dfetch 0.14.2__tar.gz → 0.14.4__tar.gz

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -49,14 +49,19 @@ jobs:
             rekor.sigstore.dev:443
             tuf-repo-cdn.sigstore.dev:443
             *.blob.core.windows.net:443
+            ziglang.org:443
+            dependencywalker.com:443
+            ghcr.io:443
+            pkg-containers.githubusercontent.com:443
+            formulae.brew.sh:443
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0  # Fetches all history and tags
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
           cache: 'pip'
@@ -67,7 +72,7 @@ jobs:
 
       - name: Set up Ruby
         if: ${{ matrix.platform != 'windows-latest' }}
-        uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af  #v1.313.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b  #v1.321.0
         with:
           ruby-version: 3.3 # See also devcontainer
 
@@ -99,7 +104,7 @@ jobs:
       - name: Restore cache for clcache
         id: clcache-restore
         if: ${{ matrix.platform == 'windows-latest' }}
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ github.workspace }}\.clcache
           key: ${{ github.job }}-${{ matrix.platform }}-${{ github.ref_name }}-${{ hashFiles('pyproject.toml') }}
@@ -140,7 +145,7 @@ jobs:
 
       - name: Save cache for clcache
         if: ${{ always() && matrix.platform == 'windows-latest' && steps.clcache-restore.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ github.workspace }}\.clcache
           key: ${{ steps.clcache-restore.outputs.cache-primary-key }}
@@ -152,7 +157,7 @@ jobs:
           SBOM=$(find build/dfetch-package -name '*.cdx.json' -maxdepth 1 | head -1)
           echo "path=$SBOM" >> "$GITHUB_OUTPUT"
       - name: Attest binary packages with SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             build/dfetch-package/*.deb
@@ -175,7 +180,7 @@ jobs:
               --cert-oidc-issuer https://token.actions.githubusercontent.com
           done
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             build/dfetch-package/*.deb
@@ -215,7 +220,7 @@ jobs:
             }' > vsa-predicate.json
       - name: Attest build artifacts with VSA
         if: steps.verify-source.outcome == 'success'
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             build/dfetch-package/*.deb
@@ -237,7 +242,7 @@ jobs:
 
       - name: Upload installer to release
         if: ${{ inputs.release_id }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2.5.0
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2.5.0
         with:
           tag_name: ${{ inputs.release_id }}
           files: |
@@ -335,7 +340,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: block
         allowed-endpoints: >+
@@ -352,12 +357,12 @@ jobs:
           *.blob.core.windows.net:443
 
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
         fetch-depth: 0  # Fetches all history and tags
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.13'
         cache: 'pip'
@@ -374,7 +379,7 @@ jobs:
         SBOM=$(find dist -name '*.cdx.json' -maxdepth 1 | head -1)
         echo "path=$SBOM" >> "$GITHUB_OUTPUT"
     - name: Attest Python packages with SBOM
-      uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
       with:
         subject-path: |
           dist/*.whl
@@ -395,7 +400,7 @@ jobs:
             --cert-oidc-issuer https://token.actions.githubusercontent.com
         done
     - name: Attest Python build provenance
-      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-path: |
           dist/*.whl
@@ -434,7 +439,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Upload artifacts to release
-      uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2.5.0
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2.5.0
       with:
         tag_name: ${{ inputs.release_id }}
         files: dist/*

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: block
         allowed-endpoints: >+
@@ -44,7 +44,7 @@ jobs:
           release-assets.githubusercontent.com:443
 
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -26,7 +26,7 @@ jobs:
             github.com:443
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: 'Dependency Review'

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/devcontainer.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -48,12 +48,12 @@ jobs:
             storage.googleapis.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Cache Docker layers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: /tmp/.buildx-cache
           key: devcontainer-${{ runner.os }}-${{ github.sha }}
@@ -61,7 +61,7 @@ jobs:
             devcontainer-${{ runner.os }}-
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build DevContainer image
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/docs.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: block
         allowed-endpoints: >+
@@ -31,13 +31,13 @@ jobs:
           plantuml.com:443
           www.plantuml.com:80
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
 
     - name: Install Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.13'
 
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -65,12 +65,12 @@ jobs:
             plantuml.com:443
             www.plantuml.com:80
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
 
@@ -97,7 +97,7 @@ jobs:
       contents: write
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -119,13 +119,13 @@ jobs:
             security.ubuntu.com:443
             www.plantuml.com:80
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
@@ -150,7 +150,7 @@ jobs:
 
       - name: Upload PDF to release
         if: ${{ inputs.release_id }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2.5.0
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2.5.0
         with:
           tag_name: ${{ inputs.release_id }}
           files: doc/_build/latex/dfetch-*.pdf

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/python-publish.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
       with:
         egress-policy: block
         allowed-endpoints: >+
@@ -39,12 +39,12 @@ jobs:
           tuf-repo-cdn.sigstore.dev:443
           api.osv.dev:443
 
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
         fetch-depth: 0  # Fetches all history and tags
     - name: Set up Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.x'
     - name: Install dependencies
@@ -76,7 +76,7 @@ jobs:
         SBOM=$(find dist-sbom -name '*.cdx.json' -maxdepth 1 | head -1)
         echo "path=$SBOM" >> "$GITHUB_OUTPUT"
     - name: Attest Python distribution with SBOM
-      uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
       with:
         subject-path: 'dist/*.whl,dist/*.tar.gz'
         predicate-type: 'https://cyclonedx.org/bom'
@@ -87,7 +87,7 @@ jobs:
         name: python-sbom
         path: dist-sbom/
     - name: Attest OSCAL build provenance
-      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+      uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-path: dist-oscal/dfetch.component-definition.json
     - name: Store the OSCAL Component Definition
@@ -116,7 +116,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
@@ -145,7 +145,7 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1
       with:
         skip-existing: true
     - name: Download SBOM
@@ -159,7 +159,7 @@ jobs:
         name: oscal-component-definition
         path: dist-oscal/
     - name: Upload SBOM and OSCAL to GitHub Release
-      uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2.5.0
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2.5.0
       with:
         tag_name: ${{ github.event.release.tag_name }}
         files: |

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       release_id: ${{ steps.release_info.outputs.tag }}
 
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -29,10 +29,10 @@ jobs:
             api.github.com:443
             release-assets.githubusercontent.com:443
             uploads.github.com:443
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true # Required for preparing & creating releases
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
@@ -57,7 +57,7 @@ jobs:
 
       - name: Update latest tag
         if: ${{ steps.release_info.outputs.tag == 'latest' }}
-        uses: EndBug/latest-tag@16bb0ae5bf2834bce7de88eb1ecdf479d4ed8753
+        uses: EndBug/latest-tag@b2e1a0a2b6990399c5b3bf109e032a78ae82dd41
         with:
           ref: latest
           description: Last state in main
@@ -84,7 +84,7 @@ jobs:
 
       - name: Create release
         if: ${{ steps.release_info.outputs.tag }}
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2.5.0
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2.5.0
         with:
           tag_name: ${{ steps.release_info.outputs.tag }}
           name: ${{ steps.release_info.outputs.tag }}

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/run.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -28,8 +28,18 @@ jobs:
             community.chocolatey.org:443
             community.chocolatey.org:80
             packages.chocolatey.org:443
-
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            cygwin.com:443
+            mirrors.kernel.org:443
+            *.c.lencr.org:443
+            *.c.lencr.org:80
+            *.dl.sourceforge.net:443
+            downloads.sourceforge.net:443
+            sourceforge.net:443
+            svn.code.sf.net:443
+            svn.code.sf.net:3690
+            ziglang.org:443
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -130,9 +140,11 @@ jobs:
             allowed-endpoints: >+
               _https._tcp.packages.microsoft.com:443
               api.github.com:443
+              *.dl.sourceforge.net:443
               community.chocolatey.org:443
               community.chocolatey.org:80
               dc.services.visualstudio.com:443
+              downloads.sourceforge.net:443
               fe2cr.update.microsoft.com:443
               files.pythonhosted.org:443
               github.com:443
@@ -141,6 +153,7 @@ jobs:
               packages.microsoft.com:443
               pypi.org:443
               release-assets.githubusercontent.com:443
+              sourceforge.net:443
               ziglang.org:443
     runs-on: ${{ matrix.platform }}
     permissions:
@@ -149,17 +162,17 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: ${{ matrix.allowed-endpoints }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/scorecard.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -47,12 +47,12 @@ jobs:
             api.scorecard.dev:443
 
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/source-provenance.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -36,7 +36,7 @@ jobs:
             *.blob.core.windows.net:443
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: true
 
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -69,7 +69,7 @@ jobs:
             *.blob.core.windows.net:443
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -77,7 +77,7 @@ jobs:
         run: git archive HEAD --format=tar.gz -o dfetch-source.tar.gz
 
       - name: Attest source provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dfetch-source.tar.gz
 

{dfetch-0.14.2 → dfetch-0.14.4}/.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
       id-token: write
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           # dfetch.invalid and giiiiiidhub.com are intentionally invalid test
@@ -60,12 +60,12 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             *.blob.core.windows.net:443
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.13'
 
@@ -147,7 +147,7 @@ jobs:
 
       - name: Attest test results
         if: steps.download-source.outcome == 'success'
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dfetch-source.tar.gz
           predicate-type: https://in-toto.io/attestation/test-result/v0.1

dfetch-0.14.4/.github/workflows/winget-publish.yml

@@ -0,0 +1,70 @@
+name: Publish to WinGet
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      release-tag:
+        description: 'Release tag to publish (e.g. 0.14.2)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to WinGet
+    # For releases: skip the rolling 'latest' tag on main.
+    # For manual dispatch: always run (the operator knows what they're doing).
+    if: >-
+      github.event_name != 'release' ||
+      github.event.release.tag_name != 'latest'
+    runs-on: ubuntu-latest
+    concurrency:
+      group: winget-publish-${{ github.event.release.tag_name || inputs.release-tag }}
+      cancel-in-progress: true
+
+    environment:
+      name: winget
+      url: https://github.com/microsoft/winget-pkgs
+
+    steps:
+      - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >+
+            github.com:443
+            api.github.com:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            uploads.github.com:443
+            index.crates.io:443
+            static.crates.io:443
+
+      - name: Publish to WinGet
+        # Requires WINGET_TOKEN secret in the 'winget' environment.
+        #
+        # NOTE: fine-grained PATs are NOT supported by this action — use a
+        # classic PAT only. See https://github.com/vedantmgoyal9/winget-releaser/issues/172
+        #
+        # Setup — create a classic PAT:
+        #   1. GitHub → Settings → Developer settings → Personal access tokens
+        #      → Tokens (classic) → Generate new token
+        #   2. Select scope: public_repo
+        #   3. The PAT must belong to a GitHub account that has write access to
+        #      dfetch-org/winget-pkgs (i.e. an org member with Triage or higher,
+        #      or the org owner).
+        #   4. Store the token as secret WINGET_TOKEN in:
+        #      Repo → Settings → Environments → winget → Environment secrets
+        #
+        # Prerequisites: dfetch-org/winget-pkgs must exist as a fork of
+        # microsoft/winget-pkgs (create it once manually on GitHub).
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        with:
+          identifier: DFetch-org.DFetch
+          release-tag: ${{ github.event.release.tag_name || inputs.release-tag }}
+          token: ${{ secrets.WINGET_TOKEN }}
+          fork-user: dfetch-org

{dfetch-0.14.2 → dfetch-0.14.4}/AGENTS.md

@@ -72,7 +72,7 @@ dfetch.log          ← logging (lowest layer)
 - **`dfetch/commands/`** — One file per CLI command (e.g., `update.py`, `check.py`); all inherit from `command.py`'s abstract `Command` base
 - **`dfetch/manifest/`** — YAML manifest loading/writing with `strictyaml` schema validation; `manifest.py` is the main handler
 - **`dfetch/project/`** — Abstract `Subproject`/`Superproject` classes with concrete Git, SVN, and Archive implementations; factory functions `create_sub_project()` and `create_super_project()` are the main entry points
-- **`dfetch/vcs/`** — Low-level VCS operations: `git.py`, `svn.py`, `archive.py` (with hash verification in `integrity_hash.py`), and `patch.py`
+- **`dfetch/vcs/`** — Low-level VCS operations: `git.py`, `svn.py`, `archive.py` (with hash verification in `integrity_hash.py`), and `patch.py`; Git submodule handling (enumeration, `.gitmodules` parsing, orphan-gitlink hygiene, `src`/`ignore` filtering) lives in `git_submodule.py`
 - **`dfetch/reporting/`** — Output formatters; check results can be emitted as stdout, Jenkins JSON, SARIF, or Code Climate format; SBOM output uses CycloneDX format
 - **`dfetch/terminal/`** — Terminal UI components (interactive prompts, tree browser, ANSI colors)