http-api-tool 1.1.0__tar.gz → 1.1.2__tar.gz

http_api_tool-1.1.2/.aislop/config.yml

@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+
+ci:
+  failBelow: 100

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.editorconfig

@@ -13,11 +13,11 @@ indent_size = 4
 [*.{json,yaml,yml}]
 indent_size = 2
 
-[*.markdown]
+[*.{md,markdown}]
 max_line_length = 80
 
 [*.py]
-max_line_legth = 120
+max_line_length = 120
 
 [*.sh]
 max_line_length = 80

http_api_tool-1.1.2/.github/actionlint.yaml

@@ -0,0 +1,12 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2025 The Linux Foundation
+
+paths:
+  .github/workflows/build-test.yaml:
+    ignore:
+      # actionlint v1.17.0 rejects a bare '$/' (an action at the repository
+      # root), which GitHub accepts and runs. The ignore also skips input and
+      # output checks for those steps; drop it once a release with
+      # kjanat/actionlint#200 is pinned (actions-template#253).
+      - 'specifying action "\$/" in invalid format because path is missing'

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/build-test-release.yaml

@@ -32,7 +32,7 @@ jobs:
     timeout-minutes: 5
     steps:
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
 
@@ -45,7 +45,7 @@ jobs:
       - name: "Gather repository metadata"
         id: repo-metadata
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/repository-metadata-action@8d17362fe9a656744433f3dec7fc60f14b23f858  # v0.2.6
+        uses: lfreleng-actions/repository-metadata-action@847400e0d0b34cc88a572fa9575accd80401b796  # v0.3.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_summary: 'true'
@@ -64,7 +64,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -79,7 +79,7 @@ jobs:
       - name: 'Verify pushed tag'
         id: 'tag-validate'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/tag-validate-action@b2865c287f732486e12dfdfb75aef0692b024608  # v1.1.2
+        uses: lfreleng-actions/tag-validate-action@63470621b8ebc5c4fc86ebb616727dd0a7285dd9  # v1.1.7
         with:
           token: "${{ secrets.GITHUB_TOKEN }}"
           require_type: 'semver'
@@ -132,7 +132,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -144,7 +144,7 @@ jobs:
       - name: 'Build Python project'
         id: 'python-build'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-build-action@97cf36d2a5914c94761408545d154c983024de1d  # v2.0.0
+        uses: lfreleng-actions/python-build-action@1a1d011cd71e781f9b7896fc9a8c5653406a7758  # v2.1.0
         with:
           sigstore_sign: true
           attestations: true
@@ -163,7 +163,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -174,7 +174,7 @@ jobs:
 
       - name: 'Test Python project [PYTEST]'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-test-action@4129c285f63e4d004b9e615b881f44cd63ba5f45  # v1.2.0
+        uses: lfreleng-actions/python-test-action@88506b4bba4d2acd670ea3cc0bb6f976e0391d24  # v1.3.0
         with:
           python_version: "${{ matrix.python-version }}"
 
@@ -192,7 +192,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -203,7 +203,7 @@ jobs:
 
       - name: 'Audit Python project'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-audit-action@b0f486bd612f394d36e1cb7068a608525bcc9b09  # v0.4.0
+        uses: lfreleng-actions/python-audit-action@f823e631b562f7632730ab36ba0b59a724350d88  # v0.5.1
         with:
           python_version: "${{ matrix.python-version }}"
           permit_fail: "${{ vars.NO_BLOCK_AUDIT_FAIL == 'true' }}"
@@ -218,7 +218,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -230,7 +230,7 @@ jobs:
       - name: "Generate SBOM"
         id: sbom
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-sbom-action@60648e3351a48617d40f68ccb1f143e050f74c96  # v0.1.1
+        uses: lfreleng-actions/python-sbom-action@a849d7190403165d437f2b8d29bc17a4894728f7  # v0.1.3
         with:
           include_dev: "false"
           sbom_format: "both"
@@ -247,7 +247,7 @@ jobs:
 
       - name: "Security scan with Grype (SARIF)"
         # yamllint disable-line rule:line-length
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439  # v7.4.2
         id: grype-sarif
         # The first Grype scan should not abort the job on failure so that
         # subsequent steps can collect artefacts and display human-readable
@@ -261,7 +261,7 @@ jobs:
 
       - name: "Security scan with Grype (Text/Table)"
         # yamllint disable-line rule:line-length
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439  # v7.4.2
         id: grype-table
         if: always()
         with:
@@ -345,7 +345,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -370,7 +370,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -382,7 +382,7 @@ jobs:
       # Set up Docker Buildx
       - name: Set up Docker Buildx
         # yamllint disable-line rule:line-length
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
 
       # Login to GitHub Container Registry
       - name: Login to Container Registry
@@ -414,7 +414,7 @@ jobs:
       # Build and push image with comprehensive caching
       - name: Build and push Docker image
         # yamllint disable-line rule:line-length
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
         with:
           context: .
           file: ./docker/Containerfile
@@ -457,7 +457,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -495,7 +495,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -513,7 +513,7 @@ jobs:
 
       - name: 'Attach build artefacts to release'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/release-assets-action@22a6302f3d1775e4a192c45235cc7833a2781b12  # v0.1.1
+        uses: lfreleng-actions/release-assets-action@51e2955cf9aeab3731efd7cc4605aa2847e7d8e2  # v0.1.3
         with:
           asset_paths: '["${{ needs.python-build.outputs.artefact_path }}/**"]'
           release_tag: "${{ needs.tag-validate.outputs.tag }}"
@@ -535,7 +535,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       # yamllint disable-line rule:line-length
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -566,7 +566,7 @@ jobs:
         id: 'promote-release'
         if: steps.check-promoted.outputs.already_promoted == 'false'
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/draft-release-promote-action@072990900b99030363d81d4131c2bf2855f07df0  # v0.1.4
+        uses: lfreleng-actions/draft-release-promote-action@e420b392557c9b1eea642f0d54dec4ff39086d5f  # v0.1.5
         with:
           token: "${{ secrets.GITHUB_TOKEN }}"
           tag: "${{ needs.tag-validate.outputs.tag }}"

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/build-test.yaml

@@ -76,7 +76,7 @@ jobs:
     steps:
       # Harden the runner
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -87,12 +87,12 @@ jobs:
 
       # Set up Docker Buildx with caching
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Build Docker image with registry cache
       - name: Build Docker image
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./docker/Containerfile
@@ -130,14 +130,9 @@ jobs:
       contents: read
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       # Set up go-httpbin for testing
       - name: Setup go-httpbin HTTPS service
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         id: go-httpbin
         with:
           debug: 'true'
@@ -145,7 +140,7 @@ jobs:
 
       # Test 1: Basic GET request
       - name: Test Basic GET request
-        uses: ./
+        uses: $/
         with:
           url: 'https://${{ steps.go-httpbin.outputs.host-gateway-ip }}:8080/get'
           ca_bundle_path: '${{ steps.go-httpbin.outputs.ca-cert-path }}'
@@ -154,7 +149,7 @@ jobs:
 
       # Test 2: POST request with JSON
       - name: Test POST request with JSON
-        uses: ./
+        uses: $/
         with:
           url: 'https://${{ steps.go-httpbin.outputs.host-gateway-ip }}:8080/post'
           http_method: 'POST'
@@ -166,7 +161,7 @@ jobs:
 
       # Test 3: Custom headers
       - name: Test Custom headers
-        uses: ./
+        uses: $/
         with:
           url: 'https://${{ steps.go-httpbin.outputs.host-gateway-ip }}:8080/headers'
           request_headers: '{"X-Test-Header": "test-value", "X-API-Key": "secret123"}'
@@ -176,7 +171,7 @@ jobs:
 
       # Test 4: Error handling (404)
       - name: Test Error handling (404)
-        uses: ./
+        uses: $/
         with:
           url: 'https://${{ steps.go-httpbin.outputs.host-gateway-ip }}:8080/status/404'
           ca_bundle_path: '${{ steps.go-httpbin.outputs.ca-cert-path }}'
@@ -185,7 +180,7 @@ jobs:
 
       # Test 5: Error handling (500)
       - name: Test Error handling (500)
-        uses: ./
+        uses: $/
         with:
           url: 'https://${{ steps.go-httpbin.outputs.host-gateway-ip }}:8080/status/500'
           ca_bundle_path: '${{ steps.go-httpbin.outputs.ca-cert-path }}'
@@ -208,7 +203,7 @@ jobs:
     steps:
       # Harden the runner
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -219,7 +214,7 @@ jobs:
 
       # Set up Docker Buildx
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Login to GitHub Container Registry
       - name: Login to Container Registry
@@ -246,7 +241,7 @@ jobs:
 
       # Build and push image with comprehensive caching
       - name: Build and push Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./docker/Containerfile
@@ -290,7 +285,7 @@ jobs:
       GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -324,7 +319,7 @@ jobs:
       - name: 'Build Python project'
         id: python-build
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-build-action@97cf36d2a5914c94761408545d154c983024de1d # v2.0.0
+        uses: lfreleng-actions/python-build-action@1a1d011cd71e781f9b7896fc9a8c5653406a7758 # v2.1.0
 
   # Python tests with matrix strategy (after container pipeline)
   python-tests:
@@ -340,7 +335,7 @@ jobs:
     timeout-minutes: 12
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -373,7 +368,7 @@ jobs:
 
       - name: "Python tests [pytest] ${{ matrix.python-version }}"
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-test-action@4129c285f63e4d004b9e615b881f44cd63ba5f45 # v1.2.0
+        uses: lfreleng-actions/python-test-action@88506b4bba4d2acd670ea3cc0bb6f976e0391d24 # v1.3.0
         with:
           python_version: ${{ matrix.python-version }}
 
@@ -391,7 +386,7 @@ jobs:
     timeout-minutes: 10
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -424,7 +419,7 @@ jobs:
 
       - name: "Audit dependencies ${{ matrix.python-version }}"
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/python-audit-action@b0f486bd612f394d36e1cb7068a608525bcc9b09 # v0.4.0
+        uses: lfreleng-actions/python-audit-action@f823e631b562f7632730ab36ba0b59a724350d88 # v0.5.1
         with:
           python_version: "${{ matrix.python-version }}"
 
@@ -439,7 +434,7 @@ jobs:
     timeout-minutes: 15
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: 'audit'
 
@@ -471,7 +466,7 @@ jobs:
             uv-cli-${{ runner.os }}-
 
       - name: Install UV
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Install project dependencies
         run: |
@@ -488,7 +483,7 @@ jobs:
       # Start go-httpbin service for testing
       - name: Setup go-httpbin service
         id: go-httpbin
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         with:
           port: '8080'
           debug: 'true'
@@ -566,24 +561,20 @@ jobs:
     timeout-minutes: 10
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: 'audit'
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       # Start go-httpbin service for testing
       - name: Setup go-httpbin service
         id: go-httpbin
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         with:
           port: '8080'
           debug: 'true'
 
       - name: Test GitHub Action (local)
-        uses: ./
+        uses: $/
         with:
           url: '${{ steps.go-httpbin.outputs.service-url }}/get'
           service_name: 'HTTPBin Test Service'
@@ -593,7 +584,7 @@ jobs:
           ca_bundle_path: '${{ steps.go-httpbin.outputs.ca-cert-path }}'
 
       - name: Test GitHub Action with POST
-        uses: ./
+        uses: $/
         with:
           url: '${{ steps.go-httpbin.outputs.service-url }}/post'
           service_name: 'HTTPBin POST Test'
@@ -604,7 +595,7 @@ jobs:
           ca_bundle_path: '${{ steps.go-httpbin.outputs.ca-cert-path }}'
 
       - name: Test GitHub Action error handling
-        uses: ./
+        uses: $/
         continue-on-error: true
         with:
           url: 'https://localhost:9999/nonexistent'
@@ -627,18 +618,14 @@ jobs:
     timeout-minutes: 10
     steps:
       # Harden the runner used by this workflow
-      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: 'audit'
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       # Start go-httpbin service for testing
       - name: Setup go-httpbin service
         id: go-httpbin
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         with:
           port: '8080'
           debug: 'true'
@@ -669,7 +656,7 @@ jobs:
           STEPS_GO_HTTPBIN_OUTPUTS_SERVICE_URL: ${{ steps.go-httpbin.outputs.service-url }}
 
       - name: Test uvx deployment with host URL
-        uses: ./
+        uses: $/
         with:
           deploy: 'uvx'
           url: '${{ steps.test-urls.outputs.host-url }}/get'
@@ -686,7 +673,7 @@ jobs:
           echo "UVX runs on the host, so it can access services via loopback interface"
 
       - name: Test docker deployment with gateway URL
-        uses: ./
+        uses: $/
         with:
           deploy: 'docker'
           url: '${{ steps.test-urls.outputs.gateway-url }}/get'
@@ -704,7 +691,7 @@ jobs:
 
 
       - name: Test uvx with POST request
-        uses: ./
+        uses: $/
         with:
           deploy: 'uvx'
           url: '${{ steps.test-urls.outputs.host-url }}/post'
@@ -743,25 +730,21 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       # Start go-httpbin service for testing
       - name: Setup go-httpbin service
         id: go-httpbin
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         with:
           port: '8080'
           debug: 'true'
 
       # Test Docker integration via GitHub Action (no Docker CLI dependency)
       - name: Test Docker integration via GitHub Action
-        uses: ./
+        uses: $/
         with:
           url: '${{ steps.go-httpbin.outputs.service-url }}/get'
           service_name: 'Docker Integration Test (PR)'
@@ -772,7 +755,7 @@ jobs:
 
       # Test additional Docker integration scenarios via GitHub Action
       - name: Test Docker integration with POST
-        uses: ./
+        uses: $/
         with:
           url: '${{ steps.go-httpbin.outputs.service-url }}/post'
           service_name: 'Docker Integration POST Test (PR)'
@@ -785,7 +768,7 @@ jobs:
 
       # Test Docker integration with custom headers
       - name: Test Docker integration with headers
-        uses: ./
+        uses: $/
         with:
           url: '${{ steps.go-httpbin.outputs.service-url }}/headers'
           service_name: 'Docker Integration Headers Test (PR)'
@@ -814,7 +797,7 @@ jobs:
     steps:
       # Harden the runner used by this workflow
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -824,7 +807,7 @@ jobs:
 
       # Set up Docker Buildx
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Login to Container Registry
       - name: Login to Container Registry
@@ -846,7 +829,7 @@ jobs:
       # Start go-httpbin service for testing
       - name: Setup go-httpbin service
         id: go-httpbin
-        uses: lfreleng-actions/go-httpbin-action@8b66d1d684264a26f4b087c94485aeb2be45cea7 # v0.1.5
+        uses: lfreleng-actions/go-httpbin-action@b0fcc716270b4975172449a293173e679773d17e # v0.1.6
         with:
           port: '8080'
           debug: 'true'
@@ -889,7 +872,7 @@ jobs:
     steps:
       # Harden the runner
       - name: Harden Runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -922,7 +905,7 @@ jobs:
 
       # Install UV
       - name: Install UV
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       # Install project dependencies with dev extras (includes bandit)
       - name: Install project dependencies

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/clear-action-cache.yaml

@@ -51,7 +51,7 @@ jobs:
     permissions:
       actions: write  # list and delete repository Actions caches
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@007258a132e4ba5358a20a5c0a902fa04de3a045  # v0.0.4
+    uses: lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml@42ee0a60963eede4169a7347f62da102bfc3b9b5  # v0.4.0
     with:
       key_pattern: ${{ inputs.key_pattern }}
       ref_filter: ${{ inputs.ref_filter }}

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
   scan:
     name: 'Audit Repository'
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-python-codeql.yaml@f7aae218f1fa0257e3dcd19f5c7d3f88f482f266 # v0.10.1
+    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-python-codeql.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091 # v0.10.3
     permissions:
       security-events: write  # Upload CodeQL results to code-scanning
       packages: read  # Fetch internal or private CodeQL packs

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/openssf-scorecard.yaml

@@ -28,7 +28,9 @@ jobs:
   openssf-scorecard:
     name: "OpenSSF Scorecard"
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml@f7aae218f1fa0257e3dcd19f5c7d3f88f482f266  # v0.10.1
+    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091  # v0.10.3
+    # Scorecard uses no cache; deny writes under branch_protection_rule
+    cache-mode: read
     permissions:
       contents: read  # Read repository contents (checkout, etc.)
       # yamllint disable-line rule:line-length

{http_api_tool-1.1.0 → http_api_tool-1.1.2}/.github/workflows/release-drafter.yaml

@@ -28,14 +28,14 @@ jobs:
       # organisation's .github repository and publish it as
       # $CONNECTION_ALLOW_LIST for the harden-runner step below.
       # yamllint disable-line rule:line-length
-      - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
+      - uses: lfreleng-actions/harden-runner-block-action@a32eb064a1188f6b0f15d2c0c0381efe54b0dd22  # v0.12.2
         with:
           config: '@18d9c4446bea555d0783e850f6d295f844fe8f67'  # v0.1.1
 
       # Harden the runner with the just-loaded allow-list.
       - name: 'Harden runner (block)'
         # yamllint disable-line rule:line-length
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40  # v2.20.1
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: 'block'
           allowed-endpoints: >