Skip to content

Commit 7c11dd8

Browse files
wilfredmulengaclaude
wilfredmulenga
and
claude
authored
fix(security): bundle security dependency updates and upgrade CI actions (May 2026) (#135)
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
1 parent d4d3f07 commit 7c11dd8

24 files changed

Lines changed: 171 additions & 116 deletions

‎.github/workflows/build_server.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
with:
3535
egress-policy: audit
3636
- name: Checkout
37-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
with:
3939
fetch-depth: 0
4040
- name: Set up Go
@@ -104,18 +104,18 @@ jobs:
104104
with:
105105
egress-policy: audit
106106
- name: Checkout
107-
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
108-
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
107+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
108+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
109109
id: app-token
110110
with:
111111
app-id: ${{ vars.GH_APP_ID }}
112112
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
113113
- name: Set up QEMU
114-
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
114+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
115115
- name: Set up Docker Buildx
116-
uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
116+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
117117
- name: Login to DockerHub
118-
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
118+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
119119
with:
120120
username: ${{ secrets.DOCKERHUB_USERNAME }}
121121
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -144,7 +144,7 @@ jobs:
144144
echo "::set-output name=version::$VERSION"
145145
echo "::set-output name=tags::$TAGS"
146146
- name: Fetch reearth-web release
147-
uses: dsaltares/fetch-gh-release-asset@master
147+
uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # v1.1.2
148148
with:
149149
repo: reearth/reearth-classic
150150
version: tags/${{ github.event.inputs.name && github.event.inputs.name != 'blank' && github.event.inputs.name || github.event.inputs.new_tag }}
@@ -154,7 +154,7 @@ jobs:
154154
- name: Extract reearth/web
155155
run: tar -xvf reearth-web.tar.gz; mv reearth-web web; ls
156156
- name: Build and push docker image
157-
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a # v2.10.0
157+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
158158
with:
159159
context: server
160160
platforms: ${{ steps.options.outputs.platforms }}

‎.github/workflows/build_web.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
3838
with:
3939
node-version: lts/*
40-
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
40+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4141
- name: Enable Corepack
4242
run: corepack enable
4343
- name: Get yarn cache directory path
@@ -75,7 +75,7 @@ jobs:
7575
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
7676
with:
7777
egress-policy: audit
78-
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
78+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
7979
id: app-token
8080
with:
8181
app-id: ${{ vars.GH_APP_ID }}
@@ -121,13 +121,13 @@ jobs:
121121
with:
122122
egress-policy: audit
123123
- name: Checkout
124-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
124+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
125125
- name: Set up QEMU
126-
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
126+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
127127
- name: Set up Docker Buildx
128-
uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
128+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
129129
- name: Login to DockerHub
130-
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
130+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
131131
with:
132132
username: ${{ secrets.DOCKERHUB_USERNAME }}
133133
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -156,7 +156,7 @@ jobs:
156156
echo "::set-output name=version::$VERSION"
157157
echo "::set-output name=tags::$TAGS"
158158
- name: Fetch reearth-web release
159-
uses: dsaltares/fetch-gh-release-asset@master
159+
uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # v1.1.2
160160
with:
161161
repo: reearth/reearth-classic
162162
version: tags/${{ github.event.inputs.name && github.event.inputs.name != 'blank' && github.event.inputs.name || github.event.inputs.new_tag }}
@@ -166,7 +166,7 @@ jobs:
166166
- name: Extract reearth/web
167167
run: tar -xvf reearth-web.tar.gz; mv reearth-web web; ls
168168
- name: Build and push docker image
169-
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a # v2.10.0
169+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
170170
with:
171171
context: server
172172
platforms: ${{ steps.options.outputs.platforms }}
@@ -251,7 +251,7 @@ jobs:
251251
with:
252252
egress-policy: audit
253253
- name: Fetch reearth-web release
254-
uses: dsaltares/fetch-gh-release-asset@master
254+
uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # v1.1.2
255255
with:
256256
version: tags/rc
257257
file: reearth-web_rc.tar.gz

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
1515
with:
1616
egress-policy: audit
17-
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1818
with:
1919
fetch-depth: 0
2020
- name: changed files for web
@@ -77,7 +77,7 @@ jobs:
7777
with:
7878
egress-policy: audit
7979
- name: checkout
80-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
80+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8181
- name: Fetch tags
8282
run: git fetch --prune --unshallow --tags
8383
- name: Get info

‎.github/workflows/ci_docker_build_push.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,13 @@ jobs:
3333
with:
3434
egress-policy: audit
3535
- name: Checkout
36-
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3737
- name: Set up QEMU
38-
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
38+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
3939
- name: Set up Docker Buildx
40-
uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
40+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
4141
- name: Login to DockerHub
42-
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
42+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
4343
with:
4444
username: ${{ secrets.DOCKERHUB_USERNAME }}
4545
password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
7070
7171
# TODO: Remove later after migrating to Cloud Run
7272
- name: Fetch reearth-web release
73-
uses: dsaltares/fetch-gh-release-asset@master
73+
uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # v1.1.2
7474
with:
7575
repo: reearth/reearth-classic
7676
version: tags/${{ github.event.inputs.name || needs.info.outputs.tag }}
@@ -81,7 +81,7 @@ jobs:
8181
run: tar -xvf reearth-web.tar.gz; mv reearth-web web; ls
8282

8383
- name: Build and push docker image
84-
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a # v2.10.0
84+
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
8585
with:
8686
context: server
8787
platforms: ${{ steps.options.outputs.platforms }}

‎.github/workflows/ci_server.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
with:
1313
egress-policy: audit
1414
- name: checkout
15-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616
- name: set up
1717
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
1818
with:
@@ -38,7 +38,7 @@ jobs:
3838
with:
3939
egress-policy: audit
4040
- name: checkout
41-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4242
- name: set up
4343
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
4444
with:

‎.github/workflows/ci_web.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
1414
with:
1515
egress-policy: audit
16-
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
1818
with:
1919
node-version: lts/*

‎.github/workflows/e2e.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
2121
with:
2222
node-version: lts/*
23-
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2424
- name: Enable Corepack
2525
run: corepack enable
2626
- name: Get yarn cache directory path

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
git config --global user.name "${{ github.actor }}"
2727
git config --global user.email "${{ github.actor }}@users.noreply.github.com"
2828
git config --global pull.rebase false
29-
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
29+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
3030
id: app-token
3131
with:
3232
app-id: ${{ vars.GH_APP_ID }}
3333
private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
3434
- name: Checkout
35-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3636
with:
3737
fetch-depth: 0
3838
token: ${{ steps.app-token.outputs.token }}

‎.github/workflows/renovate.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
with:
1313
egress-policy: audit
1414
- name: checkout
15-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1616
with:
1717
fetch-depth: 2
1818
- name: fix

‎.github/workflows/reviewer_lottery.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
1414
with:
1515
egress-policy: audit
16-
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
- uses: uesteibar/reviewer-lottery@c291d74388da1cb583aff994b8be945e8eefbcd5 # v3.1.0
1818
with:
1919
repo-token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)