BAU: Bump the gha-all-dependencies group across 1 directory with 7 updates

dependabot[bot] · web-flow · commit d699081b1d49 · 2026-05-15T03:15:04.000Z
Bumps the gha-all-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.1.1` | | [tj-actions/changed-files](https://github.com/tj-actions/changed-files) | `5f4a0b68ac816d8cb4a52bd88b460549197b7ff1` | `6b924b1775b8688e12ffb9b5cb5e968e1eb682ec` | | [bridgecrewio/checkov-action](https://github.com/bridgecrewio/checkov-action) | `12.3096.0` | `12.3102.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.35.4` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` | | [aws-actions/setup-sam](https://github.com/aws-actions/setup-sam) | `d78e1a4a9656d3b223e59b80676a797f20093133` | `89ddb14d60e682855e3fea4be85b3c56485de310` | | [govuk-one-login/devplatform-upload-action](https://github.com/govuk-one-login/devplatform-upload-action) | `3.13.0` | `3.14.0` | Updates `aws-actions/configure-aws-credentials` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@ec61189...d979d5b) Updates `tj-actions/changed-files` from 5f4a0b68ac816d8cb4a52bd88b460549197b7ff1 to 6b924b1775b8688e12ffb9b5cb5e968e1eb682ec - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@5f4a0b6...6b924b1) Updates `bridgecrewio/checkov-action` from 12.3096.0 to 12.3102.0 - [Release notes](https://github.com/bridgecrewio/checkov-action/releases) - [Commits](bridgecrewio/checkov-action@de2bfae...4048c97) Updates `github/codeql-action` from 4.35.2 to 4.35.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...68bde55) Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@2031cfc...a1d282b) Updates `aws-actions/setup-sam` from d78e1a4a9656d3b223e59b80676a797f20093133 to 89ddb14d60e682855e3fea4be85b3c56485de310 - [Release notes](https://github.com/aws-actions/setup-sam/releases) - [Commits](aws-actions/setup-sam@d78e1a4...89ddb14) Updates `govuk-one-login/devplatform-upload-action` from 3.13.0 to 3.14.0 - [Release notes](https://github.com/govuk-one-login/devplatform-upload-action/releases) - [Commits](govuk-one-login/devplatform-upload-action@b7bc01e...5879c30) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-all-dependencies - dependency-name: tj-actions/changed-files dependency-version: 6b924b1775b8688e12ffb9b5cb5e968e1eb682ec dependency-type: direct:production dependency-group: gha-all-dependencies - dependency-name: bridgecrewio/checkov-action dependency-version: 12.3102.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-all-dependencies - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gha-all-dependencies - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gha-all-dependencies - dependency-name: aws-actions/setup-sam dependency-version: 89ddb14d60e682855e3fea4be85b3c56485de310 dependency-type: direct:production dependency-group: gha-all-dependencies - dependency-name: govuk-one-login/devplatform-upload-action dependency-version: 3.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gha-all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
diff --git a/.github/workflows/call_build-single-api-module.yml b/.github/workflows/call_build-single-api-module.yml
@@ -60,7 +60,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up AWS credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ inputs.aws_role }}
           aws-region: ${{ inputs.aws_region }}
diff --git a/.github/workflows/call_get_changed_files.yml b/.github/workflows/call_get_changed_files.yml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Get changed Java files
         id: changed-java-files
-        uses: tj-actions/changed-files@5f4a0b68ac816d8cb4a52bd88b460549197b7ff1 # v45.0.7
+        uses: tj-actions/changed-files@6b924b1775b8688e12ffb9b5cb5e968e1eb682ec # v45.0.7
         with:
           # If you change the paths here, ensure they are synchronised with the paths in the other jobs.
           # Find these by searching for "Ensure these are synchronized with the paths in the check-changed-files job"
@@ -35,7 +35,7 @@ jobs:
 
       - name: Get changed files in orchestration-alerting folder
         id: changed-orch-alerting-files
-        uses: tj-actions/changed-files@5f4a0b68ac816d8cb4a52bd88b460549197b7ff1 # v45.0.7
+        uses: tj-actions/changed-files@6b924b1775b8688e12ffb9b5cb5e968e1eb682ec # v45.0.7
         with:
           files: |
             orchestration-alerting/**
diff --git a/.github/workflows/checkov.yml b/.github/workflows/checkov.yml
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Checkov GitHub Action
-        uses: bridgecrewio/checkov-action@de2bfaecd21d58ef232e0d2a3391c33c32c460d7 # v12.3096.0
+        uses: bridgecrewio/checkov-action@4048c972aae68d0b983a48bb3479aab2d877b898 # v12.3102.0
         with:
           directory: ci/terraform/${{ matrix.module }}
           soft_fail: true
@@ -47,7 +47,7 @@ jobs:
           skip_check: CKV_OPENAPI_20,CKV_OPENAPI_4
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.25.12v3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.25.12v3
         with:
           sarif_file: results.sarif
           category: ${{ matrix.module }}
@@ -61,7 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Checkov GitHub Action
-        uses: bridgecrewio/checkov-action@de2bfaecd21d58ef232e0d2a3391c33c32c460d7 # v12.3096.0
+        uses: bridgecrewio/checkov-action@4048c972aae68d0b983a48bb3479aab2d877b898 # v12.3102.0
         with:
           file: template.yaml
           framework: cloudformation
@@ -72,7 +72,7 @@ jobs:
 
       - name: Upload SARIF file
         if: always()
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v3.25.12v3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.25.12v3
         with:
           sarif_file: results.sarif
           category: orch-sam
diff --git a/.github/workflows/dependency-review-on-pr.yml b/.github/workflows/dependency-review-on-pr.yml
@@ -20,7 +20,7 @@ jobs:
         uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v4
 
       - name: Perform dependency review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           # These exceptions should be rare and well justified
           # - GHSA-qh8g-58pp-2wxh see https://github.com/govuk-one-login/authentication-api/pull/7105
diff --git a/.github/workflows/deploy-api-account-data-sp.yml b/.github/workflows/deploy-api-account-data-sp.yml
@@ -46,13 +46,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_AD_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -108,7 +108,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ secrets.ARTIFACT_SOURCE_AD_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-api-account-management-sp.yml b/.github/workflows/deploy-api-account-management-sp.yml
@@ -46,13 +46,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_AM_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -108,7 +108,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ secrets.ARTIFACT_SOURCE_AM_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-api-auth-sp.yml b/.github/workflows/deploy-api-auth-sp.yml
@@ -46,13 +46,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -108,7 +108,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ secrets.ARTIFACT_SOURCE_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-api-modules-dev.yml b/.github/workflows/deploy-api-modules-dev.yml
@@ -186,7 +186,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up AWS credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ needs.set-up.outputs.promotion_role }}
           aws-region: ${{ needs.set-up.outputs.aws_region }}
diff --git a/.github/workflows/deploy-api-modules.yml b/.github/workflows/deploy-api-modules.yml
@@ -193,7 +193,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up AWS credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ needs.set-up.outputs.promotion_role }}
           aws-region: ${{ needs.set-up.outputs.aws_region }}
diff --git a/.github/workflows/deploy-api-stubs-sp.yml b/.github/workflows/deploy-api-stubs-sp.yml
@@ -46,13 +46,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_ROLE_ARN_STUBS_API }}
           aws-region: ${{ env.AWS_REGION }}
@@ -108,7 +108,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ secrets.ARTIFACT_BUCKET_STUBS_API }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-api-utils-sp.yml b/.github/workflows/deploy-api-utils-sp.yml
@@ -47,13 +47,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_UT_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -109,7 +109,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ secrets.ARTIFACT_SOURCE_UT_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-auth-api-combined-dev-sp.yml b/.github/workflows/deploy-auth-api-combined-dev-sp.yml
@@ -44,13 +44,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ inputs.api_name == 'account-data' && secrets.GH_ACTIONS_AD_ROLE_ARN || inputs.api_name == 'account-management' && secrets.GH_ACTIONS_AM_ROLE_ARN || inputs.api_name == 'auth-int-ext' && secrets.GH_ACTIONS_ROLE_ARN || inputs.api_name == 'stubs' && secrets.GH_ACTIONS_ROLE_ARN_STUBS_API || inputs.api_name == 'utils' && secrets.GH_ACTIONS_UT_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -106,7 +106,7 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.13.0
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.14.0
         with:
           artifact-bucket-name: ${{ inputs.api_name == 'account-data' && secrets.ARTIFACT_SOURCE_AD_BUCKET_NAME || inputs.api_name == 'account-management' && secrets.ARTIFACT_SOURCE_AM_BUCKET_NAME || inputs.api_name == 'auth-int-ext' && secrets.ARTIFACT_SOURCE_BUCKET_NAME || inputs.api_name == 'stubs' && secrets.ARTIFACT_BUCKET_STUBS_API || inputs.api_name == 'utils' && secrets.ARTIFACT_SOURCE_UT_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-orch-dev-test.yml b/.github/workflows/deploy-orch-dev-test.yml
@@ -28,13 +28,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.ORCH_GH_ACTIONS_ROLE_ARN }}
           aws-region: eu-west-2
@@ -52,7 +52,7 @@ jobs:
           sam build --parallel
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.8
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.8
         with:
           artifact-bucket-name: ${{ secrets.ORCH_ARTIFACT_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.ORCH_SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/deploy-orch.yml b/.github/workflows/deploy-orch.yml
@@ -25,13 +25,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.ORCH_GH_ACTIONS_ROLE_ARN }}
           aws-region: eu-west-2
@@ -49,7 +49,7 @@ jobs:
           sam build --parallel
 
       - name: Deploy SAM app
-        uses: govuk-one-login/devplatform-upload-action@b7bc01ed6e0b61d54f42e7f3d12dd3fdbb0f172a # v3.8
+        uses: govuk-one-login/devplatform-upload-action@5879c30205266ad61e8299a4fcea76364530c9c1 # v3.8
         with:
           artifact-bucket-name: ${{ secrets.ORCH_ARTIFACT_BUCKET_NAME }}
           signing-profile-name: ${{ secrets.ORCH_SIGNING_PROFILE_NAME }}
diff --git a/.github/workflows/pre-merge-checks-gha.yml b/.github/workflows/pre-merge-checks-gha.yml
@@ -24,7 +24,7 @@ jobs:
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@5f4a0b68ac816d8cb4a52bd88b460549197b7ff1 # v45.0.7
+        uses: tj-actions/changed-files@6b924b1775b8688e12ffb9b5cb5e968e1eb682ec # v45.0.7
         with:
           files: .github/workflows/**.{yml,yaml}
 
diff --git a/.github/workflows/pre-merge-checks-sam.yml b/.github/workflows/pre-merge-checks-sam.yml
@@ -21,13 +21,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.ORCH_SAM_APP_VALIDATE_ROLE_ARN }}
           aws-region: eu-west-2
diff --git a/.github/workflows/pre-merge-checks-sp.yml b/.github/workflows/pre-merge-checks-sp.yml
@@ -27,13 +27,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up SAM cli
-        uses: aws-actions/setup-sam@d78e1a4a9656d3b223e59b80676a797f20093133 # v2
+        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v2
         with:
           use-installer: true
           version: 1.159.1
 
       - name: Set up AWS creds
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ secrets.GH_ACTIONS_VALIDATE_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
