99 outputs :
1010 hash : ${{ steps.hash.outputs.hash }}
1111 steps :
12- - uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13- - uses : actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
12+ - uses : actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
13+ - uses : actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
1414 with :
1515 python-version : ' 3.x'
1616 cache : pip
2323 - name : generate hash
2424 id : hash
2525 run : cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
26- - uses : actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
26+ - uses : actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
2727 with :
2828 path : ./dist
2929 provenance :
3333 id-token : write
3434 contents : write
3535 # Can't pin with hash due to how this workflow works.
36- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10 .0
36+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0 .0
3737 with :
3838 base64-subjects : ${{ needs.build.outputs.hash }}
3939 create-release :
4444 permissions :
4545 contents : write
4646 steps :
47- - uses : actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
47+ - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
4848 - name : create release
4949 run : >
5050 gh release create --draft --repo ${{ github.repository }}
@@ -63,11 +63,11 @@ jobs:
6363 permissions :
6464 id-token : write
6565 steps :
66- - uses : actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
67- - uses : pypa/gh-action-pypi-publish@68e62d4871ad9d14a9d55f114e6ac71f0b408ec0 # v1.8.14
66+ - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
67+ - uses : pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
6868 with :
6969 repository-url : https://test.pypi.org/legacy/
7070 packages-dir : artifact/
71- - uses : pypa/gh-action-pypi-publish@68e62d4871ad9d14a9d55f114e6ac71f0b408ec0 # v1.8.14
71+ - uses : pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
7272 with :
7373 packages-dir : artifact/
0 commit comments