Skip to content

Commit 9d129c3

Browse files
sthulbsthulb
authored
Merge branch 'develop' into feat/govcloud
2 parents 2e3506e + 96df2f7 commit 9d129c3

File tree

80 files changed

+849
-591
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+849
-591
lines changed

‎.github/workflows/codeql-analysis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout repository
31-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
31+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
3232

3333
# Initializes the CodeQL tools for scanning.
3434
- name: Initialize CodeQL

‎.github/workflows/dependency-review.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
20+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
2121
- name: 'Dependency Review'
2222
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

‎.github/workflows/label_pr_on_title.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
pull-requests: write # label respective PR
5151
steps:
5252
- name: Checkout repository
53-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
53+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5454
- name: "Label PR based on title"
5555
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5656
env:

‎.github/workflows/layer_rename.yml

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,29 @@ on:
1616
options:
1717
- beta
1818
- prod
19-
default: Gamma
19+
default: beta
2020
required: true
2121
version:
2222
description: Layer version to duplicate
23-
type: number
23+
type: string
2424
required: true
2525
workflow_call:
2626
inputs:
2727
environment:
2828
description: Deployment environment
2929
type: string
30-
default: Gamma
3130
required: true
3231
version:
3332
description: Layer version to duplicate
34-
type: number
33+
type: string
3534
required: true
3635

3736
name: Layer Rename
3837
run-name: Layer Rename - ${{ inputs.environment }}
3938

39+
permissions:
40+
contents: read
41+
4042
jobs:
4143
download:
4244
runs-on: ubuntu-latest
@@ -64,14 +66,14 @@ jobs:
6466
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-x86:${{ inputs.version }} --query 'Content.Location' | xargs curl -L -o ${{ matrix.layer }}_x86_64.zip
6567
aws --region us-east-1 lambda get-layer-version-by-arn --arn arn:aws:lambda:us-east-1:017000801446:layer:${{ matrix.layer }}-x86:${{ inputs.version }} > ${{ matrix.layer }}_x86_64.json
6668
- name: Store Zip
67-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
69+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
6870
with:
6971
name: ${{ matrix.layer }}_x86_64.zip
7072
path: ${{ matrix.layer }}_x86_64.zip
7173
retention-days: 1
7274
if-no-files-found: error
7375
- name: Store Metadata
74-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
76+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
7577
with:
7678
name: ${{ matrix.layer }}_x86_64.json
7779
path: ${{ matrix.layer }}_x86_64.json
@@ -136,7 +138,7 @@ jobs:
136138
- name: Verify Layer Signature
137139
run: |
138140
SHA=$(jq -r '.Content.CodeSha256' ${{ matrix.layer }}_x86_64.json)
139-
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_x86_64.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
141+
test $(openssl dgst -sha256 -binary ${{ matrix.layer }}_x86_64.zip | openssl enc -base64) == $SHA && echo "SHA OK: ${SHA}" || exit 1
140142
- name: Configure AWS Credentials
141143
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
142144
with:
@@ -158,4 +160,4 @@ jobs:
158160
--statement-id 'PublicLayer' \
159161
--action lambda:GetLayerVersion \
160162
--principal '*' \
161-
--version-number
163+
--version-number

‎.github/workflows/on_label_added.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
permissions:
4848
pull-requests: write # comment on PR
4949
steps:
50-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
50+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5151
# Maintenance: Persist state per PR as an artifact to avoid spam on label add
5252
- name: "Suggest split large Pull Request"
5353
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

‎.github/workflows/on_merged_pr.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ jobs:
4949
issues: write # label issue with pending-release
5050
if: needs.get_pr_details.outputs.prIsMerged == 'true'
5151
steps:
52-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
52+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5353
- name: "Label PR related issue for release"
5454
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5555
env:

‎.github/workflows/on_opened_pr.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
needs: get_pr_details
4848
runs-on: ubuntu-latest
4949
steps:
50-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
50+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
5151
- name: "Ensure related issue is present"
5252
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
5353
env:
@@ -66,7 +66,7 @@ jobs:
6666
permissions:
6767
pull-requests: write # label and comment on PR if missing acknowledge section (requirement)
6868
steps:
69-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
69+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
7070
- name: "Ensure acknowledgement section is present"
7171
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
7272
env:

‎.github/workflows/ossf_scorecard.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222

2323
steps:
2424
- name: "Checkout code"
25-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
25+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
2626
with:
2727
persist-credentials: false
2828

@@ -35,7 +35,7 @@ jobs:
3535
repo_token: ${{ secrets.SCORECARD_TOKEN }} # read-only fine-grained token to read branch protection settings
3636

3737
- name: "Upload results"
38-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
38+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
3939
with:
4040
name: SARIF file
4141
path: results.sarif

‎.github/workflows/pre-release.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
pipx install git+https://github.com/python-poetry/poetry@68b88e5390720a3dd84f02940ec5200bfce39ac6 # v1.5.0
6767
pipx inject poetry git+https://github.com/monim67/poetry-bumpversion@315fe3324a699fa12ec20e202eb7375d4327d1c4 # v0.3.1
6868
69-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
69+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
7070
with:
7171
ref: ${{ env.RELEASE_COMMIT }}
7272

@@ -110,7 +110,7 @@ jobs:
110110
contents: read
111111
steps:
112112
# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)
113-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
113+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
114114
with:
115115
ref: ${{ env.RELEASE_COMMIT }}
116116

@@ -151,7 +151,7 @@ jobs:
151151
attestation_hashes: ${{ steps.encoded_hash.outputs.attestation_hashes }}
152152
steps:
153153
# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)
154-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
154+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
155155
with:
156156
ref: ${{ env.RELEASE_COMMIT }}
157157

@@ -220,7 +220,7 @@ jobs:
220220
RELEASE_VERSION: ${{ needs.seal.outputs.RELEASE_VERSION }}
221221
steps:
222222
# NOTE: we need actions/checkout in order to use our local actions (e.g., ./.github/actions)
223-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
223+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
224224
with:
225225
ref: ${{ env.RELEASE_COMMIT }}
226226

@@ -232,7 +232,7 @@ jobs:
232232

233233
- name: Upload to PyPi prod
234234
if: ${{ !inputs.skip_pypi }}
235-
uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b # v1.10.2
235+
uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3
236236

237237
# Creates a PR with the latest version we've just released
238238
# since our trunk is protected against any direct pushes from automation
@@ -244,7 +244,7 @@ jobs:
244244
runs-on: ubuntu-latest
245245
steps:
246246
# NOTE: we need actions/checkout to authenticate and configure git first
247-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
247+
- uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
248248
with:
249249
ref: ${{ env.RELEASE_COMMIT }}
250250

‎.github/workflows/publish_v2_layer.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ jobs:
8888
working-directory: ./layer
8989
steps:
9090
- name: checkout
91-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
91+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
9292
with:
9393
ref: ${{ env.RELEASE_COMMIT }}
9494

@@ -124,7 +124,7 @@ jobs:
124124

125125
- name: Set up Docker Buildx
126126
id: builder
127-
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
127+
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
128128
with:
129129
install: true
130130
driver: docker
@@ -146,7 +146,7 @@ jobs:
146146
- name: zip output
147147
run: zip -r cdk.out.zip cdk.out
148148
- name: Archive CDK artifacts
149-
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
149+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
150150
with:
151151
name: cdk-layer-artefact
152152
path: layer/cdk.out.zip
@@ -247,7 +247,7 @@ jobs:
247247
pages: none
248248
steps:
249249
- name: Checkout repository # reusable workflows start clean, so we need to checkout again
250-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
250+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
251251
with:
252252
ref: ${{ env.RELEASE_COMMIT }}
253253

0 commit comments

Comments
 (0)