Fix remaining CI workflow failures

Author: Ibraheem Olasupo

.github/workflows/developer-enablement.yml

@@ -39,7 +39,8 @@ jobs:
         run: make developer-enablement-full
 
       - name: Upload developer enablement artifacts
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+        # actions/upload-artifact v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: developer-enablement
           path: |
@@ -48,4 +49,3 @@ jobs:
             reports/security/pull-request-security-report.md
             reports/security/security-tooling-readiness-report.md
           retention-days: 14
-

.github/workflows/integration-contract.yml

@@ -18,10 +18,12 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        # actions/checkout v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        # actions/setup-python v5.6.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.12"
 
@@ -57,7 +59,8 @@ jobs:
         run: make integration-report
 
       - name: Upload export bundle
-        uses: actions/upload-artifact@v4
+        # actions/upload-artifact v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: product-security-export-bundle
           path: outputs/security/integration/

.github/workflows/security-champions.yml

@@ -51,7 +51,8 @@ jobs:
         run: make developer-docs-validate
 
       - name: Upload Security Champions artifacts
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+        # actions/upload-artifact v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: security-champions
           path: |

.github/workflows/security-evidence.yml

@@ -42,7 +42,8 @@ jobs:
         run: make evidence-full
 
       - name: Upload evidence artefacts
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
+        # actions/upload-artifact v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: security-evidence
           path: |

outputs/portfolio/README 2.md

@@ -21,7 +21,7 @@
     },
     {
       "path": "outputs/security/appsec/evidence-manifest.json",
-      "sha256": "a927456454ee8bf27437d82e367fc3f7afdaa24d5655bc94eadb3097c5569947",
+      "sha256": "5fabe9b4f87bed5f27d33f3d0d1a352bf6b972a3eb5ae6e9f5656a7afcc810ba",
       "size_bytes": 3564,
       "type": "evidence"
     },
@@ -33,25 +33,25 @@
     },
     {
       "path": "outputs/security/findings/evidence-manifest.json",
-      "sha256": "61118ca2d0e26e8e53f45505fc49a7b1f9b527694046c359e3d73db9bbc3f0d4",
+      "sha256": "fdc17e894e9f4584c0e3aabcd46ba0847bda77258b7bf34ccd0c31b8b94a727a",
       "size_bytes": 7093,
       "type": "evidence"
     },
     {
       "path": "outputs/security/release/evidence-manifest.json",
-      "sha256": "d919f4f1b20a7efc3992107e51ee89755ee671d5e4aead77d99eb819630b3492",
+      "sha256": "1f91e58f8f4858e4608b1e3be80d4e4fb63d0109d16c0e0f8ee0786256fbfaae",
       "size_bytes": 3296,
       "type": "evidence"
     },
     {
       "path": "outputs/security/lifecycle/evidence-manifest.json",
-      "sha256": "b3d1c5dfbe875b3ac53848099cc3ac9c7e671d7d51f8db448688206669eb36cf",
+      "sha256": "c03b0ae99cd224ef61ec5d3c12a31c680cb6fb3c5128e9eb30c697ae355092b9",
       "size_bytes": 5829,
       "type": "evidence"
     },
     {
       "path": "outputs/security/evidence/evidence-manifest.json",
-      "sha256": "398b5f65bafe728498d2773c01ee454d3ad689b030f3523421e138d1e4fc8e14",
+      "sha256": "11faf87b2dc3c9167c149752548d51b4339217e59a5427e44ec5a204fd5b249d",
       "size_bytes": 6303,
       "type": "evidence"
     },
@@ -63,7 +63,7 @@
     },
     {
       "path": "outputs/security/integration/integration-manifest.json",
-      "sha256": "ec0d8c77e33f91d4450a301396b43ef460effc882924b2a7c8a3f85f0a90dcc1",
+      "sha256": "fe56e9a11461bd6ea2a1483e3b0e984c5af6852d5f2510b6206e0ebc8779fe6c",
       "size_bytes": 4620,
       "type": "evidence"
     }

outputs/portfolio/evidence-index 2.json

@@ -14,7 +14,7 @@
   ],
   "git": {
     "branch": "main",
-    "commit": "b737069e8f88",
+    "commit": "c1af18199c2e",
     "dirty": "true"
   },
   "input_files": {
@@ -38,7 +38,7 @@
   "output_files": {
     "evidence-index.json": {
       "path": "outputs/security/portfolio/evidence-index.json",
-      "sha256": "17deecd831176afd0c9675b9d84e53ae71068fffccbac2aa390f1f1c1d729475",
+      "sha256": "baeaedb303a4fc1a5249f586ae79a8b8d568a0f7d9519315d2c1a32091a48813",
       "size_bytes": 2487
     },
     "milestone-completion.json": {
@@ -58,12 +58,12 @@
     },
     "portfolio-summary.json": {
       "path": "outputs/security/portfolio/portfolio-summary.json",
-      "sha256": "3453aad6d094b39eca21c7030519cc54858f2c5713f50bd549b20b9d38c4728b",
+      "sha256": "9608493fe01a2055e33f3b27d444223def8a56c9f5ac695aaea635f37f1047ff",
       "size_bytes": 930
     },
     "report-index.json": {
       "path": "outputs/security/portfolio/report-index.json",
-      "sha256": "bda451e234978052dd5087032bdb07f908d9805f1ac62db8e38c1b487800e9b5",
+      "sha256": "9974c2834c1bdc7fb5a02033e77adfc7ddc9e9d02f8b368ba64fdfead5c191c7",
       "size_bytes": 3239
     },
     "security-capability-matrix.json": {
@@ -72,6 +72,6 @@
       "size_bytes": 7933
     }
   },
-  "portfolio_id": "PF-3e95bc47860adfe7",
+  "portfolio_id": "PF-2d2dc093d22ce96b",
   "schema_version": "1.0"
 }