Merge pull request #2282 from renovate-bot/renovate/major-github-actions

Update Github Actions (major)

Author: marcoieni

.github/actions/generate-tokens/action.yml

@@ -38,55 +38,55 @@ runs:
     # GitHub tokens generated from GitHub Apps can access resources from one organization,
     # so we need to generate a token for each organization.
     - name: Generate GitHub token (rust-lang)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-lang-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: rust-lang
 
     - name: Generate GitHub token (rust-lang-deprecated)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-lang-deprecated-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: rust-lang-deprecated
 
     - name: Generate GitHub token (rust-lang-nursery)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-lang-nursery-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: rust-lang-nursery
 
     - name: Generate GitHub token (bors-rs)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: bors-rs-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: bors-rs
 
     - name: Generate GitHub token (rust-analyzer)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-analyzer-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: rust-analyzer
 
     - name: Generate GitHub token (rust-embedded)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-embedded-token
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
         owner: rust-embedded
 
     - name: Generate GitHub token (rust-dev-tools)
-      uses: actions/create-github-app-token@v1
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
       id: rust-dev-tools-token
       with:
         app-id: ${{ inputs.app-id }}

.github/workflows/dry-run.yml

@@ -29,7 +29,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # If the PR is from this repository, checkout the PR sha,
           # so that we can also test code changes.
@@ -42,7 +42,7 @@ jobs:
         uses: ./.github/actions/setup-rust
 
       - name: Download built JSON API
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
         with:
           name: team-api-output
           path: team-api

.github/workflows/main.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'rust-lang/team'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 50
 
@@ -72,7 +72,7 @@ jobs:
         run: echo "${{ github.event.pull_request.number }}" > build/pr.txt
 
       - name: Upload the built JSON as a GitHub artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: team-api-output
           path: build
@@ -86,12 +86,12 @@ jobs:
       pages: write
     if: github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
       - name: Download built JSON API and sync-team
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
         with:
           name: team-api-output
           path: build
@@ -112,7 +112,7 @@ jobs:
         run: touch build/.nojekyll
 
       - name: Upload GitHub pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: build