From f1919b4d2bf904f12f9491870b130308e093242f Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 04:33:41 +0000 Subject: [PATCH] build(deps): update actions --- .github/actions/build-java-layer/action.yml | 2 +- .github/actions/build-nodejs-layer/action.yml | 2 +- .github/workflows/ci-java.yml | 2 +- .github/workflows/ci-nodejs.yml | 2 +- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/integration-test.yml | 14 +++++++------- .github/workflows/layer-publish.yml | 4 ++-- .github/workflows/ossf-scorecard.yml | 2 +- .github/workflows/publish-layer-collector.yml | 2 +- .github/workflows/release-layer-collector.yml | 2 +- .github/workflows/release-layer-java.yml | 6 +++--- .github/workflows/release-layer-nodejs.yml | 2 +- .github/workflows/release-layer-python.yml | 4 ++-- .github/workflows/release-layer-ruby.yml | 4 ++-- .github/workflows/zizmor.yml | 2 +- 15 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/actions/build-java-layer/action.yml b/.github/actions/build-java-layer/action.yml index 5ee31b6e1a..3ab769c8c8 100644 --- a/.github/actions/build-java-layer/action.yml +++ b/.github/actions/build-java-layer/action.yml @@ -27,7 +27,7 @@ runs: java-version: 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: cache-provider: basic # MIT licensed (see https://github.com/gradle/actions/releases/tag/v6.1.0) diff --git a/.github/actions/build-nodejs-layer/action.yml b/.github/actions/build-nodejs-layer/action.yml index 16b848f304..aa1f912920 100644 --- a/.github/actions/build-nodejs-layer/action.yml +++ b/.github/actions/build-nodejs-layer/action.yml @@ -12,7 +12,7 @@ outputs: runs: using: composite steps: - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: 'nodejs/.nvmrc' diff --git a/.github/workflows/ci-java.yml b/.github/workflows/ci-java.yml index 40a3c65ced..561e88b433 100644 --- a/.github/workflows/ci-java.yml +++ b/.github/workflows/ci-java.yml @@ -33,7 +33,7 @@ jobs: java-version: 17 - name: Setup Gradle - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: add-job-summary-as-pr-comment: on-failure # Valid values are 'never' (default), 'always', and 'on-failure' cache-provider: basic # MIT licensed (see https://github.com/gradle/actions/releases/tag/v6.1.0) diff --git a/.github/workflows/ci-nodejs.yml b/.github/workflows/ci-nodejs.yml index 2f7b834f3b..b9191006bc 100644 --- a/.github/workflows/ci-nodejs.yml +++ b/.github/workflows/ci-nodejs.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: 'nodejs/.nvmrc' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 95f3e13a24..6588f0dacc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -70,7 +70,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.target.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -84,7 +84,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: working-directory: ${{ matrix.target.directory }} # There are no array literals in GHA that is why we need to use fromJson. @@ -108,7 +108,7 @@ jobs: if: ${{ matrix.target.language == 'java' }} - name: Setup Gradle - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: cache-provider: basic # MIT licensed (see https://github.com/gradle/actions/releases/tag/v6.1.0) @@ -130,6 +130,6 @@ jobs: if: ${{ matrix.target.language == 'csharp' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: category: "/language:${{matrix.target.language}}" diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml index 6f4a7227cb..880969f6a9 100644 --- a/.github/workflows/integration-test.yml +++ b/.github/workflows/integration-test.yml @@ -65,7 +65,7 @@ jobs: id: build with: architecture: ${{ matrix.architecture }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: opentelemetry-collector-layer-${{ matrix.architecture }}-${{ inputs.language }}.zip path: ${{ steps.build.outputs.artifact-path }} @@ -86,7 +86,7 @@ jobs: id: build with: language: ${{ matrix.language }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: opentelemetry-${{ matrix.language }}-layer.zip path: ${{ steps.build.outputs.artifact-path }} @@ -111,21 +111,21 @@ jobs: with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: 'integration-tests/.nvmrc' - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: opentelemetry-collector-layer-${{ matrix.architecture }}-${{ inputs.language }}.zip path: artifacts/ - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: opentelemetry-${{ matrix.language }}-layer.zip path: artifacts/ - - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4 + - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }} role-duration-seconds: 1200 @@ -139,7 +139,7 @@ jobs: - name: Setup Gradle if: ${{ startsWith(matrix.language, 'java') }} - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 with: cache-provider: basic # MIT licensed (see https://github.com/gradle/actions/releases/tag/v6.1.0) diff --git a/.github/workflows/layer-publish.yml b/.github/workflows/layer-publish.yml index 0b369ba718..fa6a828e26 100644 --- a/.github/workflows/layer-publish.yml +++ b/.github/workflows/layer-publish.yml @@ -101,11 +101,11 @@ jobs: INPUTS_LAYER_VERSION: ${{ inputs.layer-version }} - name: Download built layer - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ inputs.artifact-name }} - - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4 + - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0 with: role-to-assume: ${{ inputs.role-arn || secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN || secrets.PROD_LAMBDA_ROLE_ARN }} role-duration-seconds: 1200 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index ab90c755c9..83e82cc9fa 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -16,4 +16,4 @@ jobs: contents: read # for actions/checkout id-token: write # for Scorecard to publish results security-events: write # for the SARIF upload to code scanning - uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@68c7b2f0ef9cd9c1e2b71d3018f63127be189578 # v0.14.0 + uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0 diff --git a/.github/workflows/publish-layer-collector.yml b/.github/workflows/publish-layer-collector.yml index ef59c65906..37e109165a 100644 --- a/.github/workflows/publish-layer-collector.yml +++ b/.github/workflows/publish-layer-collector.yml @@ -115,7 +115,7 @@ jobs: INPUTS_BUILD_TAGS: ${{ inputs.build-tags }} MATRIX_ARCHITECTURE: ${{ matrix.architecture }} - name: Upload Collector Artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: opentelemetry-collector-layer-${{ matrix.architecture }}.zip path: ${{ github.workspace }}/collector/build/opentelemetry-collector-layer-${{ matrix.architecture }}.zip diff --git a/.github/workflows/release-layer-collector.yml b/.github/workflows/release-layer-collector.yml index 444a3aa05d..6b80068dc9 100644 --- a/.github/workflows/release-layer-collector.yml +++ b/.github/workflows/release-layer-collector.yml @@ -42,7 +42,7 @@ jobs: id: build with: architecture: ${{ matrix.architecture }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: opentelemetry-collector-layer-${{ matrix.architecture }}.zip path: ${{ steps.build.outputs.artifact-path }} diff --git a/.github/workflows/release-layer-java.yml b/.github/workflows/release-layer-java.yml index e5accb018a..d40e0aab57 100644 --- a/.github/workflows/release-layer-java.yml +++ b/.github/workflows/release-layer-java.yml @@ -38,19 +38,19 @@ jobs: - uses: $/.github/actions/build-java-layer id: build - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save javaagent layer to build with: name: opentelemetry-javaagent-layer.zip path: ${{ steps.build.outputs.javaagent-artifact-path }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save javawrapper layer to build with: name: opentelemetry-javawrapper-layer.zip path: ${{ steps.build.outputs.javawrapper-artifact-path }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save javawrapper layer tar.gz to build with: name: opentelemetry-javawrapper-layer.tar.gz diff --git a/.github/workflows/release-layer-nodejs.yml b/.github/workflows/release-layer-nodejs.yml index 2d3f380812..9101a07606 100644 --- a/.github/workflows/release-layer-nodejs.yml +++ b/.github/workflows/release-layer-nodejs.yml @@ -37,7 +37,7 @@ jobs: - uses: $/.github/actions/build-nodejs-layer id: build - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save assembled layer to build with: name: opentelemetry-nodejs-layer.zip diff --git a/.github/workflows/release-layer-python.yml b/.github/workflows/release-layer-python.yml index 33ae9f22d4..027f3c4830 100644 --- a/.github/workflows/release-layer-python.yml +++ b/.github/workflows/release-layer-python.yml @@ -22,7 +22,7 @@ jobs: - uses: $/.github/actions/build-python-layer id: build - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save assembled layer to build with: name: opentelemetry-python-layer.zip @@ -55,7 +55,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: opentelemetry-python-layer.zip diff --git a/.github/workflows/release-layer-ruby.yml b/.github/workflows/release-layer-ruby.yml index 1374e846ec..c3011144aa 100644 --- a/.github/workflows/release-layer-ruby.yml +++ b/.github/workflows/release-layer-ruby.yml @@ -22,7 +22,7 @@ jobs: - uses: $/.github/actions/build-ruby-layer id: build - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 name: Save assembled layer to build with: name: opentelemetry-ruby-layer.zip @@ -55,7 +55,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: opentelemetry-ruby-layer.zip diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index d2f2f4ebdd..3599008fb8 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -15,4 +15,4 @@ jobs: permissions: contents: read # for actions/checkout security-events: write # for zizmor to upload SARIF results - uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@03559ef555db0eae5d85c3c6347d1530243e7aa7 # v0.13.0 + uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0