From 9780a357785674db55130e2d57bd653e86931743 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 09:31:07 +0000 Subject: [PATCH] build(deps): bump the actions group across 1 directory with 14 updates Bumps the actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` | | [actions/attest](https://github.com/actions/attest) | `4.1.1` | `4.2.0` | | [useblacksmith/setup-docker-builder](https://github.com/useblacksmith/setup-docker-builder) | `1.9.0` | `1.11.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.6.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.1` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.8` | `1.11` | | [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `6.2.0` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/v3.1.1...bcd2ba49218906704ab6c1aa796996da409d3eb1) Updates `actions/attest` from 4.1.1 to 4.2.0 - [Release notes](https://github.com/actions/attest/releases) - [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest/compare/a1948c3f048ba23858d222213b7c278aabede763...f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6) Updates `useblacksmith/setup-docker-builder` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/useblacksmith/setup-docker-builder/releases) - [Commits](https://github.com/useblacksmith/setup-docker-builder/compare/ab5c1da94f53f5cd75c1038092aa276dddfccbba...6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) Updates `actions/setup-java` from 5.2.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `github/codeql-action/init` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...7188fc363630916deb702c7fdcf4e481b751f97a) Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...7188fc363630916deb702c7fdcf4e481b751f97a) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...7188fc363630916deb702c7fdcf4e481b751f97a) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `openai/codex-action` from 1.8 to 1.11 - [Changelog](https://github.com/openai/codex-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/openai/codex-action/compare/v1.8...52fe01ec70a42f454c9d2ebd47598f9fd6893d56) Updates `actions/labeler` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d) Updates `actions/stale` from 10.3.0 to 10.4.0 - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629) --- updated-dependencies: - dependency-name: actions/attest dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/labeler dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/stale dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: openai/codex-action dependency-version: '1.11' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: useblacksmith/setup-docker-builder dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/android-release.yml | 2 +- .github/workflows/ci.yml | 4 +- .github/workflows/clawsweeper-dispatch.yml | 4 +- .../codeql-android-critical-security.yml | 6 +- .github/workflows/codeql-critical-quality.yml | 60 +++++++++---------- .../codeql-macos-critical-security.yml | 6 +- .github/workflows/codeql.yml | 4 +- .github/workflows/dependency-guard.yml | 4 +- .github/workflows/docker-release.yml | 30 +++++----- .github/workflows/docs-agent.yml | 2 +- .github/workflows/install-smoke-reusable.yml | 8 +-- .github/workflows/labeler.yml | 2 +- .github/workflows/live-media-runner-image.yml | 4 +- .github/workflows/maturity-scorecard.yml | 2 +- .github/workflows/npm-telegram-beta-e2e.yml | 2 +- .../openclaw-live-and-e2e-checks-reusable.yml | 2 +- .github/workflows/openclaw-performance.yml | 2 +- .../workflows/openclaw-release-publish.yml | 4 +- .../openclaw-release-telegram-qa.yml | 2 +- .github/workflows/opengrep-precise-full.yml | 2 +- .github/workflows/opengrep-precise.yml | 2 +- .github/workflows/sandbox-common-smoke.yml | 2 +- .github/workflows/stale.yml | 12 ++-- .github/workflows/test-performance-agent.yml | 2 +- .github/workflows/workflow-sanity.yml | 2 +- 25 files changed, 86 insertions(+), 86 deletions(-) diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml index 56b1b01531a..5248a9ea17f 100644 --- a/.github/workflows/android-release.yml +++ b/.github/workflows/android-release.yml @@ -350,7 +350,7 @@ jobs: fi - name: Attest Android APK provenance - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: dist/OpenClaw-Android.apk diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b83b5faa1fe..72f1fa37663 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1623,7 +1623,7 @@ jobs: - name: Set up Blacksmith Docker layer cache if: ${{ matrix.docker_cache == true && github.event_name != 'workflow_dispatch' && github.repository == 'openclaw/openclaw' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'openclaw/openclaw') }} - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 @@ -2662,7 +2662,7 @@ jobs: git -C "$GITHUB_WORKSPACE" checkout --detach refs/remotes/origin/checkout - name: Setup Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" diff --git a/.github/workflows/clawsweeper-dispatch.yml b/.github/workflows/clawsweeper-dispatch.yml index 369cb43a3c3..bf398467c75 100644 --- a/.github/workflows/clawsweeper-dispatch.yml +++ b/.github/workflows/clawsweeper-dispatch.yml @@ -73,7 +73,7 @@ jobs: - name: Create ClawSweeper dispatch token id: token if: ${{ env.HAS_CLAWSWEEPER_APP_PRIVATE_KEY == 'true' }} - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ env.CLAWSWEEPER_APP_CLIENT_ID }} private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }} @@ -102,7 +102,7 @@ jobs: steps.comment_filter.outputs.is_command == 'true' && env.HAS_CLAWSWEEPER_APP_PRIVATE_KEY == 'true' }} - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ env.CLAWSWEEPER_APP_CLIENT_ID }} private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }} diff --git a/.github/workflows/codeql-android-critical-security.yml b/.github/workflows/codeql-android-critical-security.yml index 6b9ce7f66df..081f3fddae8 100644 --- a/.github/workflows/codeql-android-critical-security.yml +++ b/.github/workflows/codeql-android-critical-security.yml @@ -29,13 +29,13 @@ jobs: submodules: false - name: Setup Java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 with: distribution: temurin java-version: "21" - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: java-kotlin build-mode: manual @@ -46,6 +46,6 @@ jobs: run: ./gradlew --no-daemon :app:assemblePlayDebug - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-security/android" diff --git a/.github/workflows/codeql-critical-quality.yml b/.github/workflows/codeql-critical-quality.yml index 7d1efe0915c..e07570fde54 100644 --- a/.github/workflows/codeql-critical-quality.yml +++ b/.github/workflows/codeql-critical-quality.yml @@ -342,13 +342,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-core-auth-secrets-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/core-auth-secrets" @@ -365,13 +365,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-config-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/config-boundary" @@ -388,13 +388,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-gateway-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/gateway-runtime-boundary" @@ -411,13 +411,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-channel-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/channel-runtime-boundary" @@ -490,7 +490,7 @@ jobs: - name: Initialize CodeQL if: ${{ github.event_name != 'pull_request' || steps.network-diff-scan.outputs.full_codeql == 'true' }} - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-network-runtime-boundary-critical-quality.yml @@ -498,7 +498,7 @@ jobs: - name: Analyze id: analyze if: ${{ github.event_name != 'pull_request' || steps.network-diff-scan.outputs.full_codeql == 'true' }} - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: output: sarif-results category: "/codeql-critical-quality/network-runtime-boundary" @@ -548,13 +548,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-agent-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/agent-runtime-boundary" @@ -571,13 +571,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-mcp-process-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/mcp-process-runtime-boundary" @@ -594,13 +594,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-memory-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/memory-runtime-boundary" @@ -617,13 +617,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-session-diagnostics-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/session-diagnostics-boundary" @@ -640,13 +640,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-sdk-reply-runtime-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/plugin-sdk-reply-runtime" @@ -663,13 +663,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-provider-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/provider-runtime-boundary" @@ -685,13 +685,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-ui-control-plane-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/ui-control-plane" @@ -707,13 +707,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/web-media-runtime-boundary" @@ -730,13 +730,13 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-boundary-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/plugin-boundary" @@ -753,12 +753,12 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: javascript-typescript config-file: ./.github/codeql/codeql-plugin-sdk-package-contract-critical-quality.yml - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-critical-quality/plugin-sdk-package-contract" diff --git a/.github/workflows/codeql-macos-critical-security.yml b/.github/workflows/codeql-macos-critical-security.yml index d7d77c750b1..00318d800f1 100644 --- a/.github/workflows/codeql-macos-critical-security.yml +++ b/.github/workflows/codeql-macos-critical-security.yml @@ -35,7 +35,7 @@ jobs: swift --version - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: swift build-mode: manual @@ -46,7 +46,7 @@ jobs: - name: Analyze id: analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: output: sarif-results upload: failure-only @@ -83,7 +83,7 @@ jobs: done - name: Upload filtered SARIF - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: sarif_file: sarif-results-filtered category: "/codeql-critical-security/macos" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index afb3d200ab1..358f2c1be9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -120,12 +120,12 @@ jobs: .github/codeql - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: languages: ${{ matrix.language }} config-file: ${{ matrix.config_file }} - name: Analyze - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4 with: category: "/codeql-security-high/${{ matrix.category }}" diff --git a/.github/workflows/dependency-guard.yml b/.github/workflows/dependency-guard.yml index ea076978dd2..101aefa2f2f 100644 --- a/.github/workflows/dependency-guard.yml +++ b/.github/workflows/dependency-guard.yml @@ -57,7 +57,7 @@ jobs: - name: Create autoscrub app token id: app-token continue-on-error: true - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: "2729701" private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} @@ -69,7 +69,7 @@ jobs: id: app-token-fallback continue-on-error: true if: steps.app-token.outcome == 'failure' - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: "2971289" private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }} diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index 0cfdd26bc69..5ffec2d4b5a 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -153,17 +153,17 @@ jobs: done - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -238,7 +238,7 @@ jobs: - name: Build and push amd64 image id: build # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY. - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . platforms: linux/amd64 @@ -258,7 +258,7 @@ jobs: id: build-browser if: steps.tags.outputs.browser != '' # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY. - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . platforms: linux/amd64 @@ -362,17 +362,17 @@ jobs: - *buildkit_prepull_step - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -447,7 +447,7 @@ jobs: - name: Build and push arm64 image id: build # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY. - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . platforms: linux/arm64 @@ -467,7 +467,7 @@ jobs: id: build-browser if: steps.tags.outputs.browser != '' # WARNING: KEEP THE OFFICIAL DOCKER ACTION HERE; DO NOT SWITCH THIS BACK TO BLACKSMITH BLINDLY. - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . platforms: linux/arm64 @@ -574,14 +574,14 @@ jobs: fetch-depth: 0 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} @@ -712,17 +712,17 @@ jobs: - *buildkit_prepull_step - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to GitHub Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/docs-agent.yml b/.github/workflows/docs-agent.yml index 2e6d6288960..55fa85eaa0b 100644 --- a/.github/workflows/docs-agent.yml +++ b/.github/workflows/docs-agent.yml @@ -149,7 +149,7 @@ jobs: - name: Run Codex docs agent if: steps.gate.outputs.run_agent == 'true' - uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1 + uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 env: DOCS_AGENT_BASE_SHA: ${{ steps.gate.outputs.review_base_sha }} DOCS_AGENT_HEAD_SHA: ${{ steps.gate.outputs.review_head_sha }} diff --git a/.github/workflows/install-smoke-reusable.yml b/.github/workflows/install-smoke-reusable.yml index 5835425983e..7f9abb0cc8f 100644 --- a/.github/workflows/install-smoke-reusable.yml +++ b/.github/workflows/install-smoke-reusable.yml @@ -130,7 +130,7 @@ jobs: persist-credentials: false - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 @@ -258,7 +258,7 @@ jobs: persist-credentials: false - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 @@ -680,7 +680,7 @@ jobs: run: docker image inspect "$IMAGE_REF" >/dev/null - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 @@ -889,7 +889,7 @@ jobs: persist-credentials: false - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index bc014bffece..dca47c49d99 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -53,7 +53,7 @@ jobs: with: app-id: "2971289" private-key: ${{ secrets.GH_APP_PRIVATE_KEY_FALLBACK }} - - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6 + - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6 if: ${{ github.event.action != 'edited' || github.event.changes.base }} with: configuration-path: .github/labeler.yml diff --git a/.github/workflows/live-media-runner-image.yml b/.github/workflows/live-media-runner-image.yml index 255f10c817c..06d5cef9bb1 100644 --- a/.github/workflows/live-media-runner-image.yml +++ b/.github/workflows/live-media-runner-image.yml @@ -28,14 +28,14 @@ jobs: - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Login to GHCR - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 diff --git a/.github/workflows/maturity-scorecard.yml b/.github/workflows/maturity-scorecard.yml index dd7f7cfb00a..a93faddbab7 100644 --- a/.github/workflows/maturity-scorecard.yml +++ b/.github/workflows/maturity-scorecard.yml @@ -450,7 +450,7 @@ jobs: fi - name: Run Codex maturity scorecard agent - uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1 + uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 env: MATURITY_EVIDENCE_DIR: .artifacts/maturity-evidence MATURITY_SCORES_PATH: qa/maturity-scores.yaml diff --git a/.github/workflows/npm-telegram-beta-e2e.yml b/.github/workflows/npm-telegram-beta-e2e.yml index 4d5dfe3982d..40d44b22361 100644 --- a/.github/workflows/npm-telegram-beta-e2e.yml +++ b/.github/workflows/npm-telegram-beta-e2e.yml @@ -209,7 +209,7 @@ jobs: persist-credentials: false - name: Set up Blacksmith Docker Builder - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml index 8748568843f..526326c7ce6 100644 --- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml +++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml @@ -2523,7 +2523,7 @@ jobs: - name: Setup Docker builder if: inputs.shared_image_policy == 'no-push-artifact' - uses: useblacksmith/setup-docker-builder@ab5c1da94f53f5cd75c1038092aa276dddfccbba # v1 + uses: useblacksmith/setup-docker-builder@6ff44f8e5255f9d8aa31ef22f7e57a2d926b7da0 # v1 with: max-cache-size-mb: 800000 diff --git a/.github/workflows/openclaw-performance.yml b/.github/workflows/openclaw-performance.yml index 140ca4451ac..857327f2f96 100644 --- a/.github/workflows/openclaw-performance.yml +++ b/.github/workflows/openclaw-performance.yml @@ -1136,7 +1136,7 @@ jobs: id: clawgrit_app_token if: ${{ steps.prepare.outputs.ready == 'true' && steps.prepare.outputs.already_published != 'true' }} continue-on-error: ${{ env.REPORT_PUBLISH_REQUIRED != 'true' }} - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: Iv23liOECG0slfuhz093 private-key: ${{ secrets.CLAWSWEEPER_APP_PRIVATE_KEY }} diff --git a/.github/workflows/openclaw-release-publish.yml b/.github/workflows/openclaw-release-publish.yml index 925e5712aec..3284b7a821a 100644 --- a/.github/workflows/openclaw-release-publish.yml +++ b/.github/workflows/openclaw-release-publish.yml @@ -724,7 +724,7 @@ jobs: - name: Attest ClawHub bootstrap approval if: ${{ steps.clawhub_plan.outputs.bootstrap_should_dispatch == 'true' }} - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: ${{ runner.temp }}/clawhub-bootstrap-approval/approval.json @@ -787,7 +787,7 @@ jobs: - name: Attest Android release approval if: ${{ inputs.publish_openclaw_npm && !contains(inputs.tag, '-alpha.') && !contains(inputs.tag, '-beta.') }} - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: ${{ runner.temp }}/android-release-approval/approval.json diff --git a/.github/workflows/openclaw-release-telegram-qa.yml b/.github/workflows/openclaw-release-telegram-qa.yml index c34da37a10f..191a3c24606 100644 --- a/.github/workflows/openclaw-release-telegram-qa.yml +++ b/.github/workflows/openclaw-release-telegram-qa.yml @@ -821,7 +821,7 @@ jobs: - name: Attest exact candidate archive bytes id: attest - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-path: ${{ steps.verify_candidate.outputs.archive_path }} diff --git a/.github/workflows/opengrep-precise-full.yml b/.github/workflows/opengrep-precise-full.yml index b4da576a9df..207154881fe 100644 --- a/.github/workflows/opengrep-precise-full.yml +++ b/.github/workflows/opengrep-precise-full.yml @@ -58,7 +58,7 @@ jobs: scripts/run-opengrep.sh --sarif --error - name: Upload SARIF to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # Only upload if the scan actually produced a SARIF file. if: always() && hashFiles('.opengrep-out/precise.sarif') != '' with: diff --git a/.github/workflows/opengrep-precise.yml b/.github/workflows/opengrep-precise.yml index ed83d60063e..fd48cae67d6 100644 --- a/.github/workflows/opengrep-precise.yml +++ b/.github/workflows/opengrep-precise.yml @@ -89,7 +89,7 @@ jobs: scripts/run-opengrep.sh --changed --sarif --error - name: Upload SARIF to GitHub Code Scanning - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e + uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # Only upload if the scan actually produced a SARIF file. if: always() && hashFiles('.opengrep-out/precise.sarif') != '' with: diff --git a/.github/workflows/sandbox-common-smoke.yml b/.github/workflows/sandbox-common-smoke.yml index 08e695c4490..b78db0ee4af 100644 --- a/.github/workflows/sandbox-common-smoke.yml +++ b/.github/workflows/sandbox-common-smoke.yml @@ -35,7 +35,7 @@ jobs: submodules: false - name: Set up Docker Builder - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Build minimal sandbox base (USER sandbox) shell: bash diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a4c1c152380..c89c55447a8 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -59,7 +59,7 @@ jobs: - name: Mark stale unassigned issues and pull requests (primary) id: stale-primary continue-on-error: true - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} days-before-issue-stale: 14 @@ -92,7 +92,7 @@ jobs: - name: Mark stale assigned issues (primary) id: assigned-issue-stale-primary continue-on-error: true - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} days-before-issue-stale: 30 @@ -116,7 +116,7 @@ jobs: - name: Mark stale assigned pull requests (primary) id: assigned-stale-primary continue-on-error: true - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token.outputs.token || steps.app-token-fallback.outputs.token }} days-before-issue-stale: -1 @@ -163,7 +163,7 @@ jobs: } - name: Mark stale unassigned issues and pull requests (fallback) if: (steps.stale-primary.outcome == 'failure' || steps.stale-state.outputs.has_state == 'true') && steps.app-token-fallback.outputs.token != '' - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token-fallback.outputs.token }} days-before-issue-stale: 14 @@ -195,7 +195,7 @@ jobs: That channel is the escape hatch for high-quality PRs that get auto-closed. - name: Mark stale assigned issues (fallback) if: (steps.assigned-issue-stale-primary.outcome == 'failure' || steps.stale-state.outputs.has_state == 'true') && steps.app-token-fallback.outputs.token != '' - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token-fallback.outputs.token }} days-before-issue-stale: 30 @@ -218,7 +218,7 @@ jobs: close-issue-reason: not_planned - name: Mark stale assigned pull requests (fallback) if: (steps.assigned-stale-primary.outcome == 'failure' || steps.stale-state.outputs.has_state == 'true') && steps.app-token-fallback.outputs.token != '' - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: repo-token: ${{ steps.app-token-fallback.outputs.token }} days-before-issue-stale: -1 diff --git a/.github/workflows/test-performance-agent.yml b/.github/workflows/test-performance-agent.yml index 54f8f25de22..603c5f51536 100644 --- a/.github/workflows/test-performance-agent.yml +++ b/.github/workflows/test-performance-agent.yml @@ -129,7 +129,7 @@ jobs: - name: Run Codex test performance agent if: steps.gate.outputs.run_agent == 'true' - uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1 + uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 with: openai-api-key: ${{ secrets.OPENCLAW_TEST_PERF_AGENT_OPENAI_API_KEY || secrets.OPENAI_API_KEY }} prompt-file: .github/codex/prompts/test-performance-agent.md diff --git a/.github/workflows/workflow-sanity.yml b/.github/workflows/workflow-sanity.yml index affef8ad795..f7af1c60dcd 100644 --- a/.github/workflows/workflow-sanity.yml +++ b/.github/workflows/workflow-sanity.yml @@ -87,7 +87,7 @@ jobs: steps: - *workflow_sanity_checkout_step - name: Setup Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12"