fix(github-action): update ivuorinen/actions (25.6.25 → 25.6.30) (#182)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/action-security.yml

@@ -58,7 +58,7 @@ jobs:
           fi
 
       - name: Run actionlint
-        uses: raven-actions/actionlint@01fce4f43a270a612932cb1c64d40505a029f821 # v2.0.0
+        uses: raven-actions/actionlint@3a24062651993d40fed1019b58ac6fbdfbf276cc # v2.0.1
         with:
           cache: true
           fail-on-error: true
@@ -66,7 +66,7 @@ jobs:
 
       - name: Run Gitleaks
         if: steps.check-configs.outputs.run_gitleaks == 'true'
-        uses: gitleaks/gitleaks-action@83373cf2f8c4db6e24b41c1a9b086bb9619e9cd3 # v2.3.7
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
@@ -117,21 +117,21 @@ jobs:
 
       - name: Upload Trivy results
         if: steps.verify-sarif.outputs.has_trivy == 'true'
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: 'trivy-results.sarif'
           category: 'trivy'
 
       - name: Upload Gitleaks results
         if: steps.verify-sarif.outputs.has_gitleaks == 'true'
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: 'gitleaks-report.sarif'
           category: 'gitleaks'
 
       - name: Archive security reports
         if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-reports-${{ github.run_id }}
           path: |

.github/workflows/codeql.yml

@@ -32,15 +32,15 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/autobuild@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/dependency-review.yml

@@ -13,4 +13,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

.github/workflows/new-release.yml

@@ -20,10 +20,10 @@ jobs:
       version: ${{ steps.daily-version.outputs.version }}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Create tag if necessary
-        uses: fregante/daily-version-action@fb1a60b7c4daf1410cd755e360ebec3901e58588 # v2
+        uses: fregante/daily-version-action@fb1a60b7c4daf1410cd755e360ebec3901e58588 # v2.1.3
         id: daily-version
 
       - name: Create changelog text
@@ -36,7 +36,7 @@ jobs:
 
       - name: Create release
         if: steps.daily-version.outputs.created
-        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1.16.0
+        uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1.18.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/pr-lint.yml

@@ -69,21 +69,7 @@ jobs:
 
       - name: MegaLinter
         id: ml
-        uses: oxsecurity/megalinter/flavors/cupcake@ec124f7998718d79379a3c5b39f5359952baf21d # v8.4.2
-        env:
-          PARALLEL: true # Run linters in parallel
-          FILTER_REGEX_EXCLUDE: '(\.automation/test|docs/json-schemas|\.github/workflows)'
-
-          # Error configuration
-          ERROR_ON_MISSING_EXEC_BIT: true
-          CLEAR_REPORT_FOLDER: true
-          PRINT_ALPACA: false
-          SHOW_ELAPSED_TIME: true
-
-          # File configuration
-          YAML_YAMLLINT_CONFIG_FILE: .yamllint.yml
-          YAML_PRETTIER_CONFIG_FILE: .prettierrc.yml
-          YAML_YAMLLINT_FILTER_REGEX_EXCLUDE: '(\.automation/test|docs/json-schemas|\.github/workflows)'
+        uses: oxsecurity/megalinter/flavors/cupcake@e08c2b05e3dbc40af4c23f41172ef1e068a7d651 # v8.8.0
 
       - name: Check MegaLinter Results
         id: check-results
@@ -103,7 +89,7 @@ jobs:
 
       - name: Upload Reports
         if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: MegaLinter reports
           path: |
@@ -113,7 +99,7 @@ jobs:
 
       - name: Upload SARIF Report
         if: always() && hashFiles('megalinter-reports/sarif/*.sarif')
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: megalinter-reports/sarif
           category: megalinter
@@ -168,7 +154,7 @@ jobs:
           github.ref != 'refs/heads/main' &&
           (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) &&
           !contains(github.event.head_commit.message, 'skip fix')
-        uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5.1.0
+        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
         with:
           branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
           commit_message: |

.github/workflows/release.yml

@@ -17,6 +17,6 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
+      - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
           generate_release_notes: true

.github/workflows/security-suite.yml

@@ -87,12 +87,12 @@ jobs:
             --enableExperimental
             --failOnCVSS 7
       - name: Upload OWASP Results
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: reports/dependency-check-report.sarif
           category: owasp-dependency-check
       - name: Upload artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: owasp-results
           path: reports/dependency-check-report.sarif
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 'lts/*'
           cache: 'npm'
@@ -119,12 +119,12 @@ jobs:
         with:
           args: --all-projects --sarif-file-output=snyk-results.sarif
       - name: Upload Snyk Results
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: snyk-results.sarif
           category: snyk
       - name: Upload artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: snyk-results
           path: snyk-results.sarif
@@ -140,18 +140,18 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Run Scorecard
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
           publish_results: true
       - name: Upload Scorecard Results
-        uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: scorecard-results.sarif
           category: scorecard
       - name: Upload artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: scorecard-results
           path: scorecard-results.sarif
@@ -168,7 +168,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Download scan results
-        uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: ./results
 
@@ -338,7 +338,7 @@ jobs:
 
       - name: Archive Results
         if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: security-results
           path: |

.mega-linter.yml

@@ -32,4 +32,4 @@ JAVASCRIPT_ES_CONFIG_FILE: .eslintrc.json
 TYPESCRIPT_ES_CONFIG_FILE: .eslintrc.json
 
 FILTER_REGEX_EXCLUDE: >
-  (node_modules|\.automation/test|docs/json-schemas|\.github/workflows)
+  (node_modules|\.automation/test|docs/json-schemas)

.pre-commit-config.yaml

@@ -29,12 +29,12 @@ repos:
         args: [-c, .markdownlint.json, --fix]
 
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.35.1
+    rev: v1.37.0
     hooks:
       - id: yamllint
 
   - repo: https://github.com/scop/pre-commit-shfmt
-    rev: v3.10.0-2
+    rev: v3.11.0-1
     hooks:
       - id: shfmt
 
@@ -51,12 +51,12 @@ repos:
         args: ['-shellcheck=']
 
   - repo: https://github.com/renovatebot/pre-commit-hooks
-    rev: 39.156.0
+    rev: 39.227.2
     hooks:
       - id: renovate-config-validator
 
   - repo: https://github.com/bridgecrewio/checkov.git
-    rev: '3.2.360'
+    rev: '3.2.400'
     hooks:
       - id: checkov
         args:

README.md

@@ -2,14 +2,20 @@
 
 ## Overview
 
-This project contains a collection of workflows and composable actions to streamline CI/CD
-processes and ensure code quality. Below is a categorized list of all workflows, grouped by their types.
+This project contains a collection of workflows and composable actions to streamline CI/CD processes and ensure code quality. The actions are grouped by purpose for easier discovery.
 
-## Testing Workflows
+## Setup & Caching
 
-- [PHP Tests][php-tests]: Runs PHPUnit tests to ensure PHP code correctness.
+- [Node Setup][node-setup]: Sets up Node.js with caching and tooling.
+- [PHP Composer][php-composer]: Installs PHP dependencies using Composer.
+- [Dotnet Version Detect][dotnet-v-detect]: Detects the required .NET version from `global.json`.
+- [Go Version Detect][go-version-detect]: Detects the required Go version from configuration files.
+- [Common Cache][common-cache]: Provides a consistent caching strategy for multiple languages.
+- [Set Git Config][set-git-config]: Configures Git user information for automated commits.
 
-## Linting and Formatting Workflows
+## Linting & Formatting
+
+### Code Linting
 
 - [Ansible Lint and Fix][ansible-lint-fix]: Lints and fixes Ansible playbooks and roles.
 - [Biome Check][biome-check]: Runs Biome to lint multiple languages and formats.
@@ -18,40 +24,46 @@ processes and ensure code quality. Below is a categorized list of all workflows,
 - [ESLint Check][eslint-check]: Runs ESLint to check for code style violations.
 - [ESLint Fix][eslint-fix]: Automatically fixes code style issues with ESLint.
 - [Go Lint Check][go-lint]: Lints Go code using `golangci-lint`.
+- [PR Lint][pr-lint]: Runs MegaLinter against pull requests.
+- [Python Lint and Fix][python-lint-fix]: Lints and fixes Python code using `flake8` and `black`.
+- [Terraform Lint and Fix][terraform-lint-fix]: Lints and fixes Terraform configurations.
+
+### Code Formatting
+
 - [Prettier Check][prettier-check]: Checks code formatting using Prettier.
 - [Prettier Fix][prettier-fix]: Automatically fixes code formatting with Prettier.
-- [Python Lint and Fix][python-lint-fix]: Lints and fixes Python code using `flake8` and `black`.
-- [Terraform Lint and Fix][terraform-lint-fix]: Lints and fixes Terraform
-  configurations.
+- [Pre-Commit][pre-commit]: Runs `pre-commit` hooks to enforce code quality standards.
 
-## Build Workflows
+## Testing
+
+- [PHP Tests][php-tests]: Runs PHPUnit tests to ensure PHP code correctness.
+- [Laravel PHPUnit][php-laravel-phpunit]: Sets up Laravel and runs Composer tests.
+
+## Build & Package
 
 - [C# Build][csharp-build]: Builds C# projects using the .NET SDK.
-- [Docker Build][docker-build]: Builds Docker images using a Dockerfile.
 - [Go Build][go-build]: Builds Go projects using the `go build` command.
+- [Docker Build][docker-build]: Builds Docker images using a Dockerfile.
 
-## Deployment Workflows
+## Publish & Deployment
 
 - [C# Publish][csharp-publish]: Publishes .NET projects to an output directory.
+- [Docker Publish][docker-publish]: Publishes Docker images to GitHub Packages and Docker Hub.
 - [Docker Publish to Docker Hub][docker-publish-hub]: Publishes Docker images to Docker Hub.
 - [Docker Publish to GitHub Packages][docker-publish-gh]: Publishes Docker images to GitHub's Container Registry.
 - [Publish to NPM][npm-publish]: Publishes packages to the NPM registry.
 
-## Release Workflows
+## Release Management
 
 - [GitHub Release][github-release]: Automates GitHub release creation with custom tags and notes.
 - [Release Monthly][release-monthly]: Creates a monthly GitHub release with autogenerated notes.
 
-## Utility Workflows
+## Repository Maintenance
 
 - [Common File Check][common-file-check]: Checks for the presence of specific files based on a glob pattern.
 - [Compress Images][compress-images]: Optimizes and creates a pull request with compressed images.
-- [Dotnet Version Detect][dotnet-v-detect]: Detects the required .NET version from `global.json`.
-- [Go Version Detect][go-version-detect]: Detects the required Go version from configuration files.
-- [Node Setup][node-setup]: Sets up a Node.js environment for workflows.
-- [PHP Composer][php-composer]: Installs PHP dependencies using Composer.
-- [Pre-Commit][pre-commit]: Runs `pre-commit` hooks to enforce code quality standards.
-- [Set Git Config][set-git-config]: Configures Git user information for automated commits.
+- [Stale][stale]: Closes stale issues and pull requests automatically.
+- [Sync Labels][sync-labels]: Syncs repository labels from a YAML file.
 
 ## License
 
@@ -60,12 +72,14 @@ This project is licensed under the MIT License. See the [LICENSE](LICENSE.md) fi
 [ansible-lint-fix]: ansible-lint-fix/README.md
 [biome-check]: biome-check/README.md
 [biome-fix]: biome-fix/README.md
+[common-cache]: common-cache/README.md
 [common-file-check]: common-file-check/README.md
 [compress-images]: compress-images/README.md
 [csharp-build]: csharp-build/README.md
 [csharp-lint-check]: csharp-lint-check/README.md
 [csharp-publish]: csharp-publish/README.md
 [docker-build]: docker-build/README.md
+[docker-publish]: docker-publish/README.md
 [docker-publish-gh]: docker-publish-gh/README.md
 [docker-publish-hub]: docker-publish-hub/README.md
 [dotnet-v-detect]: dotnet-version-detect/README.md
@@ -78,11 +92,15 @@ This project is licensed under the MIT License. See the [LICENSE](LICENSE.md) fi
 [node-setup]: node-setup/README.md
 [npm-publish]: npm-publish/README.md
 [php-composer]: php-composer/README.md
+[php-laravel-phpunit]: php-laravel-phpunit/README.md
 [php-tests]: php-tests/README.md
+[pr-lint]: pr-lint/README.md
 [pre-commit]: pre-commit/README.md
 [prettier-check]: prettier-check/README.md
 [prettier-fix]: prettier-fix/README.md
 [python-lint-fix]: python-lint-fix/README.md
 [release-monthly]: release-monthly/README.md
 [set-git-config]: set-git-config/README.md
+[stale]: stale/README.md
+[sync-labels]: sync-labels/README.md
 [terraform-lint-fix]: terraform-lint-fix/README.md

ansible-lint-fix/action.yml

@@ -47,6 +47,6 @@ runs:
         fi
 
     - name: Upload SARIF Report
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ansible-lint.sarif

biome-check/action.yml

@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set Git Config
       uses: ivuorinen/actions/set-git-config@main
@@ -31,6 +31,6 @@ runs:
         biome check . --json > biome-report.json
 
     - name: Upload Biome Results
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: biome-report.json

biome-fix/action.yml

@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set Git Config
       uses: ivuorinen/actions/set-git-config@main
@@ -32,7 +32,7 @@ runs:
 
     - name: Push Fixes
       if: success()
-      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       with:
         commit_message: 'style: autofix Biome violations'
         add_options: '-u'

common-cache/action.yml

@@ -95,7 +95,7 @@ runs:
         echo "cache-paths=${cache_paths}" >> $GITHUB_OUTPUT
 
     - id: cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ steps.prepare.outputs.cache-paths }}
         key: ${{ steps.prepare.outputs.cache-key }}

compress-images/action.yml

@@ -18,7 +18,7 @@ runs:
       uses: ivuorinen/actions/set-git-config@main
 
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Compress Images
       id: calibre
@@ -29,7 +29,7 @@ runs:
 
     - name: Create New Pull Request If Needed
       if: steps.calibre.outputs.markdown != ''
-      uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7
+      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
       with:
         title: Compressed Images Nightly
         branch-suffix: timestamp

csharp-build/action.yml

@@ -22,7 +22,7 @@ runs:
         default-version: '7.0'
 
     - name: Setup .NET SDK
-      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: '${{ steps.detect-dotnet-version.outputs.dotnet-version }}'
 
@@ -40,7 +40,7 @@ runs:
         dotnet test --configuration Release --no-build --collect:"XPlat Code Coverage" --logger "trx;LogFileName=test-results.trx"
 
     - name: Upload Test Results
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: test-results
         path: |

csharp-lint-check/action.yml

@@ -22,7 +22,7 @@ runs:
         default-version: '7.0'
 
     - name: Setup .NET SDK
-      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: '${{ steps.detect-dotnet-version.outputs.dotnet-version }}'
 
@@ -40,6 +40,6 @@ runs:
         fi
 
     - name: Upload SARIF Report
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: dotnet-format.sarif

csharp-publish/action.yml

@@ -26,7 +26,7 @@ runs:
         default-version: '7.0'
 
     - name: Setup .NET SDK
-      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: '${{ steps.detect-dotnet-version.outputs.dotnet-version }}'
 

docker-build/action.yml

@@ -92,13 +92,13 @@ runs:
         fi
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       with:
         platforms: ${{ inputs.architectures }}
 
     - name: Set up Docker Buildx
       id: buildx
-      uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       with:
         version: latest
         platforms: ${{ inputs.architectures }}

docker-publish-gh/action.yml

@@ -97,12 +97,12 @@ runs:
         done
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       with:
         platforms: ${{ inputs.platforms }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       with:
         platforms: ${{ inputs.platforms }}
 
@@ -133,7 +133,7 @@ runs:
         echo "tags=${processed_tags}" >> $GITHUB_OUTPUT
 
     - name: Log in to GitHub Container Registry
-      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
       with:
         registry: ${{ inputs.registry }}
         username: ${{ github.actor }}
@@ -141,7 +141,7 @@ runs:
 
     - name: Set up Cosign
       if: inputs.provenance == 'true'
-      uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3
+      uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
 
     - name: Publish Image
       id: publish

docker-publish-hub/action.yml

@@ -105,12 +105,12 @@ runs:
         fi
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
+      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
       with:
         platforms: ${{ inputs.platforms }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       with:
         platforms: ${{ inputs.platforms }}
 
@@ -144,14 +144,14 @@ runs:
         echo "repo-url=https://hub.docker.com/r/${full_name}" >> $GITHUB_OUTPUT
 
     - name: Log in to Docker Hub
-      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
       with:
         username: ${{ inputs.username }}
         password: ${{ inputs.password }}
 
     - name: Set up Cosign
       if: inputs.provenance == 'true'
-      uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3
+      uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
 
     - name: Update Docker Hub Description
       if: inputs.repository-description != '' || inputs.readme-file != ''

eslint-check/action.yml

@@ -239,7 +239,7 @@ runs:
 
     - name: Upload ESLint Results
       if: always() && inputs.report-format == 'sarif'
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/eslint.sarif
         category: eslint

eslint-fix/action.yml

@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set Git Config
       uses: ivuorinen/actions/set-git-config@main
@@ -32,7 +32,7 @@ runs:
 
     - name: Push Fixes
       if: always()
-      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       with:
         commit_message: 'style: autofix ESLint violations'
         add_options: '-u'

go-build/action.yml

@@ -24,7 +24,7 @@ runs:
       uses: ivuorinen/actions/go-version-detect@main
 
     - name: Setup Go
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: '${{ steps.detect-go-version.outputs.go-version }}'
 

go-lint/action.yml

@@ -106,7 +106,7 @@ runs:
         done
 
     - name: Setup Go
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: ${{ inputs.go-version }}
         cache: true
@@ -114,7 +114,7 @@ runs:
     - name: Set up Cache
       id: cache
       if: inputs.cache == 'true'
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: |
           ~/.cache/golangci-lint
@@ -266,7 +266,7 @@ runs:
 
     - name: Upload Lint Results
       if: always() && inputs.report-format == 'sarif'
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/golangci-lint.sarif
         category: golangci-lint

node-setup/action.yml

@@ -161,7 +161,7 @@ runs:
 
     - name: Setup Node.js
       id: setup
-      uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ steps.version.outputs.version }}
         registry-url: ${{ inputs.registry-url }}
@@ -216,7 +216,7 @@ runs:
     - name: Setup Caching
       if: inputs.cache == 'true'
       id: deps-cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: |
           **/node_modules

php-composer/action.yml

@@ -172,7 +172,7 @@ runs:
 
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: |
           vendor

php-laravel-phpunit/action.yml

@@ -50,11 +50,11 @@ runs:
         extensions: ${{ inputs.extensions }}
         coverage: ${{ inputs.coverage }}
 
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: 'Check file existence'
       id: check_files
-      uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3
+      uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
       with:
         files: 'package.json, artisan'
 

pr-lint/action.yml

@@ -12,9 +12,11 @@ branding:
 runs:
   using: composite
   steps:
-    # Git Checkout
+    #   ╭──────────────────────────────────────────────────────────╮
+    #   │                       Git Checkout                       │
+    #   ╰──────────────────────────────────────────────────────────╯
     - name: Checkout Code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         token: ${{ github.token }}
 
@@ -22,15 +24,120 @@ runs:
         # improve performance
         fetch-depth: 0
 
+    #   ╭──────────────────────────────────────────────────────────╮
+    #   │                 Setup Git configuration                  │
+    #   ╰──────────────────────────────────────────────────────────╯
     - name: Setup Git Config
       id: git-config
-      uses: ivuorinen/actions/set-git-config@main
+      uses: ivuorinen/actions/set-git-config@c0f919957eb60743682a6e0cd6d454fd4b142ac9 # 25.6.30
 
-    # MegaLinter
+    #   ╭──────────────────────────────────────────────────────────╮
+    #   │               Install packages for linting               │
+    #   ╰──────────────────────────────────────────────────────────╯
+
+    # Node.js tests if package.json exists
+    - name: Detect package.json
+      id: detect-node
+      shell: bash
+      run: |
+        if [ -f package.json ]; then
+          echo "found=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup Node.js and run tests
+      if: steps.detect-node.outputs.found == 'true'
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+
+    - name: Install Node.js dependencies
+      if: steps.detect-node.outputs.found == 'true'
+      shell: bash
+      run: |
+        if [ -f pnpm-lock.yaml ]; then
+          npm install -g pnpm
+          pnpm install
+        elif [ -f yarn.lock ]; then
+          npm install -g yarn
+          yarn install
+        elif [ -f package-lock.json ]; then
+          if ! npm ci; then
+            echo "::warning ::npm ci failed – falling back to npm install (lockfile drift?)"
+            npm install
+          fi
+        else
+          echo "No supported lockfile found, skipping Node.js dependencies installation."
+        fi
+
+    # PHP tests if composer.json exists
+    - name: Detect composer.json
+      id: detect-php
+      shell: bash
+      run: |
+        if [ -f composer.json ]; then
+          echo "found=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup PHP
+      if: steps.detect-php.outputs.found == 'true'
+      uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # master
+      with:
+        tools: composer
+        coverage: none
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+
+    - name: Setup problem matchers for PHP
+      if: steps.detect-php.outputs.found == 'true'
+      shell: bash
+      run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
+
+    - name: Install PHP dependencies
+      if: steps.detect-php.outputs.found == 'true'
+      shell: bash
+      run: composer install --no-progress --prefer-dist --no-interaction
+
+    # Python tests if requirements.txt exists
+    - name: Detect requirements.txt
+      id: detect-python
+      shell: bash
+      run: |
+        if [ -f requirements.txt ]; then
+          echo "found=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup Python
+      if: steps.detect-python.outputs.found == 'true'
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      with:
+        cache: 'pip'
+
+    - name: Install Python dependencies
+      if: steps.detect-python.outputs.found == 'true'
+      shell: bash
+      run: pip install -r requirements.txt
+
+    # Go tests if go.mod exists
+    - name: Detect go.mod
+      id: detect-go
+      shell: bash
+      run: |
+        if [ -f go.mod ]; then
+          echo "found=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup Go
+      if: steps.detect-go.outputs.found == 'true'
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      with:
+        go-version-file: 'go.mod'
+        cache: true
+
+    #   ╭──────────────────────────────────────────────────────────╮
+    #   │                        MegaLinter                        │
+    #   ╰──────────────────────────────────────────────────────────╯
     - name: MegaLinter
       # You can override MegaLinter flavor used to have faster performances
       # More info at https://megalinter.io/latest/flavors/
-      uses: oxsecurity/megalinter@ec124f7998718d79379a3c5b39f5359952baf21d # v8
+      uses: oxsecurity/megalinter/flavors/cupcake@e08c2b05e3dbc40af4c23f41172ef1e068a7d651 # v8.8.0
       id: ml
 
       # All available variables are described in documentation
@@ -79,7 +186,7 @@ runs:
     # Upload MegaLinter artifacts
     - name: Archive production artifacts
       if: success() || failure()
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: MegaLinter reports
         include-hidden-files: 'true'
@@ -120,7 +227,7 @@ runs:
     # Create pull request if applicable
     # (for now works only on PR from same repository, not from forks)
     - name: Create Pull Request with applied fixes
-      uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7
+      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
       id: cpr
       if: env.APPLY_FIXES_IF_PR == 'true'
       with:
@@ -144,7 +251,7 @@ runs:
       run: sudo chown -Rc $UID .git/
 
     - name: Commit and push applied linter fixes
-      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       if: env.APPLY_FIXES_IF_COMMIT == 'true'
       with:
         branch: >-

pre-commit/action.yml

@@ -56,7 +56,7 @@ runs:
 
     - name: Push pre-commit fixes
       if: always() # Push changes even when pre-commit fails
-      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       with:
         commit_message: 'style(pre-commit): autofix'
         add_options: -u

prettier-check/action.yml

@@ -102,7 +102,7 @@ runs:
 
     - name: Set up Cache
       id: cache
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       if: inputs.cache == 'true'
       with:
         path: |
@@ -305,7 +305,7 @@ runs:
 
     - name: Upload Prettier Results
       if: always() && inputs.report-format == 'sarif'
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/prettier.sarif
         category: prettier

prettier-fix/action.yml

@@ -12,7 +12,7 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     - name: Set Git Config
       uses: ivuorinen/actions/set-git-config@main
@@ -32,7 +32,7 @@ runs:
 
     - name: Push Fixes
       if: always()
-      uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
       with:
         commit_message: 'style: autofix Prettier violations'
         add_options: '-u'

python-lint-fix/action.yml

@@ -49,7 +49,7 @@ runs:
   using: composite
   steps:
     - name: Setup Python
-      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: ${{ inputs.python-version }}
         cache: 'pip'
@@ -213,7 +213,7 @@ runs:
 
     - name: Upload SARIF Report
       if: steps.check-files.outputs.result == 'found'
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/flake8.sarif
         category: 'python-lint'

release-monthly/action.yml

@@ -62,7 +62,7 @@ runs:
         fi
 
     - name: Checkout Repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 0 # Fetch all history for tag comparison
 

run.sh

@@ -78,7 +78,8 @@ find . -mindepth 1 -maxdepth 1 -type d | while read -r dir; do
       echo "- ⏩ Skipping $dir - action.yml missing"
     fi
   ) || {
-    echo "- ⚠️ Warning: Error processing directory $dir" | tee -a "$log_file"
+    echo "- ⚠️ Warning: Error processing directory $dir" |
+      tee -a "$log_file"
   }
   echo ""
 done
@@ -106,7 +107,7 @@ fi
 echo ""
 
 echo "🔎 Running MegaLinter..."
-if ! npx --yes mega-linter-runner; then
+if ! npx --yes mega-linter-runner --flavor cupcake --fix --remove-container --container-name cupcake; then
   echo "- ⚠️ Warning: MegaLinter found issues" | tee -a "$log_file"
 fi
 echo ""

terraform-lint-fix/action.yml

@@ -82,7 +82,7 @@ runs:
 
     - name: Setup Terraform
       if: steps.check-files.outputs.found == 'true'
-      uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
+      uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
       with:
         terraform_version: ${{ inputs.terraform-version }}
         terraform_wrapper: false
@@ -225,7 +225,7 @@ runs:
 
     - name: Upload SARIF Report
       if: steps.check-files.outputs.found == 'true' && inputs.format == 'sarif'
-      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
+      uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         sarif_file: ${{ inputs.working-directory }}/reports/tflint.sarif
         category: terraform-lint