@@ -50,15 +50,15 @@ jobs:
5050
5151 steps :
5252 - name : Checkout code
53- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
53+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
5454
5555 - name : Set up Python 3.13
56- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
56+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
5757 with :
5858 python-version : " 3.13"
5959
6060 - name : Cache dependencies
61- uses : actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
61+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
6262 with :
6363 # ``.venv`` is deliberately NOT cached: its interpreter symlinks
6464 # point at the exact hosted-Python patch, so a patch bump (e.g.
@@ -198,10 +198,10 @@ jobs:
198198 timeout-minutes : 15
199199 steps :
200200 - name : Checkout code
201- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
201+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
202202
203203 - name : Set up Node.js 20
204- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
204+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
205205 with :
206206 node-version : " 20"
207207
@@ -228,11 +228,11 @@ jobs:
228228 timeout-minutes : 10
229229 steps :
230230 - name : Checkout code
231- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
231+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
232232
233233 # `claude plugin validate` ships in the Claude Code npm package.
234234 - name : Set up Node.js 20
235- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
235+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
236236 with :
237237 node-version : " 20"
238238
@@ -246,7 +246,7 @@ jobs:
246246 run : claude plugin validate . --strict
247247
248248 - name : Install uv
249- uses : astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
249+ uses : astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
250250
251251 # Runs OUTSIDE the source tree, the way a user's copy of the template does:
252252 # no experiments/, no tasks/, no coder_eval checkout on the path. `plan` is a
@@ -290,10 +290,10 @@ jobs:
290290 timeout-minutes : 5
291291 steps :
292292 - name : Checkout code
293- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
293+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
294294
295295 - name : Set up Python 3.13
296- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
296+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
297297 with :
298298 python-version : " 3.13"
299299
@@ -356,15 +356,15 @@ jobs:
356356
357357 steps :
358358 - name : Checkout code
359- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
359+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
360360
361361 - name : Set up Python 3.13
362- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
362+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
363363 with :
364364 python-version : " 3.13"
365365
366366 - name : Cache dependencies
367- uses : actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
367+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
368368 with :
369369 # ``.venv`` is deliberately excluded: tarring/untarring tens of
370370 # thousands of small wheel files on Windows is what was tripping
@@ -409,7 +409,7 @@ jobs:
409409 run : .venv/Scripts/pytest tests/ -v -m "not live and not lint"
410410
411411 - name : Set up Node.js 20
412- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
412+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
413413 with :
414414 node-version : " 20"
415415
@@ -500,23 +500,23 @@ jobs:
500500
501501 steps :
502502 - name : Checkout code
503- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
503+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
504504
505505 - name : Set up Python 3.13
506- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
506+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
507507 with :
508508 python-version : " 3.13"
509509
510510 - name : Set up Node.js 20
511- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
511+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
512512 with :
513513 node-version : " 20"
514514
515515 - name : Install Claude CLI
516516 run : npm install -g @anthropic-ai/claude-code
517517
518518 - name : Cache dependencies
519- uses : actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
519+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
520520 with :
521521 # ``.venv`` excluded: a hosted-Python patch bump orphans its
522522 # interpreter symlink (dangling ``.venv/bin/python`` -> exit 127).
@@ -670,15 +670,15 @@ jobs:
670670
671671 steps :
672672 - name : Checkout code
673- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
673+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
674674
675675 - name : Set up Python 3.13
676- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
676+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
677677 with :
678678 python-version : " 3.13"
679679
680680 - name : Set up Node.js 20
681- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
681+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
682682 with :
683683 node-version : " 20"
684684
@@ -689,7 +689,7 @@ jobs:
689689 # AgentConfig.isolation=true, so the SDK doesn't shell out to bwrap.
690690
691691 - name : Cache dependencies
692- uses : actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
692+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
693693 with :
694694 # ``.venv`` excluded: a hosted-Python patch bump orphans its
695695 # interpreter symlink (dangling ``.venv/bin/python`` -> exit 127).
@@ -838,10 +838,10 @@ jobs:
838838
839839 steps :
840840 - name : Checkout code
841- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
841+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
842842
843843 - name : Set up Python 3.13
844- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
844+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
845845 with :
846846 python-version : " 3.13"
847847
@@ -912,15 +912,15 @@ jobs:
912912
913913 steps :
914914 - name : Checkout code
915- uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
915+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
916916
917917 - name : Set up Python 3.13
918- uses : actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2 .0
918+ uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0 .0
919919 with :
920920 python-version : " 3.13"
921921
922922 - name : Set up Node.js 20
923- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
923+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
924924 with :
925925 node-version : " 20"
926926
@@ -988,13 +988,13 @@ jobs:
988988 # Skip on fork PRs where secrets aren't available (matches e2e-smoke).
989989 if : github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
990990 steps :
991- - uses : actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 .0.2
991+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 .0.1
992992
993993 # The composite action is agent-agnostic and does NOT install a coding-agent
994994 # runtime. The dogfood task uses the default claude-code agent, so provide
995995 # Node + the Claude CLI here (as e2e-smoke does), before invoking the action.
996996 - name : Set up Node.js 20
997- uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4 .0
997+ uses : actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0 .0
998998 with :
999999 node-version : " 20"
10001000 - name : Install Claude CLI
0 commit comments