@cryptotaxi247 / SquadScope / commits / 4278756

Update GitHub Actions to Node.js 24 compatible versions (#500)

* Initial plan * Update GitHub Actions pins * Fix pricing review pin comment * Update node-version to 24 in all workflow files --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Copilot committed Jun 15, 2026 at 22:48 UTC 42787562483a754f45dbade7b809d3efd5363e6c
21 files changed +73 -73
.github/workflows/ci.yml
+1 -1
@@ -22,7 +22,7 @@ jobs:
22
23 steps:
24 - name: Checkout code
25 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
26 with:
27 persist-credentials: false
28
.github/workflows/copilot-pricing-review.yml
+2 -2
@@ -14,8 +14,8 @@ jobs:
14 review-pricing:
15 runs-on: ubuntu-latest
16 steps:
17 - # actions/checkout@v4 pinned to a full commit SHA for zizmor.
18 - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
17 + # Pinned to a full commit SHA so zizmor can verify the checkout action.
18 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
19 with:
20 persist-credentials: false
21
.github/workflows/crawl-and-publish.yml
+37 -37
@@ -67,7 +67,7 @@ jobs:
67
68 steps:
69 - name: Check out repository # zizmor: ignore[artipacked] crawl job pushes to the publish branch; checkout token is reused by a later git push
70 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
70 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
71 with:
72 fetch-depth: 0
73 ref: ${{ github.event.repository.default_branch }}
@@ -91,7 +91,7 @@ jobs:
91
92 - name: Find latest successful crawl cache
93 id: previous-cache-run
94 - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
94 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
95 with:
96 script: |
97 const workflowId = 'crawl-and-publish.yml';
@@ -131,7 +131,7 @@ jobs:
131 - name: Restore previous crawl cache
132 if: steps.previous-cache-run.outputs.run_id != ''
133 continue-on-error: true
134 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
134 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
135 with:
136 github-token: ${{ secrets.GITHUB_TOKEN }}
137 run-id: ${{ steps.previous-cache-run.outputs.run_id }}
@@ -141,7 +141,7 @@ jobs:
141 - name: Download previous raw artifacts for same-day reuse
142 if: ${{ steps.previous-cache-run.outputs.run_id != '' && !inputs.rebuild_week }}
143 continue-on-error: true
144 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
144 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
145 with:
146 github-token: ${{ secrets.GITHUB_TOKEN }}
147 run-id: ${{ steps.previous-cache-run.outputs.run_id }}
@@ -151,7 +151,7 @@ jobs:
151 - name: Download previous snapshots for same-day reuse
152 if: ${{ steps.previous-cache-run.outputs.run_id != '' && !inputs.rebuild_week }}
153 continue-on-error: true
154 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
154 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
155 with:
156 github-token: ${{ secrets.GITHUB_TOKEN }}
157 run-id: ${{ steps.previous-cache-run.outputs.run_id }}
@@ -159,7 +159,7 @@ jobs:
159 path: .artifact-reuse/snapshots/
160
161 - name: Set up Python
162 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
162 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
163 with:
164 python-version: '3.12'
165
@@ -221,7 +221,7 @@ jobs:
221
222 - name: Upload raw crawl artifact
223 if: always()
224 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
224 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
225 with:
226 name: raw-data
227 path: data/raw/
@@ -229,7 +229,7 @@ jobs:
229
230 - name: Upload snapshot artifact
231 if: always()
232 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
232 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
233 with:
234 name: crawl-snapshots
235 path: data/snapshots/
@@ -237,7 +237,7 @@ jobs:
237
238 - name: Upload cache artifact
239 if: always()
240 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
240 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
241 with:
242 name: crawl-cache
243 path: data/cache/
@@ -305,7 +305,7 @@ jobs:
305
306 steps:
307 - name: Check out repository
308 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
308 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
309 with:
310 fetch-depth: 0
311 ref: ${{ github.event.repository.default_branch }}
@@ -313,7 +313,7 @@ jobs:
313
314 - name: Download raw crawl artifact
315 if: ${{ !inputs.rebuild_week }}
316 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
316 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
317 with:
318 name: raw-data
319 path: data/raw/
@@ -350,12 +350,12 @@ jobs:
350 fi
351
352 - name: Set up Node
353 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
353 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
354 with:
355 - node-version: '22'
355 + node-version: '24'
356
357 - name: Set up Python
358 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
358 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
359 with:
360 python-version: '3.12'
361
@@ -848,7 +848,7 @@ jobs:
848
849 - name: Upload analyzed data
850 if: always()
851 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
851 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
852 with:
853 name: analyzed-data
854 path: data/analyzed/
@@ -856,7 +856,7 @@ jobs:
856
857 - name: Upload analysis candidate
858 if: always()
859 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
859 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
860 with:
861 name: analysis-candidate
862 path: data/candidates/
@@ -874,31 +874,31 @@ jobs:
874
875 steps:
876 - name: Check out repository # zizmor: ignore[artipacked] generate job pushes to the publish branch; checkout token is reused by a later git push
877 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
877 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
878 with:
879 fetch-depth: 0
880 ref: ${{ github.event.repository.default_branch }}
881
882 - name: Download analyzed data artifact
883 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
883 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
884 with:
885 name: analyzed-data
886 path: data/analyzed/
887
888 - name: Download analysis candidate artifact
889 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
889 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
890 with:
891 name: analysis-candidate
892 path: data/candidates/
893
894 - name: Download raw crawl artifact
895 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
895 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
896 with:
897 name: raw-data
898 path: data/raw/
899
900 - name: Set up Python
901 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
901 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
902 with:
903 python-version: '3.12'
904
@@ -1057,7 +1057,7 @@ jobs:
1057 fi
1058
1059 - name: Upload generated content artifact
1060 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
1060 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1061 with:
1062 name: generated-content
1063 path: |
@@ -1067,7 +1067,7 @@ jobs:
1067 if-no-files-found: warn
1068
1069 - name: Upload promoted analyzed artifact
1070 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
1070 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
1071 with:
1072 name: promoted-analyzed-data
1073 path: data/analyzed/
@@ -1093,7 +1093,7 @@ jobs:
1093
1094 steps:
1095 - name: Check out repository
1096 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1096 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1097 with:
1098 submodules: recursive
1099 fetch-depth: 0
@@ -1101,19 +1101,19 @@ jobs:
1101 persist-credentials: false
1102
1103 - name: Download raw crawl artifact
1104 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
1104 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1105 with:
1106 name: raw-data
1107 path: data/raw/
1108
1109 - name: Download analyzed data artifact
1110 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
1110 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1111 with:
1112 name: promoted-analyzed-data
1113 path: data/analyzed/
1114
1115 - name: Download generated content artifact
1116 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
1116 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1117 with:
1118 name: generated-content
1119 path: content/
@@ -1173,12 +1173,12 @@ jobs:
1173
1174 steps:
1175 - name: Check out repository
1176 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1176 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1177 with:
1178 persist-credentials: false
1179
1180 - name: Download analysis candidate
1181 - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
1181 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1182 with:
1183 name: analysis-candidate
1184 path: data/candidates/
@@ -1223,16 +1223,16 @@ jobs:
1223 discussions: write
1224
1225 steps:
1226 - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1226 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1227 with:
1228 persist-credentials: false
1229
1230 - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
1230 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1231 with:
1232 name: promoted-analyzed-data
1233 path: data/analyzed/
1234
1235 - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
1235 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
1236 with:
1237 name: analysis-candidate
1238 path: data/candidates/
@@ -1357,7 +1357,7 @@ jobs:
1357 should_reskill: ${{ steps.check.outputs.reskill }}
1358
1359 steps:
1360 - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1360 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
1361 with:
1362 fetch-depth: 0
1363 ref: publish
@@ -1393,7 +1393,7 @@ jobs:
1393 contents: write
1394
1395 steps:
1396 - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 # zizmor: ignore[artipacked] reskill job pushes to the publish branch; checkout token is reused by a later git push
1396 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked] reskill job pushes to the publish branch; checkout token is reused by a later git push
1397 with:
1398 fetch-depth: 0
1399 ref: publish
@@ -1409,12 +1409,12 @@ jobs:
1409 fi
1410
1411 - name: Set up Node
1412 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
1412 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
1413 with:
1414 - node-version: '22'
1414 + node-version: '24'
1415
1416 - name: Set up Python
1417 - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
1417 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1418 with:
1419 python-version: '3.12'
1420
.github/workflows/deploy-site.yml
+3 -3
@@ -34,7 +34,7 @@ jobs:
34 HUGO_PARAMS_GA_MEASUREMENT_ID: ${{ secrets.GA_MEASUREMENT_ID }}
35 steps:
36 - name: Check out repository
37 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
37 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
38 with:
39 fetch-depth: 0
40 submodules: recursive
@@ -44,9 +44,9 @@ jobs:
44 uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
45
46 - name: Set up Node.js
47 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
47 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
48 with:
49 - node-version: '20'
49 + node-version: '24'
50
51 - name: Install Hugo
52 run: | # zizmor: ignore[github-env] writes a fixed runner path (${HOME}/.local/hugo) to GITHUB_PATH, not attacker input; needed so later steps can run hugo
.github/workflows/podcaster-handoff-smoke.yml
+1 -1
@@ -32,7 +32,7 @@ jobs:
32
33 steps:
34 - name: Check out repository
35 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
36 with:
37 persist-credentials: false
38
.github/workflows/restore-publish-backup.yml
+2 -2
@@ -20,14 +20,14 @@ jobs:
20 runs-on: ubuntu-latest
21 steps:
22 - name: Check out workflow source
23 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
23 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
24 with:
25 ref: ${{ github.sha }}
26 path: workflow-source
27 persist-credentials: false
28
29 - name: Check out publish # zizmor: ignore[artipacked] this job force-pushes the restored backup to publish; checkout token is reused by git push
30 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
30 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
31 with:
32 ref: publish
33 fetch-depth: 0
.github/workflows/security-scanning.yml
+2 -2
@@ -38,7 +38,7 @@ jobs:
38
39 steps:
40 - name: Checkout code
41 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
42 with:
43 persist-credentials: false
44
@@ -91,7 +91,7 @@ jobs:
91 continue-on-error: true
92 steps:
93 - name: Checkout repository
94 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
94 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
95 with:
96 persist-credentials: false
97
.github/workflows/site-preview.yml
+4 -4
@@ -48,16 +48,16 @@ jobs:
48 PREVIEW_BASEURL: "/"
49 steps:
50 - name: Check out repository
51 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
51 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
52 with:
53 fetch-depth: 0
54 submodules: recursive
55 persist-credentials: false
56
57 - name: Set up Node.js
58 - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
58 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
59 with:
60 - node-version: '20'
60 + node-version: '24'
61
62 - name: Install Hugo
63 run: |
@@ -140,7 +140,7 @@ jobs:
140 issues: write # PR comments are created via the Issues API (listComments/createComment/updateComment)
141 steps:
142 - name: Post or update preview comment
143 - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
143 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
144 env:
145 RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
146 with:
.github/workflows/squad-ci.yml
+1 -1
@@ -15,7 +15,7 @@ jobs:
15 test:
16 runs-on: ubuntu-latest
17 steps:
18 - - uses: actions/checkout@v4
18 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
19
20 - name: Build and test
21 run: |
.github/workflows/squad-docs.yml
+1 -1
@@ -18,7 +18,7 @@ jobs:
18 build:
19 runs-on: ubuntu-latest
20 steps:
21 - - uses: actions/checkout@v4
21 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
22
23 - name: Build docs
24 run: |
.github/workflows/squad-heartbeat.yml
+3 -3
@@ -25,7 +25,7 @@ jobs:
25 heartbeat:
26 runs-on: ubuntu-latest
27 steps:
28 - - uses: actions/checkout@v4
28 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
29
30 - name: Check triage script
31 id: check-script
@@ -48,7 +48,7 @@ jobs:
48
49 - name: Ralph — Apply triage decisions
50 if: steps.check-script.outputs.has_script == 'true' && hashFiles('triage-results.json') != ''
51 - uses: actions/github-script@v7
51 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
52 with:
53 script: |
54 const fs = require('fs');
@@ -100,7 +100,7 @@ jobs:
100 # Copilot auto-assign step (uses PAT if available)
101 - name: Ralph — Assign @copilot issues
102 if: success()
103 - uses: actions/github-script@v7
103 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
104 with:
105 github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
106 script: |
.github/workflows/squad-insider-release.yml
+1 -1
@@ -12,7 +12,7 @@ jobs:
12 release:
13 runs-on: ubuntu-latest
14 steps:
15 - - uses: actions/checkout@v4
15 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
16 with:
17 fetch-depth: 0
18
.github/workflows/squad-issue-assign.yml
+3 -3
@@ -14,10 +14,10 @@ jobs:
14 if: startsWith(github.event.label.name, 'squad:')
15 runs-on: ubuntu-latest
16 steps:
17 - - uses: actions/checkout@v4
17 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
18
19 - name: Identify assigned member and trigger work
20 - uses: actions/github-script@v7
20 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
21 with:
22 script: |
23 const fs = require('fs');
@@ -116,7 +116,7 @@ jobs:
116 # Separate step: assign @copilot using PAT (required for coding agent)
117 - name: Assign @copilot coding agent
118 if: github.event.label.name == 'squad:copilot'
119 - uses: actions/github-script@v7
119 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
120 with:
121 github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN }}
122 script: |
.github/workflows/squad-label-enforce.yml
+2 -2
@@ -12,10 +12,10 @@ jobs:
12 enforce:
13 runs-on: ubuntu-latest
14 steps:
15 - - uses: actions/checkout@v4
15 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
16
17 - name: Enforce mutual exclusivity
18 - uses: actions/github-script@v7
18 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
19 with:
20 script: |
21 const issue = context.payload.issue;
.github/workflows/squad-preview.yml
+1 -1
@@ -12,7 +12,7 @@ jobs:
12 validate:
13 runs-on: ubuntu-latest
14 steps:
15 - - uses: actions/checkout@v4
15 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
16
17 - name: Build and test
18 run: |
.github/workflows/squad-promote.yml
+2 -2
@@ -18,7 +18,7 @@ jobs:
18 name: Promote dev → preview
19 runs-on: ubuntu-latest
20 steps:
21 - - uses: actions/checkout@v4
21 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
22 with:
23 fetch-depth: 0
24 token: ${{ secrets.GITHUB_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
70 needs: dev-to-preview
71 runs-on: ubuntu-latest
72 steps:
73 - - uses: actions/checkout@v4
73 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
74 with:
75 fetch-depth: 0
76 token: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/squad-release.yml
+1 -1
@@ -12,7 +12,7 @@ jobs:
12 release:
13 runs-on: ubuntu-latest
14 steps:
15 - - uses: actions/checkout@v4
15 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
16 with:
17 fetch-depth: 0
18
.github/workflows/squad-triage.yml
+2 -2
@@ -13,10 +13,10 @@ jobs:
13 if: github.event.label.name == 'squad'
14 runs-on: ubuntu-latest
15 steps:
16 - - uses: actions/checkout@v4
16 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
17
18 - name: Triage issue via Lead agent
19 - uses: actions/github-script@v7
19 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
20 with:
21 script: |
22 const fs = require('fs');
.github/workflows/sync-publish-to-main.yml
+1 -1
@@ -22,7 +22,7 @@ jobs:
22 if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
23 steps:
24 - name: Check out main # zizmor: ignore[artipacked] sync job force-pushes the sync branch; checkout token is reused by git push
25 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
25 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
26 with:
27 ref: main
28 fetch-depth: 0
.github/workflows/sync-squad-labels.yml
+2 -2
@@ -15,10 +15,10 @@ jobs:
15 sync-labels:
16 runs-on: ubuntu-latest
17 steps:
18 - - uses: actions/checkout@v4
18 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
19
20 - name: Parse roster and sync labels
21 - uses: actions/github-script@v7
21 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
22 with:
23 script: |
24 const fs = require('fs');
.github/workflows/trigger-podcast.yml
+1 -1
@@ -23,7 +23,7 @@ jobs:
23
24 steps:
25 - name: Check out repository
26 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
27 with:
28 persist-credentials: false
29