Skip to content

Commit afd2a7d

Browse files
jychpjychp
authored
CHORE: Update GitHub actions dependencies (#1448)
While investigating why the latest Scorecard workflows failed (https://github.com/cartography-cncf/cartography/actions/runs/13084015053 and https://github.com/cartography-cncf/cartography/actions/runs/13090489797), I noticed that several GitHub Actions were outdated, particularly: - **Upload Artifact** in OSSF Scorecard has been deprecated since November 2024. - **Cache V2** in Sphinx relies on an API that has been unavailable since February 1st, 2025. I checked, and we use these actions in a fairly standard way, with minimal breaking changes. These updates should not impact the workflows. I also think it would be beneficial to enable **Dependabot**, but I haven't included it in this PR while we discuss the topic. --------- Signed-off-by: Jeremy Chapeau <[email protected]>
1 parent 83f1303 commit afd2a7d

File tree

6 files changed

+35
-37
lines changed

6 files changed

+35
-37
lines changed

‎.github/workflows/ossf-scorecard.yml

+7-9
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
1-
---
2-
# https://github.com/marketplace/actions/ossf-scorecard-action
1+
# Based on: https://github.com/marketplace/actions/ossf-scorecard-action
32
name: Scorecards supply-chain security
43
on:
5-
# Only the default branch is supported.
6-
branch_protection_rule:
74
schedule:
85
# Weekly on Saturdays.
96
- cron: '30 1 * * 6'
107
push:
11-
branches: [ main, master ]
8+
branches:
9+
- master
1210

1311
# Declare default permissions as read only.
1412
permissions: read-all
@@ -27,12 +25,12 @@ jobs:
2725

2826
steps:
2927
- name: "Checkout code"
30-
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
28+
uses: actions/checkout@v4
3129
with:
3230
persist-credentials: false
3331

3432
- name: "Run analysis"
35-
uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e # tag=v1.1.1
33+
uses: ossf/scorecard-action@v2.4.0
3634
with:
3735
results_file: results.sarif
3836
results_format: sarif
@@ -51,14 +49,14 @@ jobs:
5149
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
5250
# format to the repository Actions tab.
5351
- name: "Upload artifact"
54-
uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
52+
uses: actions/upload-artifact@v4.6.0
5553
with:
5654
name: SARIF file
5755
path: results.sarif
5856
retention-days: 5
5957

6058
# Upload the results to GitHub's code scanning dashboard.
6159
- name: "Upload to code-scanning"
62-
uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
60+
uses: github/codeql-action/upload-sarif@v3.28.5
6361
with:
6462
sarif_file: results.sarif

‎.github/workflows/publish-to-ghcr-and-pypi.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
# 1. Publish to PyPI
20-
- uses: actions/checkout@v2
20+
- uses: actions/checkout@v4
2121
- name: Set up Python 3.10
22-
uses: actions/setup-python@v1
22+
uses: actions/setup-python@v5
2323
with:
2424
python-version: "3.10"
2525

@@ -48,18 +48,18 @@ jobs:
4848
skip_existing: true
4949

5050
# 2. Publish to GHCR
51-
- uses: actions/checkout@v2
51+
- uses: actions/checkout@v4
5252
- name: Extract metadata (tags, labels) for Docker
5353
id: meta
54-
uses: docker/metadata-action@v4
54+
uses: docker/metadata-action@v5
5555
with:
5656
images: ghcr.io/${{ github.repository }}
5757

5858
- name: Set up Docker Buildx
59-
uses: docker/setup-buildx-action@v2
59+
uses: docker/setup-buildx-action@v3
6060

6161
- name: Login to GitHub Container Registry
62-
uses: docker/login-action@v2
62+
uses: docker/login-action@v3
6363
with:
6464
registry: ghcr.io
6565
# This is the user that triggered the Workflow. In this case, it will
@@ -81,7 +81,7 @@ jobs:
8181
sleep 10
8282
8383
- name: Build and push
84-
uses: docker/build-push-action@v3
84+
uses: docker/build-push-action@v6
8585
with:
8686
file: Dockerfile
8787
context: .

‎.github/workflows/sphinx.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -15,20 +15,20 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
# https://github.com/marketplace/actions/checkout
18-
- uses: actions/checkout@v2
18+
- uses: actions/checkout@v4
1919
with:
2020
fetch-depth: 0
2121
lfs: true
2222
# https://github.com/marketplace/actions/setup-python
2323
# ^-- This gives info on matrix testing.
2424
- name: Install Python
25-
uses: actions/setup-python@v2
25+
uses: actions/setup-python@v5
2626
with:
2727
python-version: "3.10"
2828
# https://docs.github.com/en/actions/guides/building-and-testing-python#caching-dependencies
2929
# ^-- How to set up caching for pip on Ubuntu
3030
- name: Cache pip
31-
uses: actions/cache@v2
31+
uses: actions/cache@v4
3232
with:
3333
path: ~/.cache/pip
3434
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -100,7 +100,7 @@ jobs:
100100
# Deploy
101101
# https://github.com/peaceiris/actions-gh-pages
102102
- name: Deploy
103-
uses: peaceiris/actions-gh-pages@v3.8.0
103+
uses: peaceiris/actions-gh-pages@v4.0.0
104104
if: ${{ github.event_name == 'push' }}
105105
with:
106106
publish_branch: gh-pages

‎.github/workflows/test_suite.yml

+13-13
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,18 @@ jobs:
1414
linter:
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@v3
18-
- uses: actions/setup-python@v3
17+
- uses: actions/checkout@v4
18+
- uses: actions/setup-python@v5
1919
with:
2020
python-version: "3.10"
21-
- uses: pre-commit/[email protected].0
21+
- uses: pre-commit/[email protected].1
2222
with:
2323
extra_args: --all-files --show-diff-on-failure
2424

2525
unit-and-integration-tests:
2626
runs-on: ubuntu-latest
2727
steps:
28-
- uses: actions/checkout@v2
28+
- uses: actions/checkout@v4
2929
# https://stackoverflow.com/a/64592785
3030
- name: neo4j 4 instance setup
3131
run: |
@@ -36,11 +36,11 @@ jobs:
3636
--publish 7473:7473 \
3737
--publish 7687:7687 \
3838
neo4j:4.4-community
39-
- uses: actions/setup-python@v2
39+
- uses: actions/setup-python@v5
4040
with:
4141
python-version: "3.10"
4242
# Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
43-
- uses: actions/cache@v2
43+
- uses: actions/cache@v4
4444
with:
4545
path: ~/.cache/pip
4646
key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}
@@ -59,7 +59,7 @@ jobs:
5959
unit-and-integration-tests-neo4j5:
6060
runs-on: ubuntu-latest
6161
steps:
62-
- uses: actions/checkout@v2
62+
- uses: actions/checkout@v4
6363
# https://stackoverflow.com/a/64592785
6464
- name: neo4j 5 setup
6565
run: |
@@ -70,11 +70,11 @@ jobs:
7070
--publish 7473:7473 \
7171
--publish 7687:7687 \
7272
neo4j:5
73-
- uses: actions/setup-python@v2
73+
- uses: actions/setup-python@v5
7474
with:
7575
python-version: "3.10"
7676
# Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
77-
- uses: actions/cache@v2
77+
- uses: actions/cache@v4
7878
with:
7979
path: ~/.cache/pip
8080
key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}
@@ -94,18 +94,18 @@ jobs:
9494
build-docker-image:
9595
runs-on: ubuntu-latest
9696
steps:
97-
- uses: actions/checkout@v2
97+
- uses: actions/checkout@v4
9898
- name: Extract metadata (tags, labels) for Docker
9999
id: meta
100-
uses: docker/metadata-action@v4
100+
uses: docker/metadata-action@v5
101101
with:
102102
images: ghcr.io/${{ github.repository }}
103103

104104
- name: Set up Docker Buildx
105-
uses: docker/setup-buildx-action@v2
105+
uses: docker/setup-buildx-action@v3
106106

107107
- name: Build
108-
uses: docker/build-push-action@v3
108+
uses: docker/build-push-action@v6
109109
with:
110110
file: Dockerfile
111111
push: false # only build the image, don't push it anywhere

‎.pre-commit-config.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ repos:
1818
hooks:
1919
- id: flake8
2020
- repo: https://github.com/hhatto/autopep8
21-
rev: v2.3.1
21+
rev: v2.3.2
2222
hooks:
2323
- id: autopep8
2424
# disable a few rewrites which will cause autopep8 to reflow
2525
args: [--in-place, '--ignore=E265,E501,W504']
2626
- repo: https://github.com/asottile/pyupgrade
27-
rev: v3.19.0
27+
rev: v3.19.1
2828
hooks:
2929
- id: pyupgrade
3030
args: [--py36-plus]
@@ -39,7 +39,7 @@ repos:
3939
- id: reorder-python-imports
4040
args: [--py3-plus]
4141
- repo: https://github.com/pre-commit/mirrors-mypy
42-
rev: v1.13.0
42+
rev: v1.14.1
4343
hooks:
4444
- id: mypy
4545
additional_dependencies:

‎MAINTAINERS.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ List of community members who have shown they are committed to Cartography's con
66

77
- Alex Chantavy (https://github.com/achantavy): General catch-all
88
- Ramon Petgrave (https://github.com/ramonpetgrave64): General catch-all
9-
- Jérémy Chapeau (https://github.com/resilience-jychp): Plugin development
9+
- Jérémy Chapeau (https://github.com/jychp): Plugin development
1010
- Ryan Lane (https://github.com/ryan-lane): Plugin development, general engineering best practices
1111
- Marco Lancini (https://github.com/marco-lancini): Deployment and use-cases
1212
- Kedar Ghule (https://github.com/kedarghule): Plugin development

0 commit comments

Comments
 (0)