Merge branch 'main' into dilan/iac-windows-extraction

Author: aegilops

.github/workflows/copilot-setup-steps.yml

@@ -31,7 +31,7 @@ jobs:
     # starts. If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           submodules: true
 

.github/workflows/coverage.yml

@@ -22,7 +22,7 @@ jobs:
           ./scripts/create-coverage.py report --markdown > $GITHUB_STEP_SUMMARY
 
       - name: "Upload Coverage Report"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: coverage-report
           path: coverage.csv

.github/workflows/labeler.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@v5
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/publish.yml

@@ -57,7 +57,8 @@ jobs:
           submodules: true
 
       - name: "Set up Rust"
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@0c3131df9e5407c0c36352032d04af846dbe0fb7 # nightly
+        if: ${{ matrix.os != 'windows-latest' }}
 
       - name: "Build Extractor (Linux/macOS)"
         if: ${{ matrix.os != 'windows-latest' }}
@@ -73,7 +74,7 @@ jobs:
         run: .\scripts\create-extractor-pack.ps1
 
       - name: "Upload bundle artifact"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: "extractor-bundle-${{ matrix.os }}"
           path: "./extractor-pack"
@@ -91,7 +92,7 @@ jobs:
           submodules: true
 
       - name: "Download all artifacts"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           path: "./extractor-pack"
           merge-multiple: true

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: "Patch Release Me"
-        uses: 42ByteLabs/patch-release-me@1a840ec5f538188590b75b19e1c300c7d036bcc8    # 0.6.2
+        uses: 42ByteLabs/patch-release-me@840ec9cfe2170a5704f77ba721bddeb4eb52317a    # 0.6.3
         with:
           mode: ${{ github.event.inputs.bump }}
 

.github/workflows/version.yml

@@ -20,7 +20,7 @@ jobs:
 
       - name: Get Token
         id: get_workflow_token
-        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         with:
           app-id: ${{ secrets.CODEQL_FIELD_BOT_ID }}
           private-key: ${{ secrets.CODEQL_FIELD_BOT_KEY }}

docs/workflows.md

@@ -51,11 +51,14 @@ jobs:
       - name: Initialize and Analyze IaC
         id: codeql_iac
         uses: advanced-security/codeql-extractor-iac@v0.5.1
-
-      - name: Upload SARIF file
+        # Uncomment if you want to show the tool name as CodeQL instead of CodeQL-IaC (NOTE: this may conflict with Default Setup)
+        #with:
+        #  rewrite-sarif-tool-name: false
+      
+      - name: "Upload SARIF file"
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: ${{ steps.codeql_iac.outputs.sarif }}
+          sarif_file: ${{ steps.codeql_iac.outputs.sarif-results }}
 ```
 
 ## CodeQL CLI