declapract-typescript-ehmpathy 0.49.8 → 0.49.10

package/dist/practices/cicd-common/best-practice/.github/workflows/.test.yml

@@ -28,17 +28,17 @@ jobs:
     needs: [install, test-shards-omit]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0 # we need all commits to test:commits
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -51,15 +51,15 @@ jobs:
     needs: [install, test-shards-omit]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -75,18 +75,18 @@ jobs:
     needs: [install, test-shards-omit]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: set terraform version
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -99,15 +99,15 @@ jobs:
     needs: [install, test-shards-omit]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -120,15 +120,15 @@ jobs:
     needs: [install, test-shards-omit]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -147,7 +147,7 @@ jobs:
       acceptance-patterns: ${{ steps.acceptance.outputs.patterns }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           sparse-checkout: |
             jest.integration.shards.jsonc
@@ -188,15 +188,15 @@ jobs:
         shard: ${{ fromJson(needs.enshard.outputs.integration-matrix) }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -218,7 +218,7 @@ jobs:
 
       - name: get aws auth, if creds supplied
         if: ${{ inputs.creds-aws-role-arn }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn }}
           aws-region: ${{ inputs.creds-aws-region }}
@@ -272,15 +272,15 @@ jobs:
         shard: ${{ fromJson(needs.enshard.outputs.acceptance-matrix) }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: get node-modules from cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -302,7 +302,7 @@ jobs:
 
       - name: get aws auth, if creds supplied
         if: ${{ inputs.creds-aws-role-arn }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn }}
           aws-region: ${{ inputs.creds-aws-region }}

package/dist/practices/cicd-common/best-practice/.github/workflows/release.yml

@@ -11,14 +11,14 @@ jobs:
     steps:
       - name: get github token
         id: github-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         with:
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
           app-id: ${{ vars.RHELEASE_APP_ID }}
           private-key: ${{ secrets.RHELEASE_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           token: ${{ steps.github-token.outputs.token }} # enables git push with app token

package/dist/practices/cicd-common/best-practice/.github/workflows/review.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: test:pullreq:title
-        uses: amannn/action-semantic-pull-request@v5
+        uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

package/dist/practices/cicd-package/best-practice/.github/workflows/.publish-npm.yml

@@ -15,16 +15,16 @@ jobs:
     needs: [install]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           registry-url: "https://registry.npmjs.org/" # required to publish
           node-version-file: ".nvmrc"
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache
         with:
           path: ./node_modules

package/dist/practices/cicd-package/best-practice/.github/workflows/provision.yml

@@ -14,6 +14,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
   cancel-in-progress: true #  cancel workflows for non-latest commits
 
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
 jobs:
   github:
     uses: ./.github/workflows/.declastruct.yml

package/dist/practices/cicd-service/best-practice/.github/workflows/.deploy-sls.yml

@@ -42,21 +42,21 @@ jobs:
     needs: [install]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: configure aws credentials (oidc)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -71,21 +71,21 @@ jobs:
     needs: [install, deploy]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: configure aws credentials (oidc)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -107,7 +107,7 @@ jobs:
         env:
           PAGERDUTY_INTEGRATION_KEY: ${{ secrets.pagerduty-integration-key }}
         if: failure() && env.PAGERDUTY_INTEGRATION_KEY
-        uses: Entle/action-pagerduty-alert@0.2.0 # https://github.com/marketplace/actions/pagerduty-alert
+        uses: Entle/action-pagerduty-alert@e6ca54cd88948b8a50f5bb1071dfa5bdb149ce7e # 0.2.0 — https://github.com/marketplace/actions/pagerduty-alert
         with:
           pagerduty-integration-key: "${{ secrets.pagerduty-integration-key }}"
           pagerduty-dedup-key: github_workflow_failed
@@ -118,21 +118,21 @@ jobs:
     needs: [install, deploy]
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: configure aws credentials (oidc)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}

package/dist/practices/cicd-service/best-practice/.github/workflows/.sql-schema-control.yml

@@ -51,15 +51,15 @@ jobs:
       has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -67,7 +67,7 @@ jobs:
 
       - name: get aws auth
         if: ${{ inputs.creds-aws-role-arn-plan }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
           aws-region: ${{ inputs.creds-aws-region }}
@@ -112,15 +112,15 @@ jobs:
     if: ${{ inputs.allow-apply == true && needs.plan.outputs.has-changes-planned == 'true' }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ./node_modules
           key: ${{ needs.install.outputs.node-modules-cache-key }}
@@ -128,7 +128,7 @@ jobs:
 
       - name: get aws auth
         if: ${{ inputs.creds-aws-role-arn-apply }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}

package/dist/practices/cicd-service/best-practice/.github/workflows/.terraform.yml

@@ -44,17 +44,17 @@ jobs:
       has-changes-planned: ${{ steps.evaluate-plan.outputs.has-changes-planned }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: get aws auth
         if: ${{ inputs.creds-aws-role-arn-plan }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-plan }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: setup terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
 
       - name: terraform init
         run: terraform init
@@ -89,17 +89,17 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: get aws auth
         if: ${{ inputs.creds-aws-role-arn-apply }}
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn-apply }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: setup terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
 
       - name: terraform init
         run: terraform init

package/dist/practices/cicd-service/best-practice/.github/workflows/provision.yml

@@ -14,6 +14,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
   cancel-in-progress: true #  cancel workflows for non-latest commits
 
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
 jobs:
   aws-test-terraform:
     uses: ./.github/workflows/.terraform.yml