From 12d9db7ec610eea8a70a19767c7a60ba68cd78db Mon Sep 17 00:00:00 2001 From: Jonah Aragon Date: Wed, 22 Jul 2026 15:04:46 -0500 Subject: [PATCH] Update dependencies --- .github/dependabot.yml | 37 ++++++++++++++++++++++++++++++++ .github/workflows/build-pr.yml | 6 +++--- .github/workflows/build.yml | 6 +++--- .github/workflows/publish-pr.yml | 12 +++++------ .gitignore | 1 + 5 files changed, 50 insertions(+), 12 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..add02c17 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,37 @@ +version: 2 +updates: + # Go modules (go.mod / go.sum) — Hugo module dependencies + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + groups: + # Keep the Hextra theme module and any imfing-published companions together + imfing: + patterns: + - "github.com/imfing/*" + + # Dev Container image and features (.devcontainer/devcontainer.json) + - package-ecosystem: "devcontainers" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + groups: + # Coordinate the devcontainers org's base features as one PR + devcontainers-features: + patterns: + - "ghcr.io/devcontainers/*" + + # GitHub Actions used across .github/workflows/* + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + groups: + # Roll all action bumps into a single PR to cut noise + actions: + patterns: + - "*" diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 76e3e748..6bb2120c 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -42,7 +42,7 @@ jobs: echo "true" > ./metadata/PRIVILEGED - name: Upload metadata as artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: metadata path: metadata @@ -62,7 +62,7 @@ jobs: needs: build_english runs-on: ubuntu-latest steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: site-build.tar.gz merge-multiple: true @@ -72,7 +72,7 @@ jobs: ls -la public/ - name: Upload Site - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: site-build-combined path: public diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 816654c8..b1a7d537 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Download Repository - uses: actions/checkout@v4 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: ${{ inputs.repo }} ref: ${{ inputs.ref }} @@ -34,7 +34,7 @@ jobs: submodules: recursive - name: Setup Hugo - uses: peaceiris/actions-hugo@v3 + uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3.2.1 with: hugo-version: 'latest' @@ -47,7 +47,7 @@ jobs: tar -czf site-build.tar.gz public - name: Upload Site - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: site-build.tar.gz path: site-build.tar.gz diff --git a/.github/workflows/publish-pr.yml b/.github/workflows/publish-pr.yml index 3adebc8b..64a03ba0 100644 --- a/.github/workflows/publish-pr.yml +++ b/.github/workflows/publish-pr.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Download Website Build Artifact - uses: actions/github-script@v7.0.1 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | var artifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -53,14 +53,14 @@ jobs: tar -czvf site-build-combined.tar.gz site - name: Upload Combined Build Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: site-build-combined.tar.gz path: site-build-combined.tar.gz retention-days: 5 - name: Download Metadata Artifact - uses: actions/github-script@v7.0.1 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | var artifacts = await github.rest.actions.listWorkflowRunArtifacts({ @@ -97,7 +97,7 @@ jobs: outputs: address: ${{ steps.deployment.outputs.address }} steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: site-build-combined.tar.gz merge-multiple: true @@ -109,7 +109,7 @@ jobs: - name: Limit length of site alias to 12 run: echo "SHORT_ALIAS=$(echo "${{ needs.metadata.outputs.pr_number }}" | cut -c1-12)" >> "$GITHUB_ENV" - - uses: hkdobrev/minio-deploy-action@v1 + - uses: hkdobrev/minio-deploy-action@98438a5d45068824d87fc8938095ae86dabc05bd # v1.1.0 with: endpoint: https://${{ vars.PREVIEW_GARAGE_HOSTNAME }} bucket: ${{ vars.PREVIEW_GARAGE_BUCKET }} @@ -130,7 +130,7 @@ jobs: env: address: ${{ needs.deploy_garage.outputs.address }} steps: - - uses: thollander/actions-comment-pull-request@v2.5.0 + - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: pr_number: ${{ needs.metadata.outputs.pr_number }} message: | diff --git a/.gitignore b/.gitignore index 8c1a39c6..3de58b31 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ public/ resources/ .hugo_build.lock /scripts +.cache