Skip to content

Commit b1b084d

Browse files
waleedlatif1waleedlatif1
authored
v0.9.16: library, zod fix, migrations script hardening
2 parents 670def1 + 49609f8 commit b1b084d

42 files changed

Lines changed: 2151 additions & 201 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/cache/action.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ runs:
2020
steps:
2121
- name: Mount sticky disk
2222
if: inputs.provider == '' || inputs.provider == 'blacksmith'
23-
uses: useblacksmith/stickydisk@4c034ba57b706cf0e3b4b0ce098c2a3b1071580c # v1
23+
uses: useblacksmith/stickydisk@3f6be1451e3cad893b778bc93495c80452a5da26 # v1
2424
with:
2525
key: ${{ inputs.key }}
2626
path: ${{ inputs.path }}
@@ -29,7 +29,7 @@ runs:
2929
# which would freeze the cache at the first run's contents.
3030
- name: Restore and save cache
3131
if: inputs.provider != '' && inputs.provider != 'blacksmith'
32-
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
32+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
3333
with:
3434
key: ${{ inputs.key }}-${{ github.run_id }}
3535
restore-keys: ${{ inputs.key }}-

‎.github/actions/image/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,13 @@ runs:
6363
# under 300 MB, sat at 249 GB. Sticky disks bill at ~$0.51/GB-month.
6464
- name: Set up Blacksmith builder
6565
if: inputs.provider == '' || inputs.provider == 'blacksmith'
66-
uses: useblacksmith/setup-docker-builder@a5256a73e30f09e37e3eceb8ca36043d17621d24 # v2
66+
uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184 # v2
6767
with:
6868
cache-key: ${{ steps.cache-key.outputs.value }}
6969

7070
- name: Build and push (Blacksmith)
7171
if: inputs.provider == '' || inputs.provider == 'blacksmith'
72-
uses: useblacksmith/build-push-action@fb9e3e6a9299c78462bfadd0d93352c316adc9b8 # v2
72+
uses: useblacksmith/build-push-action@9b0579bbec7a6cad2f171596c57e7ac1e7658850 # v2
7373
with:
7474
context: ${{ inputs.context }}
7575
file: ${{ inputs.file }}
@@ -170,12 +170,12 @@ runs:
170170
171171
- name: Set up Docker Buildx
172172
if: inputs.provider != '' && inputs.provider != 'blacksmith'
173-
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
173+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
174174

175175
# No cache-to: type=gha — it shares the 10 GB repo quota with the cache mounts.
176176
- name: Build and push (GitHub)
177177
if: inputs.provider != '' && inputs.provider != 'blacksmith'
178-
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
178+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
179179
with:
180180
context: ${{ inputs.context }}
181181
file: ${{ inputs.file }}

‎.github/actions/setup/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ runs:
3939

4040
- name: Setup Node
4141
if: inputs.node-version != ''
42-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
42+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
4343
with:
4444
node-version: ${{ inputs.node-version }}
4545
registry-url: ${{ inputs.registry-url }}

‎.github/workflows/checks.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ jobs:
8383
- &checkout-plain
8484
name: Checkout code
8585
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
86-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
86+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
8787

8888
- name: Setup workspace
8989
uses: ./.github/actions/setup
@@ -123,7 +123,7 @@ jobs:
123123
124124
- name: Upload integration test reports
125125
if: always()
126-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
126+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
127127
with:
128128
name: integration-reports-${{ matrix.provision }}-${{ matrix.shard }}
129129
path: |
@@ -207,7 +207,7 @@ jobs:
207207

208208
- name: Upload end-to-end reports and server logs
209209
if: failure()
210-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
210+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
211211
with:
212212
name: http-e2e-${{ matrix.group }}
213213
path: ${{ runner.temp }}/e2e/
@@ -231,7 +231,7 @@ jobs:
231231
fetch-depth: 2
232232
- name: Checkout code
233233
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork
234-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
234+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
235235
with:
236236
fetch-depth: 2
237237
- name: Diff against the pull request's base
@@ -418,7 +418,7 @@ jobs:
418418
419419
- name: Upload Electron E2E results and server logs
420420
if: failure()
421-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
421+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
422422
with:
423423
name: desktop-live-e2e-results
424424
path: ${{ runner.temp }}/e2e/
@@ -451,7 +451,7 @@ jobs:
451451
- &checkout-plain-depth2
452452
name: Checkout code
453453
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
454-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
454+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
455455
with:
456456
fetch-depth: 2
457457

@@ -623,7 +623,7 @@ jobs:
623623

624624
- name: Upload shell placeholder execution report
625625
if: failure() && matrix.shard == 1
626-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
626+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
627627
with:
628628
name: shell-placeholders
629629
path: ${{ runner.temp }}/shell-placeholders.json

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
changed: ${{ steps.diff.outputs.changed }}
8181
steps:
8282
- name: Checkout code
83-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
83+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
8484
with:
8585
fetch-depth: 50
8686

@@ -196,20 +196,20 @@ jobs:
196196
bs_runner: blacksmith-2vcpu-ubuntu-2404
197197
steps:
198198
- name: Checkout code
199-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
199+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
200200

201201
- name: Configure AWS credentials
202-
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
202+
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
203203
with:
204204
role-to-assume: ${{ secrets.DEV_AWS_ROLE_TO_ASSUME }}
205205
aws-region: ${{ secrets.DEV_AWS_REGION }}
206206

207207
- name: Login to Amazon ECR
208208
id: login-ecr
209-
uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2
209+
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
210210

211211
- name: Login to Docker Hub
212-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
212+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
213213
with:
214214
username: ${{ secrets.DOCKERHUB_USERNAME }}
215215
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -246,7 +246,7 @@ jobs:
246246
preview_branch: ${{ steps.target.outputs.preview_branch }}
247247
steps:
248248
- name: Checkout code
249-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
249+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
250250

251251
- name: Setup workspace
252252
uses: ./.github/actions/setup
@@ -348,27 +348,27 @@ jobs:
348348
bs_runner: blacksmith-2vcpu-ubuntu-2404
349349
steps:
350350
- name: Checkout code
351-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
351+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
352352

353353
- name: Configure AWS credentials
354-
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
354+
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
355355
with:
356356
role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_TO_ASSUME || secrets.STAGING_AWS_ROLE_TO_ASSUME }}
357357
aws-region: ${{ github.ref == 'refs/heads/main' && secrets.AWS_REGION || secrets.STAGING_AWS_REGION }}
358358

359359
- name: Login to Amazon ECR
360360
id: login-ecr
361-
uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2
361+
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
362362

363363
- name: Login to Docker Hub
364-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
364+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
365365
with:
366366
username: ${{ secrets.DOCKERHUB_USERNAME }}
367367
password: ${{ secrets.DOCKERHUB_TOKEN }}
368368

369369
- name: Login to GHCR
370370
if: github.ref == 'refs/heads/main'
371-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
371+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
372372
with:
373373
registry: ghcr.io
374374
username: ${{ github.repository_owner }}
@@ -466,17 +466,17 @@ jobs:
466466
app_image_digest: ${{ steps.promote.outputs.app_image_digest }}
467467
steps:
468468
- name: Checkout code
469-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
469+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
470470

471471
- name: Configure AWS credentials
472-
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
472+
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
473473
with:
474474
role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_TO_ASSUME || github.ref == 'refs/heads/dev' && secrets.DEV_AWS_ROLE_TO_ASSUME || secrets.STAGING_AWS_ROLE_TO_ASSUME }}
475475
aws-region: ${{ github.ref == 'refs/heads/main' && secrets.AWS_REGION || github.ref == 'refs/heads/dev' && secrets.DEV_AWS_REGION || secrets.STAGING_AWS_REGION }}
476476

477477
- name: Login to Amazon ECR
478478
id: login-ecr
479-
uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2
479+
uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
480480

481481
# Deploy-tag moves must be monotonic: a re-run of an old run must never
482482
# retag latest/staging back to stale code. A superseded first-attempt
@@ -572,7 +572,7 @@ jobs:
572572
id-token: write
573573
steps:
574574
- name: Checkout code
575-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
575+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
576576

577577
- name: Setup workspace
578578
uses: ./.github/actions/setup
@@ -581,7 +581,7 @@ jobs:
581581
node-version: ''
582582

583583
- name: Configure AWS credentials
584-
uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
584+
uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
585585
with:
586586
role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.AWS_ROLE_TO_ASSUME || github.ref == 'refs/heads/dev' && secrets.DEV_AWS_ROLE_TO_ASSUME || secrets.STAGING_AWS_ROLE_TO_ASSUME }}
587587
aws-region: ${{ github.ref == 'refs/heads/main' && secrets.AWS_REGION || github.ref == 'refs/heads/dev' && secrets.DEV_AWS_REGION || secrets.STAGING_AWS_REGION }}
@@ -679,10 +679,10 @@ jobs:
679679

680680
steps:
681681
- name: Checkout code
682-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
682+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
683683

684684
- name: Login to GHCR
685-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
685+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
686686
with:
687687
registry: ghcr.io
688688
username: ${{ github.repository_owner }}
@@ -736,7 +736,7 @@ jobs:
736736

737737
steps:
738738
- name: Login to GHCR
739-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
739+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
740740
with:
741741
registry: ghcr.io
742742
username: ${{ github.repository_owner }}
@@ -820,7 +820,7 @@ jobs:
820820
count: ${{ steps.resolve.outputs.count }}
821821
steps:
822822
- name: Login to GHCR
823-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
823+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
824824
with:
825825
registry: ghcr.io
826826
username: ${{ github.repository_owner }}
@@ -999,7 +999,7 @@ jobs:
999999

10001000
steps:
10011001
- name: Login to GHCR
1002-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
1002+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
10031003
with:
10041004
registry: ghcr.io
10051005
username: ${{ github.repository_owner }}
@@ -1019,7 +1019,7 @@ jobs:
10191019
# resolution, and one pull shared by both subjects instead of two.
10201020
- name: Generate SBOM
10211021
if: matrix.platform != 'index'
1022-
uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
1022+
uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
10231023
with:
10241024
image: ${{ matrix.image }}:${{ github.sha }}-${{ matrix.platform }}
10251025
format: spdx-json
@@ -1067,10 +1067,10 @@ jobs:
10671067
outputs:
10681068
docs_changed: ${{ steps.filter.outputs.docs }}
10691069
steps:
1070-
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1070+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
10711071
with:
10721072
fetch-depth: 2 # Need at least 2 commits to detect changes
1073-
- uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
1073+
- uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
10741074
id: filter
10751075
with:
10761076
filters: |
@@ -1121,7 +1121,7 @@ jobs:
11211121
contents: write
11221122
steps:
11231123
- name: Checkout code
1124-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1124+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
11251125
with:
11261126
fetch-depth: 0
11271127

@@ -1216,7 +1216,7 @@ jobs:
12161216
version: ${{ steps.version.outputs.version }}
12171217
steps:
12181218
- name: Checkout code
1219-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1219+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
12201220

12211221
- name: Compute prerelease version and create draft release
12221222
id: version

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ jobs:
108108

109109
steps:
110110
- name: Checkout repository
111-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
111+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
112112
with:
113113
persist-credentials: false
114114

‎.github/workflows/companion.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
4545
timeout-minutes: 5
4646
steps:
47-
- uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
47+
- uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
4848
env:
4949
CROSS_REPO_TOKEN: ${{ secrets.CROSS_REPO_TOKEN }}
5050
with:

0 commit comments

Comments
 (0)