From 6ea76396f30cf7a124c2e9073e2df4835fda1116 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 20:30:52 +0000 Subject: [PATCH] ci: bump the github-actions group with 8 updates Bumps the github-actions group with 8 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5.1.0` | `7.0.1` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.7.0` | `6.0.1` | | [jdx/mise-action](https://github.com/jdx/mise-action) | `4.3.0` | `5.1.1` | | [actions/cache](https://github.com/actions/cache) | `5.1.0` | `6.1.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.2` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.5` | `7.1.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.2` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | Updates `actions/checkout` from 5.1.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-java` from 5.7.0 to 6.0.1 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v5.7.0...de7274f081f381c8f8158605e0321c36c376e2e6) Updates `jdx/mise-action` from 4.3.0 to 5.1.1 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/c2a87611a18de5b3828c5652fe268e992400cb5c...2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca) Updates `actions/cache` from 5.1.0 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/caa296126883cff596d87d8935842f9db880ef25...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/upload-artifact` from 6.0.0 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `codecov/codecov-action` from 5.5.5 to 7.1.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/0fb7174895f61a3b6b78fc075e0cd60383518dac...303a32d7a59b442fa8d48b6a1cc6825c09c847a5) Updates `actions/download-artifact` from 7.0.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: jdx/mise-action dependency-version: 5.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/android.yml | 14 +++++++------- .github/workflows/ci.yml | 6 +++--- .github/workflows/ios.yml | 10 +++++----- .github/workflows/release.yml | 18 +++++++++--------- .github/workflows/review.yml | 2 +- 5 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml index edc619a4e..40738518c 100644 --- a/.github/workflows/android.yml +++ b/.github/workflows/android.yml @@ -20,7 +20,7 @@ jobs: android: ${{ steps.filter.outputs.android }} release: ${{ steps.release.outputs.builds }} steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Nothing here pushes or fetches, so the job token is not left in # .git/config for the steps after this one. @@ -67,12 +67,12 @@ jobs: steps: # Nothing here pushes, so the job token is not left in .git/config. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Java - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: "temurin" java-version: "25" @@ -84,10 +84,10 @@ jobs: # built against an SDK nobody chose, and nothing in the build log would # say so. See AGENTS.md → Toolchain. - name: Install toolchain (mise) - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 - name: Cache Android NDK - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | /usr/local/lib/android/sdk/ndk/27.0.12077973 @@ -95,7 +95,7 @@ jobs: key: ${{ runner.os }}-ndk-27-28 - name: Cache Android sdk - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 env: cache-name: cache-Android-sdk with: @@ -129,7 +129,7 @@ jobs: run: bash tool/dev/build.sh android - name: Upload Artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: DPIP-Android-Release path: build/app/outputs/flutter-apk/*.apk diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fcb4614c9..228ddf392 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,7 +23,7 @@ jobs: steps: # Full history: the commit gate walks the range this push or PR adds, and # a shallow clone has no base to compare against. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Nothing here pushes, and every step after this one runs code the @@ -149,7 +149,7 @@ jobs: # developers run locally — one source of truth. v4 = Node 24 runtime # (Node 20 actions are forced onto 24 and emit deprecation warnings). - name: Install toolchain (mise) - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 - name: Install dependencies run: bash tool/dev/deps.sh @@ -210,7 +210,7 @@ jobs: # tokenless opt-out for public repositories, in the Codecov org settings. - name: Upload coverage to Codecov if: ${{ !cancelled() && hashFiles('coverage/lcov.info') != '' }} - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: use_oidc: true files: coverage/lcov.info diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml index 03904da8e..b0c83b963 100644 --- a/.github/workflows/ios.yml +++ b/.github/workflows/ios.yml @@ -32,7 +32,7 @@ jobs: ios: ${{ steps.filter.outputs.ios }} release: ${{ steps.release.outputs.builds }} steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Nothing here pushes or fetches, so the job token is not left in # .git/config for the steps after this one. @@ -79,7 +79,7 @@ jobs: steps: # Nothing here pushes, so the job token is not left in .git/config. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -89,12 +89,12 @@ jobs: # built against an SDK nobody chose, and nothing in the build log would # say so. See AGENTS.md → Toolchain. - name: Install toolchain (mise) - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 # The iOS build uses Swift Package Manager, not CocoaPods (there is no # Podfile). Cache SPM's clone/artifact store keyed on the resolved pins. - name: Cache Swift Packages - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: # build/ios/SourcePackages, not DerivedData. Flutter always passes # -clonedSourcePackagesDirPath pointing there (ios/xcodeproj.dart), so @@ -136,7 +136,7 @@ jobs: zip -qr DPIP.ipa Payload - name: Upload Artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: DPIP-iOS path: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8e45ba55a..f36f545bb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -47,7 +47,7 @@ jobs: steps: # Full history: the label counts this week's commits and the train reads # the newest tag. A shallow clone has neither. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Nothing in this job pushes; `gh` reads its token from GH_TOKEN. @@ -172,7 +172,7 @@ jobs: contents: read steps: # Full history: tool/release/build_info.sh counts commits and reads tags. - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Nothing in this job pushes, and it is the job holding the signing @@ -200,12 +200,12 @@ jobs: # developer use. A published build is the one that most needs to be # reproducible, so it must not be the one tracking whatever "stable" # happens to mean on the day it runs. - - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 with: cache: true # zizmor: ignore[cache-poisoning] — accepted, see above - if: matrix.platform == 'android' - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: "temurin" java-version: "25" @@ -223,7 +223,7 @@ jobs: # precise key costs one full download on a dependency change and is # correct every time. - name: Cache pub packages - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.pub-cache key: ${{ runner.os }}-pub-${{ hashFiles('pubspec.lock') }} @@ -245,7 +245,7 @@ jobs: # main saved here and stored a fresh ~880 MB copy of its own. - name: Cache Swift packages if: matrix.platform == 'ios' - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/Library/Caches/org.swift.swiftpm @@ -468,7 +468,7 @@ jobs: if: always() && matrix.platform == 'ios' run: rm -rf "$RUNNER_TEMP/private_keys" - - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dpip-${{ matrix.platform }} path: DPIP-*.* @@ -481,14 +481,14 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Kept, and the one place it is: `Publish` pushes the snapshot tag # with `git push`. This job uploads no artifact for it to leak into. persist-credentials: true - - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: artifacts merge-multiple: true diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml index ca743ecc1..3778e9290 100644 --- a/.github/workflows/review.yml +++ b/.github/workflows/review.yml @@ -137,7 +137,7 @@ jobs: - name: Get PR context id: pr-context if: github.event_name == 'issue_comment' - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | // For issue_comment events, resolve PR base/head so the action