[llvm] Update [Github] Update GHA Dependencies (PR #226856)
Mend Renovate via llvm-commits
llvm-commits at lists.llvm.org
Sun Sep 27 17:22:50 PDT 2026
https://github.com/renovate-bot created https://github.com/llvm/llvm-project/pull/226856
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance) | action | minor | `v4.1.1` → `v4.2.2` |
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | minor | `v6.0.3` → `v6.1.0` |
| [actions/checkout](https://redirect.github.com/actions/checkout) | action | minor | `v6.0.2` → `v6.1.0` |
| [docker/login-action](https://redirect.github.com/docker/login-action) | action | minor | `v4.4.0` → `v4.6.0` |
| [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | minor | `v4.37.0` → `v4.38.2` |
| [hendrikmuhs/ccache-action](https://redirect.github.com/hendrikmuhs/ccache-action) | action | patch | `v1.2.23` → `v1.2.24` |
| [ossf/scorecard-action](https://redirect.github.com/ossf/scorecard-action) | action | patch | `v2.4.3` → `v2.4.4` |
| [pypa/gh-action-pypi-publish](https://redirect.github.com/pypa/gh-action-pypi-publish) | action | patch | `v1.14.0` → `v1.14.2` |
| [python](https://redirect.github.com/actions/python-versions) | uses-with | patch | `3.14.6` → `3.14.7` |
| [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | patch | `v0.6.2` → `v0.6.4` |
---
### Release Notes
<details>
<summary>actions/attest-build-provenance (actions/attest-build-provenance)</summary>
### [`v4.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v4.2.2)
[Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2)
> \[!NOTE]
> As of version 4, `actions/attest-build-provenance` is simply a wrapper on top of [`actions/attest`](https://redirect.github.com/actions/attest).
>
> Existing applications may continue to use the `attest-build-provenance` action, but new implementations should use `actions/attest` instead.
##### What's Changed
- Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#862](https://redirect.github.com/actions/attest-build-provenance/pull/862)
**Full Changelog**: <https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2>
</details>
<details>
<summary>actions/checkout (actions/checkout)</summary>
### [`v6.1.0`](https://redirect.github.com/actions/checkout/compare/v6.0.3...v6.1.0)
[Compare Source](https://redirect.github.com/actions/checkout/compare/v6.0.3...v6.1.0)
</details>
<details>
<summary>docker/login-action (docker/login-action)</summary>
### [`v4.6.0`](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0)
[Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.2...v4.6.0)
### [`v4.5.2`](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2)
[Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.1...v4.5.2)
### [`v4.5.1`](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1)
[Compare Source](https://redirect.github.com/docker/login-action/compare/v4.5.0...v4.5.1)
### [`v4.5.0`](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0)
[Compare Source](https://redirect.github.com/docker/login-action/compare/v4.4.0...v4.5.0)
</details>
<details>
<summary>github/codeql-action (github/codeql-action)</summary>
### [`v4.38.2`](https://redirect.github.com/github/codeql-action/releases/tag/v4.38.2)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.38.1...v4.38.2)
- Update default CodeQL bundle version to [2.27.1](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1). [#4160](https://redirect.github.com/github/codeql-action/pull/4160)
### [`v4.38.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.38.1)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.38.0...v4.38.1)
- The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. [#4146](https://redirect.github.com/github/codeql-action/pull/4146)
### [`v4.38.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.38.0)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.9...v4.38.0)
- On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. [#4124](https://redirect.github.com/github/codeql-action/pull/4124)
- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle when available. [#4072](https://redirect.github.com/github/codeql-action/pull/4072)
- Update default CodeQL bundle version to [2.27.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0). [#4129](https://redirect.github.com/github/codeql-action/pull/4129)
### [`v4.37.9`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.9)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.8...v4.37.9)
- Update default CodeQL bundle version to [2.26.4](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4). [#4106](https://redirect.github.com/github/codeql-action/pull/4106)
### [`v4.37.8`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.8)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.7...v4.37.8)
No user facing changes.
### [`v4.37.7`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.7)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.6...v4.37.7)
- Update default CodeQL bundle version to [2.26.3](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://redirect.github.com/github/codeql-action/pull/4085)
### [`v4.37.6`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.6)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.5...v4.37.6)
- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://redirect.github.com/github/codeql-action/pull/4070)
### [`v4.37.5`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.5)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.4...v4.37.5)
- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://redirect.github.com/github/codeql-action/pull/4061)
### [`v4.37.4`](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.3...v4.37.4)
### [`v4.37.3`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.3)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.2...v4.37.3)
No user facing changes.
### [`v4.37.2`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.2)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.1...v4.37.2)
- The new address format for the `config-file` input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the `remote=` prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. [#4023](https://redirect.github.com/github/codeql-action/pull/4023)
- The CodeQL Action can now make use of [configured private registries](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries) in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. [#4007](https://redirect.github.com/github/codeql-action/pull/4007)
### [`v4.37.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.37.1)
[Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.37.0...v4.37.1)
- *Upcoming breaking change*: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. [#3956](https://redirect.github.com/github/codeql-action/pull/3956)
- Update default CodeQL bundle version to [2.26.1](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1). [#4019](https://redirect.github.com/github/codeql-action/pull/4019)
</details>
<details>
<summary>hendrikmuhs/ccache-action (hendrikmuhs/ccache-action)</summary>
### [`v1.2.24`](https://redirect.github.com/hendrikmuhs/ccache-action/releases/tag/v1.2.24)
[Compare Source](https://redirect.github.com/hendrikmuhs/ccache-action/compare/v1.2.23...v1.2.24)
#### What's Changed
- metadata: Add release of ccache on linux-riscv64 by [@luhenry](https://redirect.github.com/luhenry) in [#442](https://redirect.github.com/hendrikmuhs/ccache-action/pull/442)
- Update sccache to 0.15.0 by [@luhenry](https://redirect.github.com/luhenry) in [#444](https://redirect.github.com/hendrikmuhs/ccache-action/pull/444)
#### dependabot updates
- Bump fast-xml-builder from 1.1.4 to 1.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#445](https://redirect.github.com/hendrikmuhs/ccache-action/pull/445)
- Bump jest from 30.3.0 to 30.4.2 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#446](https://redirect.github.com/hendrikmuhs/ccache-action/pull/446)
- Bump [@types/node](https://redirect.github.com/types/node) from 25.6.0 to 25.9.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#449](https://redirect.github.com/hendrikmuhs/ccache-action/pull/449)
- Bump fast-xml-parser from 5.5.7 to 5.8.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#443](https://redirect.github.com/hendrikmuhs/ccache-action/pull/443)
- Bump actions/checkout from 6 to 7 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#454](https://redirect.github.com/hendrikmuhs/ccache-action/pull/454)
- Bump [@vercel/ncc](https://redirect.github.com/vercel/ncc) from 0.38.4 to 0.44.1 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#458](https://redirect.github.com/hendrikmuhs/ccache-action/pull/458)
- Bump to sccache v0.17.0 and ccache v4.13.6 by [@luhenry](https://redirect.github.com/luhenry) in [#464](https://redirect.github.com/hendrikmuhs/ccache-action/pull/464)
- Bump [@types/node](https://redirect.github.com/types/node) from 25.9.1 to 26.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#461](https://redirect.github.com/hendrikmuhs/ccache-action/pull/461)
- Bump [@actions/cache](https://redirect.github.com/actions/cache) from 6.0.0 to 6.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#460](https://redirect.github.com/hendrikmuhs/ccache-action/pull/460)
- Bump undici from 6.24.1 to 6.28.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#462](https://redirect.github.com/hendrikmuhs/ccache-action/pull/462)
- Bump brace-expansion by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#463](https://redirect.github.com/hendrikmuhs/ccache-action/pull/463)
**Full Changelog**: <https://github.com/hendrikmuhs/ccache-action/compare/v1.2.23...v1.2.24>
</details>
<details>
<summary>ossf/scorecard-action (ossf/scorecard-action)</summary>
### [`v2.4.4`](https://redirect.github.com/ossf/scorecard-action/releases/tag/v2.4.4)
[Compare Source](https://redirect.github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4)
#### What's Changed
This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the [Scorecard v5.4.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.4.0) and the [Scorecard v5.5.0 release notes](https://redirect.github.com/ossf/scorecard/releases/tag/v5.5.0).
- log POST failures instead of failing entire action by [@spencerschrock](https://redirect.github.com/spencerschrock) in [#1625](https://redirect.github.com/ossf/scorecard-action/pull/1625)
**Full Changelog**: <https://github.com/ossf/scorecard-action/compare/v2.4.3...v2.4.4>
</details>
<details>
<summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary>
### [`v1.14.2`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2)
[Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2)
<p align="right"><i>This one probably won't touch you visibly so just bookmark <a href="https://ep2026.europython.eu/session/defending-open-source-from-ai-slop-a-maintainer-s-practical-guide">@webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube</a> or <a href="https://redirect.github.com/sponsors/webknjaz">encourage him to come back with more to share next year</a>!</i></p>
#### 🛠️ Urgh… Another release!? Again? Explain yourself!
Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.
> \[!tip]
> So what *most* people will find useful is [@takluyver](https://redirect.github.com/takluyver)[💰](https://redirect.github.com/sponsors/takluyver)'s update of Twine to v7 that we use internally ([#416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.
#### 🧐 Tell me why..
<details>
<summary>
The rest of the updates bump things related to <code>pypi-attestations</code> and <code>sigstore</code>, which has the most interesting backstory here. @facutuesca<a href="https://redirect.github.com/sponsors/facutuesca">💰</a> sent a patch in #417 but a bunch more helped out.
</summary>
TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like [aio-libs/aiohttp#13226](https://redirect.github.com/aio-libs/aiohttp/pull/13226) around July 23.
On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.
I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.
Over the course of investigation, [@facutuesca](https://redirect.github.com/facutuesca)[💰](https://redirect.github.com/sponsors/facutuesca) found and fixed a related underlying cache invalidation bug in [sigstore/sigstore-python#1838](https://redirect.github.com/sigstore/sigstore-python/pull/1838), which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.
Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <https://publishing-five-minute-timeout.tiiny.site>.
<center>
<a href="https://xkcd.com/2549/">
<img src="https://imgs.xkcd.com/comics/edge_cake_2x.png" alt="Edge Cake XKCD feels just like this release">
</a>
</center>
</details>
#### 🫶 New Contributors
- [@davidbrochart](https://redirect.github.com/davidbrochart) made their first contribution in [#415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415)
- [@takluyver](https://redirect.github.com/takluyver) made their first contribution in [#416](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416)
**🪞 Full Diff**: <https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2>
**🧔♂️ Release Manager:** [@webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua)
**🙏 Special Thanks** to [@davidbrochart](https://redirect.github.com/davidbrochart)[💰](https://redirect.github.com/sponsors/davidbrochart) and [@Dreamsorcerer](https://redirect.github.com/Dreamsorcerer)[💰](https://redirect.github.com/sponsors/Dreamsorcerer) for turning my attention (in [#415](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415) and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. [@bdraco](https://redirect.github.com/bdraco)[💰](https://redirect.github.com/sponsors/bdraco) came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. [@miketheman](https://redirect.github.com/miketheman)[💰](https://redirect.github.com/sponsors/miketheman) confirmed the Warehouse-side details. Also, [@jku](https://redirect.github.com/jku)[💰](https://redirect.github.com/sponsors/jku) and [@woodruffw](https://redirect.github.com/woodruffw)[💰](https://redirect.github.com/sponsors/woodruffw) helped work through, review and release the Sigstore ecosystem upstream libs.
**💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j), [on Mastodon 🐘](https://mastodon.social/@webknjaz/117005132816750073) and [on GitHub][release discussion].
[![GH Sponsors badge]][GH Sponsors URL]
[GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c
[GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz
[release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/419
### [`v1.14.1`](https://redirect.github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.1)
[Compare Source](https://redirect.github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1)
<p align="right"><i>This release was cut at <a href="https://ep2026.europython.eu/sprints/">EuroPython 2026 Sprints</a></i></p>
#### 🛠️ Internal Dependencies
[@adisivaprasad](https://redirect.github.com/adisivaprasad)[💰](https://redirect.github.com/sponsors/adisivaprasad) helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating `actions/setup-python` from v5.6.0 to v6.2.0 in [#408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408).
#### 💪 New Contributors
- [@adisivaprasad](https://redirect.github.com/adisivaprasad) made their first contribution in [#408](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/408)
- [@jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) followed up and reminded us to actually cut this release in [#413](https://redirect.github.com/pypa/gh-action-pypi-publish/issues/413)
**🪞 Full Diff**: <https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.0...v1.14.1>
**🧔♂️ Release Manager:** [@webknjaz](https://redirect.github.com/sponsors/webknjaz) [🇺🇦](https://stand-with-ukraine.pp.ua)
**🙏 Special Thanks** to [@jylenhof](https://redirect.github.com/jylenhof)[💰](https://redirect.github.com/sponsors/jylenhof) for reminding me to work on this release!
**💬 Discuss** [on Bluesky 🦋](https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrd7jpnxc22d), [on Mastodon 🐘](https://mastodon.social/@webknjaz/116970132515797444) and [on GitHub][release discussion].
[![GH Sponsors badge]][GH Sponsors URL]
[GH Sponsors badge]: https://img.shields.io/badge/%40webknjaz-transparent?logo=githubsponsors&logoColor=%23EA4AAA&label=Sponsor&color=2a313c
[GH Sponsors URL]: https://redirect.github.com/sponsors/webknjaz
[release discussion]: https://redirect.github.com/pypa/gh-action-pypi-publish/discussions/414
</details>
<details>
<summary>actions/python-versions (python)</summary>
### [`v3.14.7`](https://redirect.github.com/actions/python-versions/releases/tag/3.14.7-31064857500): 3.14.7
[Compare Source](https://redirect.github.com/actions/python-versions/compare/3.14.6-27283001424...3.14.7-31064857500)
Python 3.14.7
</details>
<details>
<summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary>
### [`v0.6.4`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.4)
[Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.3...v0.6.4)
[Sponsorship is appreciated!](https://redirect.github.com/sponsors/woodruffw/)
zizmor 1.30.1 is now the default version.
Release notes: <https://docs.zizmor.sh/release-notes/#1301>
### [`v0.6.3`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.3)
[Compare Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.2...v0.6.3)
zizmor 1.30.0 is now the default version.
Release notes: <https://docs.zizmor.sh/release-notes/#1300>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Between 12:00 AM and 12:59 AM, only on Monday (`* 0 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/llvm/llvm-project).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
>From f77732d1418aadabfd6c78781284588db589dbb8 Mon Sep 17 00:00:00 2001
From: Mend Renovate <bot at renovateapp.com>
Date: Mon, 28 Sep 2026 00:22:32 +0000
Subject: [PATCH] Update [Github] Update GHA Dependencies
---
.github/workflows/bazel-checks.yml | 4 ++--
.github/workflows/build-ci-container-tooling.yml | 4 ++--
.github/workflows/build-ci-container-windows.yml | 2 +-
.github/workflows/build-ci-container.yml | 4 ++--
.github/workflows/build-libc-container.yml | 4 ++--
.github/workflows/build-metrics-container.yml | 4 ++--
.github/workflows/check-ci.yml | 2 +-
.github/workflows/ci-post-commit-analyzer.yml | 4 ++--
.github/workflows/commit-access-review.yml | 2 +-
.github/workflows/compiler-rt-libc-builtins-tests.yml | 2 +-
.github/workflows/docs.yml | 2 +-
.github/workflows/email-check.yaml | 2 +-
.github/workflows/get-llvm-version/action.yml | 2 +-
.github/workflows/gha-codeql.yml | 6 +++---
.github/workflows/hlsl-test-all.yaml | 8 ++++----
.github/workflows/ids-check.yml | 2 +-
.github/workflows/issue-release-workflow.yml | 2 +-
.github/workflows/issue-write.yml | 2 +-
.github/workflows/libc-freebsd-vm-tests.yml | 2 +-
.github/workflows/libc-fullbuild-tests.yml | 4 ++--
.github/workflows/libc-overlay-tests.yml | 8 ++++----
.github/workflows/libc-shared-tests.yml | 6 +++---
.github/workflows/libclang-abi-tests.yml | 2 +-
.github/workflows/libcxx-benchmark-commit.yml | 4 ++--
.github/workflows/libcxx-benchmark-cron.yml | 6 +++---
.github/workflows/libcxx-build-containers.yml | 4 ++--
.github/workflows/libcxx-pr-benchmark.yml | 8 ++++----
.github/workflows/libcxx-pr-check-generated-files.yml | 2 +-
.github/workflows/libcxx-pr-conformance-tests.yaml | 10 +++++-----
.github/workflows/libcxx-pr-test-tools.yml | 2 +-
.github/workflows/lldb-pylint-action.yml | 2 +-
.github/workflows/llvm-abi-tests.yml | 2 +-
.github/workflows/mlir-spirv-tests.yml | 4 ++--
.github/workflows/pr-code-format.yml | 2 +-
.github/workflows/pr-code-lint.yml | 2 +-
.github/workflows/premerge.yaml | 10 +++++-----
.github/workflows/prune-branches.yml | 2 +-
.github/workflows/release-asset-audit.yml | 2 +-
.github/workflows/release-binaries.yml | 4 ++--
.github/workflows/release-documentation.yml | 4 ++--
.github/workflows/release-llvm-testing-tools.yml | 2 +-
.github/workflows/release-sources.yml | 4 ++--
.github/workflows/release-tasks.yml | 8 ++++----
.github/workflows/scorecard.yml | 6 +++---
.github/workflows/spirv-tests.yml | 4 ++--
.github/workflows/sycl-tests.yml | 4 ++--
.github/workflows/test-suite.yml | 6 +++---
.../workflows/test-unprivileged-download-artifact.yml | 2 +-
.github/workflows/upload-release-artifact/action.yml | 4 ++--
.github/workflows/version-check.yml | 2 +-
.github/workflows/zizmor.yml | 4 ++--
51 files changed, 98 insertions(+), 98 deletions(-)
diff --git a/.github/workflows/bazel-checks.yml b/.github/workflows/bazel-checks.yml
index f2dd3ab35da9d..155633bb19a9d 100644
--- a/.github/workflows/bazel-checks.yml
+++ b/.github/workflows/bazel-checks.yml
@@ -22,7 +22,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup Buildifier
@@ -53,7 +53,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# TODO(boomanaiden154): We should use a purpose built container for this. Move
diff --git a/.github/workflows/build-ci-container-tooling.yml b/.github/workflows/build-ci-container-tooling.yml
index f04711c53c69d..433f419d026bb 100644
--- a/.github/workflows/build-ci-container-tooling.yml
+++ b/.github/workflows/build-ci-container-tooling.yml
@@ -51,7 +51,7 @@ jobs:
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -80,7 +80,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/build-ci-container-windows.yml b/.github/workflows/build-ci-container-windows.yml
index d8d464ce98b30..a0b254e402a74 100644
--- a/.github/workflows/build-ci-container-windows.yml
+++ b/.github/workflows/build-ci-container-windows.yml
@@ -25,7 +25,7 @@ jobs:
container-filename: ${{ steps.vars.outputs.container-filename }}
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: .github/workflows/containers/github-action-ci-windows
diff --git a/.github/workflows/build-ci-container.yml b/.github/workflows/build-ci-container.yml
index bb8b1503e5eda..10ce1bf6ea488 100644
--- a/.github/workflows/build-ci-container.yml
+++ b/.github/workflows/build-ci-container.yml
@@ -36,7 +36,7 @@ jobs:
- cd $HOME && printf '#include <iostream>\nint main(int argc, char **argv) { std::cout << "Hello\\n"; }' | clang++ -x c++ - && ./a.out | grep Hello
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -74,7 +74,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/build-libc-container.yml b/.github/workflows/build-libc-container.yml
index 015d77b1b70eb..fd6b7d0114766 100644
--- a/.github/workflows/build-libc-container.yml
+++ b/.github/workflows/build-libc-container.yml
@@ -27,7 +27,7 @@ jobs:
- ubuntu-26.04-arm
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -49,7 +49,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/build-metrics-container.yml b/.github/workflows/build-metrics-container.yml
index c2c70d616b28a..e9a0444c7143b 100644
--- a/.github/workflows/build-metrics-container.yml
+++ b/.github/workflows/build-metrics-container.yml
@@ -23,7 +23,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -47,7 +47,7 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/check-ci.yml b/.github/workflows/check-ci.yml
index a4f0ab2e157e9..8d9860fdcb10b 100644
--- a/.github/workflows/check-ci.yml
+++ b/.github/workflows/check-ci.yml
@@ -22,7 +22,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: .ci
diff --git a/.github/workflows/ci-post-commit-analyzer.yml b/.github/workflows/ci-post-commit-analyzer.yml
index fdbff0d6616b4..ad2d1de4b23e9 100644
--- a/.github/workflows/ci-post-commit-analyzer.yml
+++ b/.github/workflows/ci-post-commit-analyzer.yml
@@ -41,12 +41,12 @@ jobs:
LLVM_VERSION: 18
steps:
- name: Checkout Source
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
# A full build of llvm, clang, lld, and lldb takes about 250MB
# of ccache space. There's not much reason to have more than this,
diff --git a/.github/workflows/commit-access-review.yml b/.github/workflows/commit-access-review.yml
index 16217536fdccd..007a215937aec 100644
--- a/.github/workflows/commit-access-review.yml
+++ b/.github/workflows/commit-access-review.yml
@@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
diff --git a/.github/workflows/compiler-rt-libc-builtins-tests.yml b/.github/workflows/compiler-rt-libc-builtins-tests.yml
index f5e1fdfb91c11..abaccc2037991 100644
--- a/.github/workflows/compiler-rt-libc-builtins-tests.yml
+++ b/.github/workflows/compiler-rt-libc-builtins-tests.yml
@@ -28,7 +28,7 @@ jobs:
os: [ubuntu-26.04, ubuntu-26.04-arm]
steps:
- - uses: actions/checkout at de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dc9f69f8b3c13..6a262529a2513 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -57,7 +57,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
diff --git a/.github/workflows/email-check.yaml b/.github/workflows/email-check.yaml
index f15daa39e41d2..efe7444005228 100644
--- a/.github/workflows/email-check.yaml
+++ b/.github/workflows/email-check.yaml
@@ -14,7 +14,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/get-llvm-version/action.yml b/.github/workflows/get-llvm-version/action.yml
index a1bda75bd3fd7..8aa96078c9255 100644
--- a/.github/workflows/get-llvm-version/action.yml
+++ b/.github/workflows/get-llvm-version/action.yml
@@ -21,7 +21,7 @@ outputs:
runs:
using: "composite"
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
path: get-llvm-version
diff --git a/.github/workflows/gha-codeql.yml b/.github/workflows/gha-codeql.yml
index 9d0c0890fb85b..03250078623c9 100644
--- a/.github/workflows/gha-codeql.yml
+++ b/.github/workflows/gha-codeql.yml
@@ -24,15 +24,15 @@ jobs:
security-events: write
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
.github/
- name: Initialize CodeQL
- uses: github/codeql-action/init at 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+ uses: github/codeql-action/init at 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
with:
languages: actions
queries: security-extended
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze at 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+ uses: github/codeql-action/analyze at 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
diff --git a/.github/workflows/hlsl-test-all.yaml b/.github/workflows/hlsl-test-all.yaml
index 03605497ab660..8c642873f60e9 100644
--- a/.github/workflows/hlsl-test-all.yaml
+++ b/.github/workflows/hlsl-test-all.yaml
@@ -29,7 +29,7 @@ jobs:
runs-on: ${{ inputs.SKU }}
steps:
- name: Checkout DXC
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
repository: Microsoft/DirectXShaderCompiler
@@ -37,20 +37,20 @@ jobs:
path: DXC
submodules: true
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ inputs.LLVM-branch }}
path: llvm-project
- name: Checkout OffloadTest
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
repository: llvm/offload-test-suite
ref: main
path: OffloadTest
- name: Checkout Golden Images
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
repository: llvm/offload-golden-images
diff --git a/.github/workflows/ids-check.yml b/.github/workflows/ids-check.yml
index d713a1d89e48f..fd768c0654764 100644
--- a/.github/workflows/ids-check.yml
+++ b/.github/workflows/ids-check.yml
@@ -24,7 +24,7 @@ jobs:
timeout-minutes: 20
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
path: ${{ github.workspace }}/llvm-project
diff --git a/.github/workflows/issue-release-workflow.yml b/.github/workflows/issue-release-workflow.yml
index b985b1b93e72c..52bb1d0deecd7 100644
--- a/.github/workflows/issue-release-workflow.yml
+++ b/.github/workflows/issue-release-workflow.yml
@@ -64,7 +64,7 @@ jobs:
pull-requests: write
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: llvm/llvm-project
# GitHub stores the token used for checkout and uses it for pushes
diff --git a/.github/workflows/issue-write.yml b/.github/workflows/issue-write.yml
index a9f62685fa08d..e78efe85e403f 100644
--- a/.github/workflows/issue-write.yml
+++ b/.github/workflows/issue-write.yml
@@ -33,7 +33,7 @@ jobs:
github.repository == 'llvm/llvm-project'
steps:
- name: Fetch Sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/libc-freebsd-vm-tests.yml b/.github/workflows/libc-freebsd-vm-tests.yml
index 187029e82aafc..16dc5c19cee9d 100644
--- a/.github/workflows/libc-freebsd-vm-tests.yml
+++ b/.github/workflows/libc-freebsd-vm-tests.yml
@@ -15,7 +15,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
diff --git a/.github/workflows/libc-fullbuild-tests.yml b/.github/workflows/libc-fullbuild-tests.yml
index 7955a760c8dbb..f890bd3039586 100644
--- a/.github/workflows/libc-fullbuild-tests.yml
+++ b/.github/workflows/libc-fullbuild-tests.yml
@@ -127,7 +127,7 @@ jobs:
# - c_compiler: gcc
# cpp_compiler: g++
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -138,7 +138,7 @@ jobs:
# Do not use direct GHAC access even though it is supported by sccache. GHAC rejects
# frequent small object writes.
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 1G
key: libc_fullbuild_v3_${{ matrix.target }}_${{ matrix.build_type }}_${{ matrix.c_compiler }}
diff --git a/.github/workflows/libc-overlay-tests.yml b/.github/workflows/libc-overlay-tests.yml
index 51b1e7d9dc121..4d4fbf1c4670b 100644
--- a/.github/workflows/libc-overlay-tests.yml
+++ b/.github/workflows/libc-overlay-tests.yml
@@ -52,7 +52,7 @@ jobs:
cpp_compiler: clang++
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -64,7 +64,7 @@ jobs:
# Do not use direct GHAC access even though it is supported by sccache. GHAC rejects
# frequent small object writes.
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 1G
key: libc_overlay_build_v2_${{ matrix.os }}_${{ matrix.compiler.c_compiler }}
@@ -150,12 +150,12 @@ jobs:
mpc_path: riscv64-linux-gnu
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 1G
key: libc_qemu_overlay_${{ matrix.arch }}_${{ matrix.c_compiler }}
diff --git a/.github/workflows/libc-shared-tests.yml b/.github/workflows/libc-shared-tests.yml
index a7b3b0d5f1570..5625efe78909d 100644
--- a/.github/workflows/libc-shared-tests.yml
+++ b/.github/workflows/libc-shared-tests.yml
@@ -27,7 +27,7 @@ jobs:
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -74,7 +74,7 @@ jobs:
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -149,7 +149,7 @@ jobs:
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
diff --git a/.github/workflows/libclang-abi-tests.yml b/.github/workflows/libclang-abi-tests.yml
index 755db8a771dba..2a477a21f8055 100644
--- a/.github/workflows/libclang-abi-tests.yml
+++ b/.github/workflows/libclang-abi-tests.yml
@@ -109,7 +109,7 @@ jobs:
*${{ matrix.ref }}.abi
- name: Download source code
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
if: steps.cache.outputs.cache-hit != 'true'
with:
persist-credentials: false
diff --git a/.github/workflows/libcxx-benchmark-commit.yml b/.github/workflows/libcxx-benchmark-commit.yml
index 4c62087f2eede..ade11d37f3554 100644
--- a/.github/workflows/libcxx-benchmark-commit.yml
+++ b/.github/workflows/libcxx-benchmark-commit.yml
@@ -52,7 +52,7 @@ jobs:
matrix: ${{ steps.select.outputs.matrix }}
steps:
- name: Checkout the machine definitions
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# Disabling cone mode allows checking out exactly the single file we need.
@@ -112,7 +112,7 @@ jobs:
INSTALL_DIR: ${{ github.workspace }}/install
steps:
- name: Checkout the LLVM monorepo
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# We benchmark arbitrary historical commits, which requires the full history to be available.
diff --git a/.github/workflows/libcxx-benchmark-cron.yml b/.github/workflows/libcxx-benchmark-cron.yml
index 5bad2531e3077..042a514b0e7da 100644
--- a/.github/workflows/libcxx-benchmark-cron.yml
+++ b/.github/workflows/libcxx-benchmark-cron.yml
@@ -45,7 +45,7 @@ jobs:
matrix: ${{ steps.select.outputs.matrix }}
steps:
- name: Checkout the machine definitions
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# Disabling cone mode allows checking out exactly the single file we need.
@@ -110,7 +110,7 @@ jobs:
- name: Checkout the full LLVM monorepo
if: ${{ steps.restore-anchors.outputs.cache-hit != 'true' }}
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# Selecting anchor commits requires full Git history, but not the blob content.
@@ -119,7 +119,7 @@ jobs:
- name: Checkout sparse LLVM monorepo
if: ${{ steps.restore-anchors.outputs.cache-hit == 'true' }}
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: libcxx/utils # Only checkout what the tools need
diff --git a/.github/workflows/libcxx-build-containers.yml b/.github/workflows/libcxx-build-containers.yml
index 5f24cc54021ad..878ce81c7774f 100644
--- a/.github/workflows/libcxx-build-containers.yml
+++ b/.github/workflows/libcxx-build-containers.yml
@@ -33,7 +33,7 @@ jobs:
packages: write
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -51,7 +51,7 @@ jobs:
TAG: ${{ github.sha }}
- name: Log in to GitHub Container Registry
- uses: docker/login-action at af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+ uses: docker/login-action at dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
diff --git a/.github/workflows/libcxx-pr-benchmark.yml b/.github/workflows/libcxx-pr-benchmark.yml
index e5de26cc1f0f2..97d2c58f5099d 100644
--- a/.github/workflows/libcxx-pr-benchmark.yml
+++ b/.github/workflows/libcxx-pr-benchmark.yml
@@ -28,7 +28,7 @@ jobs:
name: main-branch-only
deployment: false
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -49,7 +49,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout the LNT configurations
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
# Disabling cone mode allows checking out exactly the single file we need.
@@ -121,7 +121,7 @@ jobs:
TOOLING: ${{ github.workspace }}/tooling
steps:
- name: Checkout the PR
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ needs.extract-info.outputs.pr_head }}
@@ -132,7 +132,7 @@ jobs:
# commit so that we're always running tooling that's in sync with the workflow's definition. Only the
# code and the test suite (including its testing configuration) are taken from the PR head.
- name: Checkout the tooling from ${{ github.sha }}
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ github.sha }}
diff --git a/.github/workflows/libcxx-pr-check-generated-files.yml b/.github/workflows/libcxx-pr-check-generated-files.yml
index b7f0da7eb67f5..df4fcc14a5b35 100644
--- a/.github/workflows/libcxx-pr-check-generated-files.yml
+++ b/.github/workflows/libcxx-pr-check-generated-files.yml
@@ -18,7 +18,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
diff --git a/.github/workflows/libcxx-pr-conformance-tests.yaml b/.github/workflows/libcxx-pr-conformance-tests.yaml
index 61e455e1a799d..d231e70d401f3 100644
--- a/.github/workflows/libcxx-pr-conformance-tests.yaml
+++ b/.github/workflows/libcxx-pr-conformance-tests.yaml
@@ -57,7 +57,7 @@ jobs:
cc: 'gcc-16'
cxx: 'g++-16'
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: ${{ matrix.config }}.${{ matrix.cxx }}
@@ -112,7 +112,7 @@ jobs:
cc: 'clang-21'
cxx: 'clang++-21'
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: ${{ matrix.config }}
@@ -177,7 +177,7 @@ jobs:
'bootstrapping-build'
]
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: ${{ matrix.config }}
@@ -232,7 +232,7 @@ jobs:
xcode-version: '26.6'
runs-on: ["self-hosted", "macOS", "apple-runners", "26.6.2"] # macOS 26.6.2, which has Xcode 26.6
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Select Xcode
@@ -280,7 +280,7 @@ jobs:
- { config: mingw-static, mingw: true, cc: cc, cxx: c++, runner: windows-11-arm }
runs-on: ${{ matrix.runner != '' && matrix.runner || 'windows-2022' }}
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Install dependencies
diff --git a/.github/workflows/libcxx-pr-test-tools.yml b/.github/workflows/libcxx-pr-test-tools.yml
index 64bbc705e5e09..de853e2f65514 100644
--- a/.github/workflows/libcxx-pr-test-tools.yml
+++ b/.github/workflows/libcxx-pr-test-tools.yml
@@ -36,7 +36,7 @@ jobs:
CC: clang-23
CXX: clang++-23
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 0 # some tools need full git history
diff --git a/.github/workflows/lldb-pylint-action.yml b/.github/workflows/lldb-pylint-action.yml
index b4347107ca54c..75d1456c86288 100644
--- a/.github/workflows/lldb-pylint-action.yml
+++ b/.github/workflows/lldb-pylint-action.yml
@@ -19,7 +19,7 @@ jobs:
cancel-in-progress: true
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
diff --git a/.github/workflows/llvm-abi-tests.yml b/.github/workflows/llvm-abi-tests.yml
index 74b6b18dee306..402b6c6c47272 100644
--- a/.github/workflows/llvm-abi-tests.yml
+++ b/.github/workflows/llvm-abi-tests.yml
@@ -98,7 +98,7 @@ jobs:
llvm.symbols
- name: Download source code
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
if: steps.cache.outputs.cache-hit != 'true'
with:
persist-credentials: false
diff --git a/.github/workflows/mlir-spirv-tests.yml b/.github/workflows/mlir-spirv-tests.yml
index 14dfbe892b06f..9f21fd4298cd7 100644
--- a/.github/workflows/mlir-spirv-tests.yml
+++ b/.github/workflows/mlir-spirv-tests.yml
@@ -28,11 +28,11 @@ jobs:
container:
image: ghcr.io/llvm/ci-ubuntu-26.04:latest at sha256:7ac659feb90ac48dd8676e4eb305b9aa5b31fc8b329b7e39379c38af06efc6e1
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 2G
key: spirv-mlir-ubuntu-26.04
diff --git a/.github/workflows/pr-code-format.yml b/.github/workflows/pr-code-format.yml
index 88720720c3d57..a32dd18b01d11 100644
--- a/.github/workflows/pr-code-format.yml
+++ b/.github/workflows/pr-code-format.yml
@@ -21,7 +21,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
diff --git a/.github/workflows/pr-code-lint.yml b/.github/workflows/pr-code-lint.yml
index 16b6d40489467..61f85e182543d 100644
--- a/.github/workflows/pr-code-lint.yml
+++ b/.github/workflows/pr-code-lint.yml
@@ -28,7 +28,7 @@ jobs:
cancel-in-progress: true
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
diff --git a/.github/workflows/premerge.yaml b/.github/workflows/premerge.yaml
index c6d604533f1f6..f21ef392a0154 100644
--- a/.github/workflows/premerge.yaml
+++ b/.github/workflows/premerge.yaml
@@ -37,7 +37,7 @@ jobs:
shell: bash
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
@@ -113,7 +113,7 @@ jobs:
shell: bash
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
@@ -201,14 +201,14 @@ jobs:
# back to a git diff, which needs real history.
- name: Checkout LLVM (sparse)
if: github.event_name == 'pull_request'
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: .ci
sparse-checkout-cone-mode: false
- name: Checkout LLVM
if: github.event_name != 'pull_request'
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
@@ -252,7 +252,7 @@ jobs:
needs.premerge-compute-macos.outputs.macos-projects != ''
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 2
diff --git a/.github/workflows/prune-branches.yml b/.github/workflows/prune-branches.yml
index 5c46f1350bd1d..fa16f31f49a92 100644
--- a/.github/workflows/prune-branches.yml
+++ b/.github/workflows/prune-branches.yml
@@ -20,7 +20,7 @@ jobs:
contents: write
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: true # Relies on persisted credentials to delete unused remote branches
fetch-depth: 0
diff --git a/.github/workflows/release-asset-audit.yml b/.github/workflows/release-asset-audit.yml
index b60974e3dd97f..5916a5ee0c40b 100644
--- a/.github/workflows/release-asset-audit.yml
+++ b/.github/workflows/release-asset-audit.yml
@@ -23,7 +23,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 759dea944a0fb..9cb6b2cecce5e 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -226,7 +226,7 @@ jobs:
# get changed unexpectedly.
- uses: actions/setup-python at ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
- python-version: '3.14.6'
+ python-version: '3.14.7'
# For some reason this is needed on Windows or else the build system can't find python3.lib.
- name: Setup Python library path
@@ -240,7 +240,7 @@ jobs:
git config --global core.autocrlf false
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ needs.prepare.outputs.ref }}
diff --git a/.github/workflows/release-documentation.yml b/.github/workflows/release-documentation.yml
index 0e86ec0ca5355..1725c5fdd27e2 100644
--- a/.github/workflows/release-documentation.yml
+++ b/.github/workflows/release-documentation.yml
@@ -75,7 +75,7 @@ jobs:
doxygen-artifact-id: ${{ steps.doxygen-artifact-upload.outputs.artifact-id }}
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -163,7 +163,7 @@ jobs:
contents: read
steps:
- name: Clone www-releases
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: ${{ github.repository_owner }}/www-releases
ref: main
diff --git a/.github/workflows/release-llvm-testing-tools.yml b/.github/workflows/release-llvm-testing-tools.yml
index 1fb413566e139..cf61127b6ef10 100644
--- a/.github/workflows/release-llvm-testing-tools.yml
+++ b/.github/workflows/release-llvm-testing-tools.yml
@@ -19,7 +19,7 @@ jobs:
if: github.repository == 'llvm/llvm-project'
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Build Binaries
diff --git a/.github/workflows/release-sources.yml b/.github/workflows/release-sources.yml
index aa8aa433964d3..dfbc1547622e7 100644
--- a/.github/workflows/release-sources.yml
+++ b/.github/workflows/release-sources.yml
@@ -53,7 +53,7 @@ jobs:
export-args: ${{ steps.inputs.outputs.export-args }}
runs-on: ubuntu-26.04
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -88,7 +88,7 @@ jobs:
- inputs
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: ${{ needs.inputs.outputs.ref }}
diff --git a/.github/workflows/release-tasks.yml b/.github/workflows/release-tasks.yml
index 76b94add1cbdf..9d130dc0c28d8 100644
--- a/.github/workflows/release-tasks.yml
+++ b/.github/workflows/release-tasks.yml
@@ -41,7 +41,7 @@ jobs:
sudo apt-get install python3-github
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
@@ -91,7 +91,7 @@ jobs:
environment: pypi
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
ref: "llvmorg-${{ needs.validate-tag.outputs.release-version }}"
@@ -129,7 +129,7 @@ jobs:
llvm/utils/lit/dist
- name: Upload lit to pypi.org
- uses: pypa/gh-action-pypi-publish at cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+ uses: pypa/gh-action-pypi-publish at dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
with:
packages-dir: llvm/utils/lit/dist/
@@ -184,7 +184,7 @@ jobs:
sudo apt-get install python3-github
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: llvm/utils/release/github-upload-release.py
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c5e53e7f8b9e5..f80facb6b4ec2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,12 +31,12 @@ jobs:
steps:
- name: "Checkout code"
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: "Run analysis"
- uses: ossf/scorecard-action at 4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+ uses: ossf/scorecard-action at 2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
with:
results_file: results.sarif
results_format: sarif
@@ -57,6 +57,6 @@ jobs:
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif at 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+ uses: github/codeql-action/upload-sarif at 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
with:
sarif_file: results.sarif
diff --git a/.github/workflows/spirv-tests.yml b/.github/workflows/spirv-tests.yml
index 7a32576b725c4..3a23cea5026ff 100644
--- a/.github/workflows/spirv-tests.yml
+++ b/.github/workflows/spirv-tests.yml
@@ -24,11 +24,11 @@ jobs:
container:
image: ghcr.io/llvm/ci-ubuntu-26.04:latest at sha256:7ac659feb90ac48dd8676e4eb305b9aa5b31fc8b329b7e39379c38af06efc6e1
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 2G
key: spirv-ubuntu-26.04
diff --git a/.github/workflows/sycl-tests.yml b/.github/workflows/sycl-tests.yml
index 60b8ae4c538a1..3ee72b99ee5c9 100644
--- a/.github/workflows/sycl-tests.yml
+++ b/.github/workflows/sycl-tests.yml
@@ -23,11 +23,11 @@ jobs:
container:
image: ghcr.io/llvm/ci-ubuntu-26.04:latest at sha256:7ac659feb90ac48dd8676e4eb305b9aa5b31fc8b329b7e39379c38af06efc6e1
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Setup ccache
- uses: hendrikmuhs/ccache-action at d62db5f07c26379fc4b4e0916f098a92573c3b03 # v1.2.23
+ uses: hendrikmuhs/ccache-action at f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
with:
max-size: 2G
key: sycl-ubuntu-26.04
diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml
index 7cafb4f5f9916..bdcc617acc0d9 100644
--- a/.github/workflows/test-suite.yml
+++ b/.github/workflows/test-suite.yml
@@ -21,7 +21,7 @@ jobs:
name: main-branch-only
deployment: false
steps:
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
@@ -82,7 +82,7 @@ jobs:
EOF
exit 1
- name: Checkout pull request
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
ref: ${{ fromJSON(steps.get-pr.outputs.result).merge_commit_sha }}
# test merge commits are stored in the base repository, not the head
@@ -91,7 +91,7 @@ jobs:
path: llvm-project
persist-credentials: false
- name: Checkout llvm/llvm-test-suite
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
repository: llvm/llvm-test-suite
path: llvm-test-suite
diff --git a/.github/workflows/test-unprivileged-download-artifact.yml b/.github/workflows/test-unprivileged-download-artifact.yml
index 7da0b8363a093..21f513a905984 100644
--- a/.github/workflows/test-unprivileged-download-artifact.yml
+++ b/.github/workflows/test-unprivileged-download-artifact.yml
@@ -46,7 +46,7 @@ jobs:
needs: [ upload-test-artifact ]
steps:
- name: Checkout LLVM
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
sparse-checkout: |
diff --git a/.github/workflows/upload-release-artifact/action.yml b/.github/workflows/upload-release-artifact/action.yml
index dc15de78cc114..acede314cb6a4 100644
--- a/.github/workflows/upload-release-artifact/action.yml
+++ b/.github/workflows/upload-release-artifact/action.yml
@@ -79,7 +79,7 @@ runs:
id: provenance
# TODO(boomanaiden154): This is now a thin wrapper around actions/attest.
# We should eventually move over to that.
- uses: actions/attest-build-provenance at 0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+ uses: actions/attest-build-provenance at 4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
with:
subject-path: ${{ steps.download-artifact.outputs.download-path }}/*
@@ -103,7 +103,7 @@ runs:
*.jsonl
# Checkout the files used by this action.
- - uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ - uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
if: inputs.upload == 'true'
with:
persist-credentials: false
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 6508b30ac10d8..63c2a3b2f3412 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-26.04
steps:
- name: Fetch LLVM sources
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
fetch-depth: 0
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 22ab25c2110b9..7ae7446c4fbb8 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,9 +21,9 @@ jobs:
actions: read
steps:
- name: Checkout repository
- uses: actions/checkout at df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ uses: actions/checkout at d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Run zizmor
- uses: zizmorcore/zizmor-action at 3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+ uses: zizmorcore/zizmor-action at cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
More information about the llvm-commits
mailing list