From da45e3ca6b192c39e2b5ff499fbe8cf7929282aa Mon Sep 17 00:00:00 2001 From: Kevin Adams Date: Wed, 14 Oct 2026 23:42:03 -0400 Subject: [PATCH] ci: move actions to Node 24 and pin trivy-action (#306) checkout/upload-artifact/download-artifact v4 run on Node 20, which GitHub is retiring; they were already being force-run on Node 24. trivy-action was tracking @master, so any push to that repo ran unreviewed in our tag builds next to the publish credentials. It is now pinned to the v0.36.0 commit. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 89575b4..5374eec 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -28,7 +28,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.3.1 + - uses: actions/checkout@v7.0.1 - name: Install lint tools run: | @@ -100,7 +100,7 @@ jobs: is_release: ${{ steps.vars.outputs.is_release }} steps: - - uses: actions/checkout@v4.3.1 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 @@ -281,7 +281,7 @@ jobs: || { echo "::error::multipath must depend on truenas-proxmox (= ${VERSION})"; exit 1; } - name: Upload package artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: packages-${{ steps.vars.outputs.version }} path: | @@ -297,10 +297,10 @@ jobs: needs: build steps: - - uses: actions/checkout@v4.3.1 + - uses: actions/checkout@v7.0.1 - name: Run Trivy (repo scan — secrets + misconfig) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: fs scan-ref: . @@ -310,7 +310,7 @@ jobs: format: table - name: Download built packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packages-${{ needs.build.outputs.version }} @@ -320,7 +320,7 @@ jobs: dpkg-deb --extract "${{ needs.build.outputs.deb_file }}" deb-contents/ - name: Run Trivy (package contents — vuln + secret) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: fs scan-ref: deb-contents @@ -340,10 +340,10 @@ jobs: contents: write steps: - - uses: actions/checkout@v4.3.1 + - uses: actions/checkout@v7.0.1 - name: Download built packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packages-${{ needs.build.outputs.version }}