From 07ac50bc4aee49cdbfaf70cf2134a7b7a1317559 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 15 Apr 2026 12:52:29 +0000 Subject: [PATCH 1/2] Initial plan From dcfe1b3e949e01114d59d0328ccf6cba64449ec7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 15 Apr 2026 13:11:20 +0000 Subject: [PATCH 2/2] chore(ci): pin GitHub Actions to commit SHAs Agent-Logs-Url: https://github.com/CycloneDX/cyclonedx-webpack-plugin/sessions/bc0d298a-9544-4b01-89b7-edb96fc42487 Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com> --- .github/workflows/nodejs.yml | 38 +++++++++++++++++------------------ .github/workflows/release.yml | 14 ++++++------- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml index ef2aa804..253159d9 100644 --- a/.github/workflows/nodejs.yml +++ b/.github/workflows/nodejs.yml @@ -33,10 +33,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -46,7 +46,7 @@ jobs: run: npm run build-dev - name: artifact build result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: dist path: dist @@ -59,10 +59,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -84,12 +84,12 @@ jobs: - name: Annotate Code if: ${{ failure() || success() }} # see https://github.com/DerLev/eslint-annotations - uses: DerLev/eslint-annotations@v2 + uses: DerLev/eslint-annotations@a79ea65c1b45a649c48bcc6efc0103b6fd2e4c5f # v2 with: eslint-report: ${{ env.REPORTS_DIR }}/eslint.json - name: artifact eslint result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 if: ${{ failure() }} with: name: ${{ env.STANDARD_REPORTS_ARTIFACT }} @@ -103,10 +103,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -148,10 +148,10 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js ${{ matrix.node-version }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ matrix.node-version }} package-manager-cache: false @@ -173,7 +173,7 @@ jobs: npm i --ignore-scripts --loglevel=silly --no-save $dev_requirements - name: fetch build artifact # see https://github.com/actions/download-artifact - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: dist path: dist @@ -182,7 +182,7 @@ jobs: - name: artifact npm errors if: ${{ failure() }} # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: 'npm-errors_${{ matrix.os }}_node${{ matrix.node-version }}' path: '/home/runner/.npm/_logs/*.log' @@ -202,7 +202,7 @@ jobs: - name: artifact test reports if: ${{ ! cancelled() }} # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: '${{ env.TESTS_REPORTS_ARTIFACT }}_${{ matrix.os }}_node${{ matrix.node-version }}' path: ${{ env.REPORTS_DIR }} @@ -222,16 +222,16 @@ jobs: steps: - name: Checkout # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false - name: fetch build artifact # see https://github.com/actions/download-artifact - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: dist path: dist @@ -251,7 +251,7 @@ jobs: steps: - name: fetch test artifacts # see https://github.com/actions/download-artifact - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: pattern: '${{ env.TESTS_REPORTS_ARTIFACT }}_*' merge-multiple: true @@ -262,7 +262,7 @@ jobs: ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets if: ${{ env.CODACY_PROJECT_TOKEN != '' }} # see https://github.com/codacy/codacy-coverage-reporter-action - uses: codacy/codacy-coverage-reporter-action@v1 + uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1 with: project-token: ${{ env.CODACY_PROJECT_TOKEN }} coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*/* diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0653ea25..7e1f30b7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,7 +51,7 @@ jobs: steps: - name: Checkout code # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Configure Git # needed for push back of changes run: | @@ -60,7 +60,7 @@ jobs: git config --local user.name "${GITHUB_ACTOR}" - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -96,12 +96,12 @@ jobs: steps: - name: Checkout code # see https://github.com/actions/checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: ${{ needs.bump.outputs.version }} - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }} # see https://github.com/actions/setup-node - uses: actions/setup-node@v6 + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: ${{ env.NODE_ACTIVE_LTS }} package-manager-cache: false @@ -134,7 +134,7 @@ jobs: npm pack --pack-destination "$PACKED_DIR" - name: artifact release result # see https://github.com/actions/upload-artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: ${{ env.PACKED_ARTIFACT }} path: ${{ env.PACKED_DIR }}/ @@ -154,14 +154,14 @@ jobs: steps: - name: fetch release result # see https://github.com/actions/download-artifact - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: ${{ env.PACKED_ARTIFACT }} path: ${{ env.ASSETS_DIR }} - name: Create Release id: release # see https://github.com/softprops/action-gh-release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: