Bump the github-actions group with 4 updates (#3894)

Bumps the github-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [ossf/scorecard-action](https://github.com/ossf/scorecard-action), [github/codeql-action](https://github.com/github/codeql-action) and [actions/setup-python](https://github.com/actions/setup-python). Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
HDFGroup · Dec 13, 2023 · 184445f · 184445f
1 parent 2f23f2a
commit 184445f
Show file tree

Hide file tree

Showing 24 changed files with 46 additions and 46 deletions.
diff --git a/.github/workflows/clang-format-check.yml b/.github/workflows/clang-format-check.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, 'skip-ci')"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.1.1
     - name: Run clang-format style check for C and Java code
       uses: DoozyX/[email protected]
       with:

diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
@@ -10,7 +10,7 @@ jobs:
     name: Check for spelling errors
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - uses: codespell-project/actions-codespell@master
         with:
           skip: ./.github/workflows/codespell.yml,./bin/trace,./hl/tools/h5watch/h5watch.c,./tools/test/h5jam/tellub.c,./config/sanitizer/LICENSE,./config/sanitizer/sanitizers.cmake,./tools/test/h5repack/testfiles/*.dat,./test/API/driver,./configure,./bin/ltmain.sh,./bin/depcomp,./bin/config.guess,./bin/config.sub,./autom4te.cache,./m4/libtool.m4,./c++/src/*.html,./HDF5Examples/depcomp

diff --git a/.github/workflows/cve.yml b/.github/workflows/cve.yml
@@ -27,7 +27,7 @@ jobs:
     name: CVE regression
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Autotools Dependencies (Linux)
         run: |
@@ -40,7 +40,7 @@ jobs:
           make
           sudo make install
       - name: Checkout CVE test repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/cve_hdf5
           path: cve_hdf5

diff --git a/.github/workflows/h5py.yml b/.github/workflows/h5py.yml
@@ -17,7 +17,7 @@ jobs:
         compiler: gcc
         version: 13
     - name: Checkout Spack
-      uses: actions/checkout@v4
+      uses: actions/checkout@v4.1.1
       with:
         repository: spack/spack
         path: ./spack

diff --git a/.github/workflows/hdfeos5.yml b/.github/workflows/hdfeos5.yml
@@ -27,7 +27,7 @@ jobs:
     name: Build hdfeos5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Autotools Dependencies (Linux)
         run: |

diff --git a/.github/workflows/intel-auto.yml b/.github/workflows/intel-auto.yml
@@ -16,7 +16,7 @@ jobs:
     name: "Intel ${{ inputs.build_mode }}"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Dependencies
         run: |

diff --git a/.github/workflows/intel-cmake.yml b/.github/workflows/intel-cmake.yml
@@ -19,7 +19,7 @@ jobs:
     name: "ubuntu-oneapi ${{ inputs.build_mode }}"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       # Only CMake need ninja-build, but we just install it unilaterally
       # libssl, etc. are needed for the ros3 VFD
@@ -77,7 +77,7 @@ jobs:
     name: "windows-oneapi ${{ inputs.build_mode }}"
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Dependencies (Windows)
         run: choco install ninja

diff --git a/.github/workflows/linux-auto-aocc-ompi.yml b/.github/workflows/linux-auto-aocc-ompi.yml
@@ -26,7 +26,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install System dependencies
         run: |

diff --git a/.github/workflows/main-auto-par.yml b/.github/workflows/main-auto-par.yml
@@ -40,7 +40,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -98,7 +98,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure

diff --git a/.github/workflows/main-auto-spc.yml b/.github/workflows/main-auto-spc.yml
@@ -43,7 +43,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -104,7 +104,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -165,7 +165,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -226,7 +226,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -287,7 +287,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -348,7 +348,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -409,7 +409,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -470,7 +470,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure

diff --git a/.github/workflows/main-auto.yml b/.github/workflows/main-auto.yml
@@ -49,7 +49,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure
@@ -153,7 +153,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # AUTOTOOLS CONFIGURE
       - name: Autotools Configure

diff --git a/.github/workflows/main-cmake.yml b/.github/workflows/main-cmake.yml
@@ -163,7 +163,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       #
       # CMAKE CONFIGURE
@@ -281,7 +281,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
 
       # CMAKE CONFIGURE
       - name: CMake Configure

diff --git a/.github/workflows/netcdf.yml b/.github/workflows/netcdf.yml
@@ -31,15 +31,15 @@ jobs:
         sudo apt update
         sudo apt install -y libaec-dev zlib1g-dev automake autoconf libcurl4-openssl-dev libjpeg-dev wget curl bzip2 m4 flex bison cmake libzip-dev doxygen openssl libtool libtool-bin
     - name: Checkout HDF5
-      uses: actions/checkout@v4
+      uses: actions/checkout@v4.1.1
     - name: Install HDF5
       run: |
         ./autogen.sh
         ./configure --prefix=/usr/local --disable-tests --disable-static --enable-shared --enable-hl --with-szlib
         make -j
         sudo make install -j
     - name: Checkout netCDF
-      uses: actions/checkout@v4
+      uses: actions/checkout@v4.1.1
       with:
         repository: unidata/netcdf-c
         path: netcdf-c

diff --git a/.github/workflows/nvhpc-auto.yml b/.github/workflows/nvhpc-auto.yml
@@ -16,7 +16,7 @@ jobs:
     name: "nvhpc ${{ inputs.build_mode }}"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Dependencies
         run: |

diff --git a/.github/workflows/nvhpc-cmake.yml b/.github/workflows/nvhpc-cmake.yml
@@ -16,7 +16,7 @@ jobs:
     name: "nvhpc ${{ inputs.build_mode }}"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - name: Install Linux dependencies
         shell: bash

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
 
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           path: hdfsrc
 

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        uses: github/codeql-action/upload-sarif@305f6546310b9203e892c28c1484e82977f4f63d # v2.22.10
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/tarball.yml b/.github/workflows/tarball.yml
@@ -83,7 +83,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - name: Get Sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           path: hdfsrc
 

diff --git a/.github/workflows/vol_adios2.yml b/.github/workflows/vol_adios2.yml
@@ -26,7 +26,7 @@ jobs:
           sudo apt-get install automake autoconf libtool libtool-bin libopenmpi-dev
 
       - name: Checkout HDF5
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/hdf5
           path: hdf5
@@ -73,7 +73,7 @@ jobs:
 
       - if: ${{ steps.cache-adios2.outputs.cache-hit != 'true' }}
         name: Checkout ADIOS2 (${{ env.ADIOS2_COMMIT_SHORT }})
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: ornladios/ADIOS2
           ref: ${{ env.ADIOS2_COMMIT }}

diff --git a/.github/workflows/vol_async.yml b/.github/workflows/vol_async.yml
@@ -22,13 +22,13 @@ jobs:
           sudo apt-get install automake autoconf libtool libtool-bin libopenmpi-dev
 
       - name: Checkout HDF5
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/hdf5
           path: hdf5
 
       - name: Checkout Argobots
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: pmodels/argobots
           path: abt

diff --git a/.github/workflows/vol_cache.yml b/.github/workflows/vol_cache.yml
@@ -35,13 +35,13 @@ jobs:
           sudo apt-get install automake autoconf libtool libtool-bin libopenmpi-dev
 
       - name: Checkout HDF5
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/hdf5
           path: hdf5
 
       - name: Checkout Argobots
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: pmodels/argobots
           path: abt

diff --git a/.github/workflows/vol_ext_passthru.yml b/.github/workflows/vol_ext_passthru.yml
@@ -22,13 +22,13 @@ jobs:
           sudo apt-get install automake autoconf libtool libtool-bin libopenmpi-dev
 
       - name: Checkout HDF5
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/hdf5
           path: hdf5
 
       - name: Checkout vol-external-passthrough
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: hpc-io/vol-external-passthrough
           path: vol-external-passthrough

diff --git a/.github/workflows/vol_log.yml b/.github/workflows/vol_log.yml
@@ -23,7 +23,7 @@ jobs:
           #mpich
 
       - name: Checkout HDF5
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: HDFGroup/hdf5
           path: hdf5
@@ -56,7 +56,7 @@ jobs:
           echo "PATH=${{ runner.workspace }}/hdf5_build/bin:${PATH}" >> $GITHUB_ENV
 
       - name: Checkout Log-based VOL
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: DataLib-ECP/vol-log-based
           path: vol-log-based