Merge remote-tracking branch 'origin/main' into integration-tests

Author: ytausch

.github/workflows/bot-cache.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       - name: run cache
         if: success() && ! env.CI_SKIP
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: cf-graph.tar.zstd
           key: cf-graph-tzstd-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.version }}

.github/workflows/keepalive.yml

@@ -48,7 +48,7 @@ jobs:
           echo "NEXT=${NEXT}" >> "$GITHUB_OUTPUT"
 
       - name: log into ghcr.io
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         if: ${{ ! env.CI_SKIP }}
         with:
           registry: ${{ env.REGISTRY }}
@@ -68,7 +68,7 @@ jobs:
             type=raw,value=latest
 
       - name: build and push image
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
         if: ${{ ! env.CI_SKIP }}
         with:
           context: .

.github/workflows/release.yml

@@ -55,7 +55,7 @@ jobs:
 
       - name: download lockfile if it is an artifact
         if: ${{ inputs.lockfile-is-artifact }}
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ inputs.lockfile }}
           path: input-lockfile
@@ -110,7 +110,7 @@ jobs:
         if: ${{ ! env.CI_SKIP }}
 
       - name: build docker image
-        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
         if: ${{ ! env.CI_SKIP }}
         with:
           context: .
@@ -119,7 +119,7 @@ jobs:
           tags: ${{ env.IMAGE_NAME }}:test
 
       - name: restore test durations
-        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         if: ${{ ! env.CI_SKIP }}
         with:
           path: .test_durations
@@ -157,15 +157,15 @@ jobs:
           BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
 
       - name: upload test durations
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ ! env.CI_SKIP }}
         with:
           name: test-durations-${{ matrix.group }}
           path: .test_durations.${{ matrix.group }}
           include-hidden-files: true
 
       - name: upload coverage
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ ! env.CI_SKIP }}
         with:
           name: coverage-${{ matrix.group }}
@@ -201,7 +201,7 @@ jobs:
 
       - name: download lockfile if it is an artifact
         if: ${{ inputs.lockfile-is-artifact }}
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ inputs.lockfile }}
           path: input-lockfile
@@ -265,7 +265,7 @@ jobs:
           MONGODB_CONNECTION_STRING: "mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000"
 
       - name: restore test durations
-        uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf  # v4.2.2
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         if: ${{ ! env.CI_SKIP }}
         with:
           path: .test_durations
@@ -305,15 +305,15 @@ jobs:
           BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
 
       - name: upload test durations
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ ! env.CI_SKIP }}
         with:
           name: test-durations-mongodb
           path: .test_durations.mongodb
           include-hidden-files: true
 
       - name: upload coverage
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ ! env.CI_SKIP }}
         with:
           name: coverage-mongodb
@@ -342,7 +342,7 @@ jobs:
 
       - name: download lockfile if it is an artifact
         if: ${{ inputs.lockfile-is-artifact }}
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ inputs.lockfile }}
           path: input-lockfile
@@ -363,7 +363,7 @@ jobs:
           python autotick-bot/stop_me_if_needed.py
 
       - name: download coverage artifacts
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         if: ${{ ! env.CI_SKIP }}
         with:
           pattern: coverage-*
@@ -375,13 +375,13 @@ jobs:
           coverage xml
 
       - name: upload codecov
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.1.8
+        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.1.8
         if: ${{ ! env.CI_SKIP }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: cache test durations
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         if: ${{ ! env.CI_SKIP }}
         with:
           path: .test_durations
@@ -391,7 +391,7 @@ jobs:
             test-durations-
 
       - name: download test duration artifacts
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         if: ${{ ! env.CI_SKIP }}
         with:
           pattern: test-durations-*
@@ -403,9 +403,24 @@ jobs:
           jq 'reduce inputs as $i (.; . + $i)' test-durations-*/.test_durations.* > .test_durations
 
       - name: upload test durations
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ ! env.CI_SKIP }}
         with:
           name: test-durations
           path: .test_durations
           include-hidden-files: true
+
+  # this little bit follows the same pattern from conda-build
+  status:
+    needs:
+      - tests
+      - tests-mongodb
+      - test-coverage-and-durations
+    if: '!cancelled()'
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: determine success
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        with:
+          jobs: ${{ toJSON(needs) }}

.github/workflows/tests-reusable.yml

@@ -24,7 +24,7 @@ repos:
           - --py36-plus
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.30.0
+    rev: v1
     hooks:
       - id: typos
         exclude: |
@@ -34,7 +34,7 @@ repos:
           )$
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.9
+    rev: v0.11.5
     hooks:
       - id: ruff
         args: [ --fix ]