From eba16a221364413c35caabf195ac95bc1306455e Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:10:23 +0200 Subject: [PATCH 01/10] update actions/checkout@v4 -> actions/checkout@v6 --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/docker-publish.yml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 34a90ef5..756b025e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: style: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Setup Rust uses: ./.github/actions/setup-rust with: @@ -39,7 +39,7 @@ jobs: outputs: msrv: ${{ steps.read-declared-msrv.outputs.msrv }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - id: read-declared-msrv name: Read msrv from Cargo.toml rust_version field run: echo "msrv=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name = "scryer-prolog") | ."rust_version"')" >> "$GITHUB_OUTPUT" @@ -68,7 +68,7 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - uses: actionhippie/swap-space@v1 if: matrix.use_swap with: @@ -167,7 +167,7 @@ jobs: report: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: Setup Rust uses: ./.github/actions/setup-rust with: diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index ae969be3..f6a2491c 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx From 8f33eaf7d15d6e126db78bd0d71a11f59a54c48d Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:13:46 +0200 Subject: [PATCH 02/10] update actions/upload-artifact@v4 -> actions/upload-artifact@v7 --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 756b025e..3658d2ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -110,7 +110,7 @@ jobs: - name: Publish release binary artifact if: matrix.publish - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: path: | target/${{ matrix.target }}/release/scryer-prolog* @@ -147,12 +147,12 @@ jobs: || echo "::warning ::logtalk compliance suite failed" # -u "https://github.com/LogtalkDotOrg/logtalk3/tree/$LOGTALK_GIT_HASH/tests/prolog/" \ - name: Publish Logtalk test logs - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: logtalk-test-logs path: '${{ env.LOGTALKUSER }}/tests/prolog/logtalk_tester_logs' - name: Publish Logtalk test results artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: logtalk-test-results path: '${{ env.LOGTALKUSER }}/tests/prolog/**/*.xml' @@ -187,7 +187,7 @@ jobs: run: | RUSTC_BOOTSTRAP=1 cargo test --all -- -Z unstable-options --format json --report-time | cargo2junit > cargo_test_results.xml - name: Publish cargo test results artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: cargo-test-results path: cargo_test_results.xml @@ -206,7 +206,7 @@ jobs: - run: cargo bench --bench run_criterion -- --profile-time 60 - name: Publish benchmark results - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: benchmark-results path: | From 4db325e4b8d754409829070aa8c9d6a78896ad93 Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:16:58 +0200 Subject: [PATCH 03/10] update actions/download-artifact@v4 -> actions/download-artifact@v8 --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3658d2ec..1fb48656 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -123,7 +123,7 @@ jobs: needs: [build-test] steps: # Download prebuilt ubuntu binary from build-test job, setup logtalk - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: scryer-prolog_ubuntu-22.04_x86_64-unknown-linux-gnu - run: | @@ -220,7 +220,7 @@ jobs: needs: [build-test] if: startsWith(github.ref, 'refs/tags/v') steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 - name: Zip binaries for release run: | zip scryer-prolog_macos-latest.zip ./scryer-prolog_macos-latest_x86_64-apple-darwin/scryer-prolog From f456c98c5bf449ce2b253b1dfcc813ceae23d6d8 Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:18:20 +0200 Subject: [PATCH 04/10] update docker/setup-buildx-action@v3 -> docker/setup-buildx-action@v4 --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index f6a2491c..846f0c05 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -19,7 +19,7 @@ jobs: # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx # https://github.com/docker/setup-buildx-action - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 # Login against Docker registry - name: Log into registry From 82378c6338979d4e0e0ae6b8aef463d43057601c Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:19:08 +0200 Subject: [PATCH 05/10] update docker/login-action@v3 -> docker/login-action@v4 --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 846f0c05..1e3395bc 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -24,7 +24,7 @@ jobs: # Login against Docker registry - name: Log into registry # https://github.com/docker/login-action - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} From e3d020ea74555728698c1fd2ae2c9ab0d92a09d9 Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:20:39 +0200 Subject: [PATCH 06/10] update docker/metadata-action@v5 -> docker/metadata-action@v6 --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 1e3395bc..05b23326 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -35,7 +35,7 @@ jobs: - name: Extract Docker metadata id: meta # https://github.com/docker/metadata-action - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/scryer-prolog tags: | From 4a9f690c167eb00d3a6f4b57554dc6d6a8b844a7 Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:22:09 +0200 Subject: [PATCH 07/10] update docker/build-push-action@v6 -> docker/build-push-action@v7 --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 05b23326..3e0107b7 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -47,7 +47,7 @@ jobs: - name: Build and push Docker image id: build-and-push # https://github.com/docker/build-push-action - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 # v4 adds SLSA Provenance attestation which is # - unsupported by AWS Lambda # - limited support by Google Cloud Run From 0aa6abe517ede012a5b53b52f7d52eea42c43993 Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 22:57:13 +0200 Subject: [PATCH 08/10] pin 3rd-party actions following githubs recommendations[^3rd-p-a] to use full-length commit SHA for 3rd-party actions setup dependabot to help keep dependencies up-to-date [^3rd-p-a]: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions --- .github/actions/setup-rust/action.yml | 6 ++-- .github/dependabot.yml | 52 +++++++++++++++++++++++++++ .github/workflows/ci.yml | 32 ++++++++--------- .github/workflows/docker-publish.yml | 12 +++---- 4 files changed, 77 insertions(+), 25 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index 6e6786c7..5ce75e12 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -16,7 +16,7 @@ inputs: runs: using: "composite" steps: - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master id: toolchain with: toolchain: ${{ inputs.rust-version }} @@ -33,7 +33,7 @@ runs: echo "CC=clang" >> $GITHUB_ENV echo "PKG_CONFIG_SYSROOT_DIR=/" >> $GITHUB_ENV - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | ~/.cargo/bin/ @@ -46,7 +46,7 @@ runs: # Remove build artifacts for the current crate, since it will be rebuilt every # run anyway, but keep dependency artifacts to cache them. # Must be placed after actions/cache so its post step runs first. - - uses: pyTooling/Actions/with-post-step@v4.1.0 + - uses: pyTooling/Actions/with-post-step@679ec24c80c6736efa7099a11c19086263a6beba # v4.1.0 with: main: bash ./.github/actions/setup-rust/cleanup.sh post: bash ./.github/actions/setup-rust/cleanup.sh diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..251a5598 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,52 @@ +version: 2 + +updates: + # Enable version updates for cargo + - package-ecosystem: "cargo" + # Look for `Cargo.toml` and `Cargo.lock` files in the `root` directory + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: "7" + groups: + cargo-incompatible: + applies-to: version-updates + # TODO: use incompatible update-type once available + # see issue https://github.com/dependabot/dependabot-core/issues/9681 + update-types: + - "major" + - "minor" # pre-1.0 dependencies + cargo-compatible: + applies-to: version-updates + # TODO: use compatible update-type once available + # see issue https://github.com/dependabot/dependabot-core/issues/9681 + update-types: + - "patch" + ignore: + # ignore all cargo updates for now while dependabot does not respect msrv/rust-version + # see issue https://github.com/dependabot/dependabot-core/issues/5423 + - dependency-name: "*" + + # Enable version updates for Docker + - package-ecosystem: "docker" + # Look for a `Dockerfile` in the `root` directory + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: "7" + + # Enable version updates for GitHub Actions + - package-ecosystem: "github-actions" + # Workflow files stored in the default location of `.github/workflows` + # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`. + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: "7" + ignore: + # these actions doesn't have proper version tags + - dependency-name: "dtolnay/rust-toolchain" + - dependency-name: "logtalk-actions/setup-logtalk" \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1fb48656..b58d2a90 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: style: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Rust uses: ./.github/actions/setup-rust with: @@ -39,7 +39,7 @@ jobs: outputs: msrv: ${{ steps.read-declared-msrv.outputs.msrv }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - id: read-declared-msrv name: Read msrv from Cargo.toml rust_version field run: echo "msrv=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name = "scryer-prolog") | ."rust_version"')" >> "$GITHUB_OUTPUT" @@ -68,8 +68,8 @@ jobs: run: shell: bash steps: - - uses: actions/checkout@v6 - - uses: actionhippie/swap-space@v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actionhippie/swap-space@0cffa893f224708cfb6b011690d8ba819d69c10f # v1.1.0 if: matrix.use_swap with: size: 10G @@ -110,7 +110,7 @@ jobs: - name: Publish release binary artifact if: matrix.publish - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: | target/${{ matrix.target }}/release/scryer-prolog* @@ -123,14 +123,14 @@ jobs: needs: [build-test] steps: # Download prebuilt ubuntu binary from build-test job, setup logtalk - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 with: name: scryer-prolog_ubuntu-22.04_x86_64-unknown-linux-gnu - run: | chmod +x release/scryer-prolog echo "$PWD/release" >> "$GITHUB_PATH" - name: Install Logtalk - uses: logtalk-actions/setup-logtalk@master + uses: logtalk-actions/setup-logtalk@4ea002fe3037199afcf1c6c91bf1f57de0f995e6 # master with: logtalk-version: "3.70.0" logtalk-tool-dependencies: false @@ -147,17 +147,17 @@ jobs: || echo "::warning ::logtalk compliance suite failed" # -u "https://github.com/LogtalkDotOrg/logtalk3/tree/$LOGTALK_GIT_HASH/tests/prolog/" \ - name: Publish Logtalk test logs - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: logtalk-test-logs path: '${{ env.LOGTALKUSER }}/tests/prolog/logtalk_tester_logs' - name: Publish Logtalk test results artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: logtalk-test-results path: '${{ env.LOGTALKUSER }}/tests/prolog/**/*.xml' - name: Publish Logtalk test summary - uses: EnricoMi/publish-unit-test-result-action/composite@master + uses: EnricoMi/publish-unit-test-result-action/composite@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0 with: check_name: Logtalk test summary files: '${{ env.LOGTALKUSER }}/tests/prolog/**/*.xml' @@ -167,7 +167,7 @@ jobs: report: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Rust uses: ./.github/actions/setup-rust with: @@ -187,12 +187,12 @@ jobs: run: | RUSTC_BOOTSTRAP=1 cargo test --all -- -Z unstable-options --format json --report-time | cargo2junit > cargo_test_results.xml - name: Publish cargo test results artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: cargo-test-results path: cargo_test_results.xml - name: Publish cargo test summary - uses: EnricoMi/publish-unit-test-result-action/composite@master + uses: EnricoMi/publish-unit-test-result-action/composite@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0 with: check_name: Cargo test summary files: cargo_test_results.xml @@ -206,7 +206,7 @@ jobs: - run: cargo bench --bench run_criterion -- --profile-time 60 - name: Publish benchmark results - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: benchmark-results path: | @@ -220,7 +220,7 @@ jobs: needs: [build-test] if: startsWith(github.ref, 'refs/tags/v') steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 - name: Zip binaries for release run: | zip scryer-prolog_macos-latest.zip ./scryer-prolog_macos-latest_x86_64-apple-darwin/scryer-prolog @@ -229,7 +229,7 @@ jobs: zip scryer-prolog_windows-latest.zip ./scryer-prolog_windows-latest_x86_64-pc-windows-msvc/scryer-prolog.exe zip scryer-prolog_wasm32.zip ./scryer-prolog_ubuntu-22.04_wasm32-unknown-unknown/scryer-prolog.wasm - name: Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 with: files: | scryer-prolog_macos-latest.zip diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 3e0107b7..35848179 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -14,17 +14,17 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx # https://github.com/docker/setup-buildx-action - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 # Login against Docker registry - name: Log into registry # https://github.com/docker/login-action - uses: docker/login-action@v4 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -35,7 +35,7 @@ jobs: - name: Extract Docker metadata id: meta # https://github.com/docker/metadata-action - uses: docker/metadata-action@v6 + uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 with: images: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/scryer-prolog tags: | @@ -47,8 +47,8 @@ jobs: - name: Build and push Docker image id: build-and-push # https://github.com/docker/build-push-action - uses: docker/build-push-action@v7 - # v4 adds SLSA Provenance attestation which is + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 + # v4 adds SLSA Provenance attestation which is # - unsupported by AWS Lambda # - limited support by Google Cloud Run # > If deploying a multi-architecture image, the manifest list must include linux/amd64. From 717c3c2db8b606201fd548ebde9c61a67a33decf Mon Sep 17 00:00:00 2001 From: Skgland Date: Fri, 10 Apr 2026 23:59:59 +0200 Subject: [PATCH 09/10] update actions/cache@v4.3.0 -> actions/cache@v5.0.4 --- .github/actions/setup-rust/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index 5ce75e12..d7bdd40e 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -33,7 +33,7 @@ runs: echo "CC=clang" >> $GITHUB_ENV echo "PKG_CONFIG_SYSROOT_DIR=/" >> $GITHUB_ENV - - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: | ~/.cargo/bin/ From 8bbb484f94c891bb64f9ec43e89ba9814618ac79 Mon Sep 17 00:00:00 2001 From: Skgland Date: Sat, 11 Apr 2026 00:06:13 +0200 Subject: [PATCH 10/10] update pyTooling/Actions/with-post-step@v4.1.0 -> pyTooling/Actions/with-post-step@v7.7.0 --- .github/actions/setup-rust/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index d7bdd40e..45f087e6 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -46,7 +46,7 @@ runs: # Remove build artifacts for the current crate, since it will be rebuilt every # run anyway, but keep dependency artifacts to cache them. # Must be placed after actions/cache so its post step runs first. - - uses: pyTooling/Actions/with-post-step@679ec24c80c6736efa7099a11c19086263a6beba # v4.1.0 + - uses: pyTooling/Actions/with-post-step@41aed3e559cbf69bfdb46abb25d7c535900ed5b6 # v7.7.0 with: main: bash ./.github/actions/setup-rust/cleanup.sh post: bash ./.github/actions/setup-rust/cleanup.sh