vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-03 12:47:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

Merge reviewed candidate 20260920T070025Z-delivery-trust (pulse be6179c2d2)

Browse source 
Refresh reviewed GitHub Actions pins: actions/setup-go 6.4.0 -> 7.0.0, signpath/github-action-submit-signing-request v2 -> v3.0, actions/github-script 8.0.0 -> 9.0.0 with their reviewed pin constants, release-consumer manifest and installer/promotion governance assertions. Clears Dependabot #2094/#2095/#2096.

Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot] 2026-09-20 08:25:11 +01:00
commit a830992573
24 changed files with 41 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/backfill-release-assets.yml vendored
View file

@ -29,7 +29,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

6
.github/workflows/build-and-test.yml vendored
View file

@ -240,7 +240,7 @@ jobs:
- name: Set up Go
if: needs.changes.outputs.code == 'true'
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
@ -296,7 +296,7 @@ jobs:
fetch-depth: 0
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
@ -334,7 +334,7 @@ jobs:
path: benchmark-base
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true

8
.github/workflows/build-release-candidate.yml vendored
View file

@ -282,7 +282,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false
@ -386,7 +386,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false
@ -462,7 +462,7 @@ jobs:
- name: Submit SignPath Authenticode request
if: ${{ inputs.windows_signing_backend == 'signpath' }}
id: signpath
uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2
uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
with:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
@ -702,7 +702,7 @@ jobs:
test "$(git rev-parse HEAD)" = "${GITHUB_SHA}"
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

2
.github/workflows/canonical-governance.yml vendored
View file

@ -31,7 +31,7 @@ jobs:
path: repos/pulse
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: repos/pulse/go.mod
cache: true

2
.github/workflows/canonical-private-governance.yml vendored
View file

@ -59,7 +59,7 @@ jobs:
path: repos/pulse-mobile
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: repos/pulse/go.mod
cache: false

4
.github/workflows/compile-release-payload.yml vendored
View file

@ -59,7 +59,7 @@ jobs:
test "$(git rev-parse HEAD)" = "${EXPECTED_SOURCE_SHA}"
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false
@ -134,7 +134,7 @@ jobs:
ref: ${{ inputs.source_sha }}
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

6
.github/workflows/create-release.yml vendored
View file

@ -536,7 +536,7 @@ jobs:
cp -r frontend-modern/dist internal/api/frontend-modern/
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false
@ -582,7 +582,7 @@ jobs:
cp -r frontend-modern/dist internal/api/frontend-modern/
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
@ -1343,7 +1343,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

2
.github/workflows/eval-model-matrix.yml vendored
View file

@ -40,7 +40,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

2
.github/workflows/issue-version-label-sync.yml vendored
View file

@ -32,7 +32,7 @@ jobs:
sparse-checkout-cone-mode: false
- name: Sync issue version metadata
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{ steps.triage-token.outputs.token }}
script: |

2
.github/workflows/patrol-qualification-regression.yml vendored
View file

@ -50,7 +50,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod

2
.github/workflows/qualify-secure-runtime-release.yml vendored
View file

@ -86,7 +86,7 @@ jobs:
python3 scripts/write_github_output.py line_ref "origin/${required_branch}"
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true

2
.github/workflows/reclaim-closed-pr-capacity.yml vendored
View file

@ -26,7 +26,7 @@ jobs:
sparse-checkout-cone-mode: false
- name: Cancel unfinished runs for the closed head
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const cleanup = require(`${process.env.GITHUB_WORKSPACE}/.github/scripts/reclaim-closed-pr-capacity.cjs`);

2
.github/workflows/release-dry-run.yml vendored
View file

@ -314,7 +314,7 @@ jobs:
sudo apt-get install -y docker-compose
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

2
.github/workflows/root-pair-diagnostic.yml vendored
View file

@ -33,7 +33,7 @@ jobs:
with:
persist-credentials: false
fetch-depth: 0
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.26.8'
cache: false

6
.github/workflows/security-scan.yml vendored
View file

@ -38,7 +38,7 @@ jobs:
- name: Set up Go
if: ${{ github.event.schedule != '17 */6 * * *' }}
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
@ -377,7 +377,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
@ -404,7 +404,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod

4
.github/workflows/signpath-test-signing.yml vendored
View file

@ -31,7 +31,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false
@ -104,7 +104,7 @@ jobs:
- name: Submit SignPath test-signing request
id: signpath
uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2
uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
with:
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}

2
.github/workflows/test-e2e.yml vendored
View file

@ -92,7 +92,7 @@ jobs:
frontend-modern/package-lock.json
internal/cloudcp/portal/frontend/package-lock.json
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
- name: Install locked dependencies

4
.github/workflows/unified-agent-native.yml vendored
View file

@ -79,7 +79,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
@ -186,7 +186,7 @@ jobs:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true

2
.github/workflows/update-demo-server.yml vendored
View file

@ -301,7 +301,7 @@ jobs:
- name: Set up Go
if: inputs.verify_only != true
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: false

2
.github/workflows/uuid-layout-diagnostic.yml vendored
View file

@ -33,7 +33,7 @@ jobs:
with:
persist-credentials: false
fetch-depth: 0
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: '1.26.7'
cache: false

4
scripts/check_workflow_trust.py
View file

@ -155,7 +155,7 @@ GENERATED_CODE_ACTION_INPUTS = {
SAFE_PULL_REQUEST_TARGET_WORKFLOW = "reclaim-closed-pr-capacity.yml"
SAFE_PULL_REQUEST_TARGET_ACTIONS = (
"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
"actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd",
"actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3",
)
# v7.0.1 includes checkout's fail-closed fork-PR protection for privileged
# pull_request_target and workflow_run events. Keep this exact-pin allowlist
@ -172,7 +172,7 @@ REVIEWED_NODE24_ACTION_PINS = {
{"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"}
),
"actions/github-script@": frozenset(
{"ed597411d8f924073f98dfc5c65a23a2325f34cd"}
{"3a2844b7e9c422d3c10d287c895573f7108da1b3"}
),
}
WRITE_CREDENTIAL_RATIONALE = "# required: authenticated git writes"

6
scripts/installtests/build_release_assets_test.go
View file

@ -1427,7 +1427,7 @@ func TestBackfillReleaseWorkflowRepairsPublishedAssetsWithoutRebuilds(t *testing
`contents: write`,
`runs-on: ubuntu-24.04`,
`uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`,
`uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0`,
`uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0`,
`SYFT_VERSION="1.42.4"`,
`SYFT_ARCHIVE="syft_${SYFT_VERSION}_linux_amd64.tar.gz"`,
`SYFT_SHA256="590650c2743b83f327d1bf9bec64f6f83b7fec504187bb84f500c862bf8f2a0f"`,
@ -1747,7 +1747,7 @@ func TestReleaseCandidateRequiresPlatformNativeAgentSigning(t *testing.T) {
`sign-windows-agent:`,
`collect-windows-signing:`,
`windows_signing_backend:`,
`signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2`,
`signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0`,
`github-artifact-id: ${{ steps.upload-unsigned-windows.outputs.artifact-id }}`,
`wait-for-completion: false`,
`windows-signing-request.json`,
@ -2279,7 +2279,7 @@ func TestUpdateDemoWorkflowUsesGovernedNetworkPath(t *testing.T) {
`Waiting for activated release assets to be available`,
`bash /tmp/pulse-install.sh --version "$TAG"`,
`Refuse mutation during verification-only checks`,
`uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0`,
`uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0`,
`go run ./scripts/release_update_key.go public-key-ssh`,
`sed -i "s|^PINNED_RELEASE_SSH_PUBLIC_KEY=.*|PINNED_RELEASE_SSH_PUBLIC_KEY=\"${TRUSTED_SSH_PUBLIC_KEY}\"|" /tmp/pulse-install.sh`,
`Verify target host identity`,

4
scripts/release_control/action_consumer_manifests.json
View file

@ -165,8 +165,8 @@
}
},
"signpath/github-action-submit-signing-request": {
"sha": "c92b958760219087e01f8d67a1669ed57afe2627",
"manifest_sha256": "d0b52fdfa234d87c1ff4d21c06a91d2b6e0dd45e1a8866ad3b58cbdeb9aef326",
"sha": "f6d04783b4569d051e0c80105fe66e82819d0092",
"manifest_sha256": "9afe14756752bb0b43421bf94e7cebdc3fead29765be4f07fbc60d82421ebc23",
"inputs": [
"api-token",
"artifact-configuration-slug",

4
scripts/release_control/release_promotion_policy_test.py
View file

@ -1632,7 +1632,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
workflow,
)
self.assertIn(
"signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2",
"signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0",
workflow,
)
self.assertIn("signedArtifactsPublished = $false", workflow)
@ -2008,7 +2008,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
self.assertIn("windows_signing_backend: signpath", content)
self.assertIn('if [[ "$REQUIRE_WINDOWS_SIGNING" == "true" ]]', candidate_workflow)
self.assertIn("inputs.require_windows_signing", candidate_workflow)
self.assertIn("signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2", candidate_workflow)
self.assertIn("signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0", candidate_workflow)
self.assertIn("github-artifact-id: ${{ steps.upload-unsigned-windows.outputs.artifact-id }}", candidate_workflow)
self.assertIn("windows-signing-evidence.json", candidate_workflow)
for signpath_setting in (