chore(deps): update github actions (#158)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-06 11:12:00 +00:00 · 2026-10-05 20:10:57 +00:00 · 2026-10-05 20:10:57 +00:00 · 4251fe9b49
commit 4251fe9b49
parent 324951ca93
20 changed files with 22 additions and 22 deletions
--- a/.github/workflows/cd-hcp-fargate.yaml
+++ b/.github/workflows/cd-hcp-fargate.yaml
@ -216,7 +216,7 @@ jobs:
          echo "ship-gate: hotfix/release path accepted (${PREV} -> ${TAG} from ${TARGET_COMMITISH:-branch})"

      - name: Configure AWS credentials using OIDC
-        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
@ -255,10 +255,10 @@ jobs:
          } >> "${GITHUB_OUTPUT}"

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
--- a/.github/workflows/cd-hcp-lambda.yaml
+++ b/.github/workflows/cd-hcp-lambda.yaml
@ -244,7 +244,7 @@ jobs:
          PY

      - name: Configure AWS credentials using OIDC
-        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
--- a/.github/workflows/cd-hcp-spa.yaml
+++ b/.github/workflows/cd-hcp-spa.yaml
@ -225,7 +225,7 @@ jobs:
          echo "dist/index.html sha256=${index_sha}"

      - name: Configure AWS credentials using OIDC
-        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
--- a/.github/workflows/cd-hcp-static.yaml
+++ b/.github/workflows/cd-hcp-static.yaml
@ -295,7 +295,7 @@ jobs:
          echo "${OUTPUT_DIR}/${VERIFY_KEY} sha256=${verify_sha}"

      - name: Configure AWS credentials using OIDC
-        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@ -82,7 +82,7 @@ jobs:
          cache: npm
          cache-dependency-path: ${{ inputs.cache-dependency-path }}

-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
        with:
          ruby-version: ${{ inputs.ruby-version }}
          bundler-cache: true
--- a/.github/workflows/ci-mobile-ios.yaml
+++ b/.github/workflows/ci-mobile-ios.yaml
@ -214,7 +214,7 @@ jobs:
          cache: npm
          cache-dependency-path: ${{ inputs.cache-dependency-path }}

-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
        with:
          ruby-version: ${{ inputs.ruby-version }}
          bundler-cache: true
--- a/workflow-templates/cdk-deploy.yml
+++ b/workflow-templates/cdk-deploy.yml
@ -5,7 +5,7 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
      # reusable workflow's default — passed explicitly to pin against drift.
--- a/workflow-templates/ci-dotnet.yml
+++ b/workflow-templates/ci-dotnet.yml
@ -12,4 +12,4 @@ jobs:
    # Every input is optional. Common overrides: `solution` (defaults to *.sln
    # in the working directory), `working-directory`, and `dotnet-version`
    # (defaults to 8.0.x). This reusable has no `node-version` input.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
--- a/workflow-templates/ci-mobile-ios.yml
+++ b/workflow-templates/ci-mobile-ios.yml
@ -8,7 +8,7 @@ jobs:
  ci:
    # Job id MUST stay `ci`: the reusable's aggregator job is also `ci`, so the
    # check context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-mobile-ios.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-mobile-ios.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also
      # the reusable workflow's default — passed explicitly to pin against drift.
--- a/workflow-templates/ci-node.yml
+++ b/workflow-templates/ci-node.yml
@ -6,7 +6,7 @@ on:

 jobs:
  ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
      # reusable workflow's default — passed explicitly to pin against drift.
--- a/workflow-templates/ci-python-app.yml
+++ b/workflow-templates/ci-python-app.yml
@ -10,4 +10,4 @@ jobs:
    # check context resolves to the required `ci / ci`.
    #
    # Every input is optional. Common override: `source-dirs` (ruff targets).
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
--- a/workflow-templates/ci-python.yml
+++ b/workflow-templates/ci-python.yml
@ -6,7 +6,7 @@ on:

 jobs:
  ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      run-tests: true
      # ci-python-sam.yaml declares a `node-version` input (default "24") that
--- a/workflow-templates/ci-static.yml
+++ b/workflow-templates/ci-static.yml
@ -8,7 +8,7 @@ jobs:
  ci:
    # Job id MUST stay `ci`: the reusable's job is also `ci`, so the check
    # context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-static.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
      # generates lockfileVersion 3. Being explicit avoids lockfile drift.
--- a/workflow-templates/ci-typescript-frontend.yml
+++ b/workflow-templates/ci-typescript-frontend.yml
@ -8,7 +8,7 @@ jobs:
  ci:
    # Job id MUST stay `ci`: the reusable's job is also `ci`, so the check
    # context resolves to the required `ci / ci`.
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
      # generates lockfileVersion 3. Being explicit avoids lockfile drift.
--- a/workflow-templates/dependency-review.yml
+++ b/workflow-templates/dependency-review.yml
@ -8,4 +8,4 @@ permissions:

 jobs:
  dependency-review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
--- a/workflow-templates/dotnet-eb-deploy.yml
+++ b/workflow-templates/dotnet-eb-deploy.yml
@ -5,7 +5,7 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-dotnet-eb.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-dotnet-eb.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Required: the project to publish, relative to the repo root.
      project: REPLACE-ME-project-csproj
--- a/workflow-templates/labeler.yml
+++ b/workflow-templates/labeler.yml
@ -13,4 +13,4 @@ permissions:

 jobs:
  label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
--- a/workflow-templates/mobile-ios-deploy.yml
+++ b/workflow-templates/mobile-ios-deploy.yml
@ -5,7 +5,7 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Pinned explicitly (handbook): local dev is Node 24 / npm 11, which
      # generates lockfileVersion 3. Being explicit avoids lockfile drift.
--- a/workflow-templates/release.yml
+++ b/workflow-templates/release.yml
@ -13,7 +13,7 @@ permissions:

 jobs:
  release:
-    uses: Sea-Haven-Industries/.github/.github/workflows/release.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/release.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      version: ${{ inputs.version }}
      # Tags in this org are v-prefixed MAJOR.MINOR.PATCH; "v" is the default
--- a/workflow-templates/sam-deploy.yml
+++ b/workflow-templates/sam-deploy.yml
@ -5,7 +5,7 @@ on:

 jobs:
  deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@9781774f04b824b1182ff41638687f1c01c04361 # v1.0.11
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
    with:
      # Required: the CloudFormation stack name (kebab-case, matches repo name).
      # NOTE: this is a literal placeholder on purpose — starter-workflow variables