docs run: just docs - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: docs path: site/ - - uses: aws-actions/configure-aws-credentials@v6 + - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 id: creds with: role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} @@ -148,7 +148,7 @@ jobs: - if: github.event_name == 'push' && github.ref == 'refs/heads/main' run: just sync-latest-docs-to-s3 - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') - uses: aws-actions/configure-aws-credentials@v6 + uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.DOCS_AWS_ROLE }} aws-region: us-east-1 @@ -174,8 +174,8 @@ jobs: env: python-version: '3.13' steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" # Prepare the environment on the runner BEFORE entering with-connect, so @@ -183,7 +183,7 @@ jobs: - run: uv sync --python ${{ env.python-version }} --group test - run: uv run --no-sync rsconnect version - name: Run integration tests - uses: posit-dev/with-connect@main + uses: posit-dev/with-connect@0783dabdd24e360e985a4588ce1239c3dc31c542 # main with: version: ${{ matrix.version }} # License file valid until 2026-12-05 diff --git a/.github/workflows/preview-docs.yml b/.github/workflows/preview-docs.yml index 522048f10..3c0f0009c 100644 --- a/.github/workflows/preview-docs.yml +++ b/.github/workflows/preview-docs.yml @@ -16,19 +16,19 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: ">=0.9.0" - - uses: extractions/setup-just@v4 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 - name: Install and Build if: github.event.action != 'closed' # skip the build if the PR has been closed run: just docs - name: Deploy preview - uses: rossjrw/pr-preview-action@v1 + uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1.8.1 with: source-dir: ./site/ diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 4311cddaf..497215a49 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -16,10 +16,10 @@ jobs: snyk-monitor: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up uv and Python - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: '3.11' activate-environment: true @@ -29,7 +29,7 @@ jobs: uv pip compile pyproject.toml --output-file requirements.txt uv pip install -r requirements.txt - - uses: snyk/actions/setup@master + - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 - name: Run Snyk (requirements.txt) run: snyk monitor --file="requirements.txt" --package-manager=pip --project-name="requirements.txt" --org=${{ env.SNYK_ORG }} diff --git a/.github/workflows/uv-lock-upgrade.yml b/.github/workflows/uv-lock-upgrade.yml index 5b5b73ae3..2da9eb217 100644 --- a/.github/workflows/uv-lock-upgrade.yml +++ b/.github/workflows/uv-lock-upgrade.yml @@ -12,15 +12,15 @@ jobs: runs-on: ubuntu-latest steps: # Use an app token so the PR triggers CI (GITHUB_TOKEN-created PRs don't) - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: client-id: ${{ secrets.POSIT_CONNECT_PROJECTS_CLIENT_ID }} private-key: ${{ secrets.POSIT_CONNECT_PROJECTS_PEM }} - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@v7 + - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - name: Upgrade uv.lock id: upgrade run: | @@ -29,7 +29,7 @@ jobs: uv lock --upgrade 2>&1 echo 'EOF' } >> "$GITHUB_OUTPUT" - - uses: peter-evans/create-pull-request@v8 + - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ steps.app-token.outputs.token }} branch: uv-lock-upgrade