Merge pull request #2715 from theupdateframework/dependabot/github_ac…

…tions/action-dependencies-3c42254ab4

build(deps): bump the action-dependencies group with 3 updates

.github/workflows/_test.yml

@@ -11,7 +11,7 @@ jobs:
 
  steps:
  - name: Checkout TUF
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: Set up Python (oldest supported version)
  uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
@@ -48,7 +48,7 @@ jobs:
 
  steps:
  - name: Checkout TUF
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: Set up Python ${{ matrix.python-version }}
  uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0

.github/workflows/_test_sslib_main.yml

@@ -11,7 +11,7 @@ jobs:
 
  steps:
  - name: Checkout TUF
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: Set up Python
  uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0

.github/workflows/cd.yml

@@ -18,7 +18,7 @@ jobs:
  needs: test
  steps:
  - name: Checkout release tag
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  with:
  ref: ${{ github.event.workflow_run.head_branch }}
 
@@ -36,7 +36,7 @@ jobs:
  awk "/## $GITHUB_REF_NAME/{flag=1; next} /## v/{flag=0} flag" docs/CHANGELOG.md > changelog
 
  - name: Store build artifacts
- uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+ uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
  with:
  name: build-artifacts
  path: |
@@ -99,7 +99,7 @@ jobs:
  - name: Publish binary wheel and source tarball on PyPI
  # Only attempt pypi upload in upstream repository
  if: github.repository == 'theupdateframework/python-tuf'
- uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b # v1.10.2
+ uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3
 
  - name: Finalize GitHub release
  uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ jobs:
 
  steps:
  - name: Checkout repository
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: Initialize CodeQL
  uses: github/codeql-action/init@v3 # unpinned since this is not security critical

.github/workflows/conformance.yml

@@ -14,7 +14,7 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: Checkout conformance client
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: Run test suite
  uses: theupdateframework/tuf-conformance@f4acd16d0ea49a6fd5cc4558084b578c6fc7d6cd # v2.0.0

.github/workflows/dependency-review.yml

@@ -16,6 +16,6 @@ jobs:
  runs-on: ubuntu-latest
  steps:
  - name: 'Checkout Repository'
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  - name: 'Dependency Review'
  uses: actions/dependency-review-action@v4 # unpinned since this is not security critical

.github/workflows/scorecards.yml

@@ -22,7 +22,7 @@ jobs:
 
  steps:
  - name: "Checkout code"
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
  - name: "Run analysis"
  uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0

.github/workflows/specification-version-check.yml

@@ -14,7 +14,7 @@ jobs:
  outputs:
  version: ${{ steps.get-version.outputs.version }}
  steps:
- - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+ - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
  - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: "3.x"