diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 3c6206d51..3fb7ac77e 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -38,7 +38,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 ref: main @@ -132,7 +132,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 ref: main diff --git a/.github/workflows/build-native-matrix.yml b/.github/workflows/build-native-matrix.yml index 79a5e8050..347a02aee 100644 --- a/.github/workflows/build-native-matrix.yml +++ b/.github/workflows/build-native-matrix.yml @@ -59,7 +59,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ce230f08c..718f0e837 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest name: Lint steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -54,7 +54,7 @@ jobs: outputs: native_changed: ${{ steps.check.outputs.native_changed }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -112,7 +112,7 @@ jobs: runs-on: ${{ matrix.os }} name: Native host build (${{ matrix.os }}) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -169,7 +169,7 @@ jobs: name: Test Node ${{ matrix.node-version }} (${{ matrix.os }}) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -212,7 +212,7 @@ jobs: runs-on: ubuntu-latest name: TypeScript type check steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -243,7 +243,7 @@ jobs: runs-on: ubuntu-latest name: Security audit steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Audit production dependencies # --package-lock-only reads the lock file directly — no npm install needed. @@ -261,7 +261,7 @@ jobs: runs-on: ubuntu-latest name: Verify dynamic imports steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -277,7 +277,7 @@ jobs: runs-on: ubuntu-latest name: Grammar version parity steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -302,7 +302,7 @@ jobs: name: Engine parity (${{ matrix.os }}) steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 @@ -394,7 +394,7 @@ jobs: name: Rust compile check steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Rust uses: dtolnay/rust-toolchain@stable @@ -440,7 +440,7 @@ jobs: CODEGRAPH_FAST_SKIP_DIAG: "1" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 419a1dc5b..6e4759ec9 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -22,7 +22,7 @@ jobs: outputs: trivial: ${{ steps.check.outputs.trivial }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -103,7 +103,7 @@ jobs: exit 1 - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 1 @@ -265,7 +265,7 @@ jobs: exit 1 - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 with: fetch-depth: 1 diff --git a/.github/workflows/codegraph-impact.yml b/.github/workflows/codegraph-impact.yml index 6df3fe3ec..dc41cd172 100644 --- a/.github/workflows/codegraph-impact.yml +++ b/.github/workflows/codegraph-impact.yml @@ -12,7 +12,7 @@ jobs: impact: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - uses: actions/setup-node@v7.0.0 diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index 61d6a25e9..e706d7963 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -12,7 +12,7 @@ jobs: name: Validate commits runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/embedding-regression.yml b/.github/workflows/embedding-regression.yml index 54d73b44f..2424767a5 100644 --- a/.github/workflows/embedding-regression.yml +++ b/.github/workflows/embedding-regression.yml @@ -21,7 +21,7 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 diff --git a/.github/workflows/perf-canary.yml b/.github/workflows/perf-canary.yml index 087323109..0fc230487 100644 --- a/.github/workflows/perf-canary.yml +++ b/.github/workflows/perf-canary.yml @@ -42,7 +42,7 @@ jobs: CODEGRAPH_FAST_SKIP_DIAG: "1" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-node@v7.0.0 with: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4073ab64a..9089b36bb 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -33,7 +33,7 @@ jobs: # Only the scheduled path below actually reads repo history (git rev-list); # release/workflow_dispatch exit immediately with should_run=true and never # touch the checkout, so skip the full-depth clone for those triggers. - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 if: github.event_name == 'schedule' with: fetch-depth: 0 @@ -87,7 +87,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-node@v7.0.0 with: node-version: "22" @@ -130,7 +130,7 @@ jobs: version: ${{ steps.compute.outputs.version }} npm_tag: ${{ steps.compute.outputs.npm_tag }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -211,7 +211,7 @@ jobs: CODEGRAPH_FAST_SKIP_DIAG: "1" steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -373,7 +373,7 @@ jobs: contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - uses: actions/setup-node@v7.0.0 with: @@ -548,7 +548,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 ref: main diff --git a/.github/workflows/shield-license-compliance.yml b/.github/workflows/shield-license-compliance.yml index 2117da63f..f296ebf03 100644 --- a/.github/workflows/shield-license-compliance.yml +++ b/.github/workflows/shield-license-compliance.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@v7.0.1 - name: Setup Node.js uses: actions/setup-node@v7.0.0 diff --git a/.github/workflows/update-recall-floors.yml b/.github/workflows/update-recall-floors.yml index a3b8f5056..546e37052 100644 --- a/.github/workflows/update-recall-floors.yml +++ b/.github/workflows/update-recall-floors.yml @@ -34,7 +34,7 @@ jobs: # with contents:write + pull-requests:write and passes its write-scoped # token straight into the checkout step — an upstream tag compromise # would otherwise run unreviewed code with that authority. - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }}