Update deps

.github/workflows/cleanup.yml

@@ -14,24 +14,24 @@ jobs:
     runs-on: 'ubuntu-latest'
 
     steps:
-    - uses: 'actions/checkout@v4'
-
-    - uses: 'google-github-actions/auth@v2'
-      with:
-        workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
-        service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
-
-    - uses: 'google-github-actions/setup-gcloud@v2'
-
-    - name: Delete services
-      run: |-
-        gcloud config set core/project "${{ vars.PROJECT_ID }}"
-
-        # List and delete all versions that were deployed 30 minutes ago or
-        # earlier. The date math here is a little weird, but we're looking for
-        # deployments "earlier than" 30 minutes ago, so it's less than since
-        # time increases.
-        (IFS=$'\n'; for NAME in $(gcloud app versions list --format="value(id)" --filter="service != "default" AND version.createTime < '-pt30m'"); do
-          echo "Deleting ${NAME}..."
-          gcloud app versions delete ${NAME} --quiet
-        done)
+      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
+
+      - uses: 'google-github-actions/auth@v2' # ratchet:exclude
+        with:
+          workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
+          service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+
+      - uses: 'google-github-actions/setup-gcloud@v2' # ratchet:exclude
+
+      - name: Delete services
+        run: |-
+          gcloud config set core/project "${{ vars.PROJECT_ID }}"
+
+          # List and delete all versions that were deployed 30 minutes ago or
+          # earlier. The date math here is a little weird, but we're looking for
+          # deployments "earlier than" 30 minutes ago, so it's less than since
+          # time increases.
+          (IFS=$'\n'; for NAME in $(gcloud app versions list --format="value(id)" --filter="service != "default" AND version.createTime < '-pt30m'"); do
+            echo "Deleting ${NAME}..."
+            gcloud app versions delete ${NAME} --quiet
+          done)

.github/workflows/draft-release.yml

@@ -15,10 +15,8 @@ on:
 
 jobs:
   draft-release:
-    name: 'Draft release'
-    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v0'
+    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v3' # ratchet:exclude
     with:
       version_strategy: '${{ github.event.inputs.version_strategy }}'
-    # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow
     secrets:
       ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'

.github/workflows/integration.yml

@@ -24,43 +24,43 @@ jobs:
     runs-on: 'ubuntu-latest'
 
     steps:
-    - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
 
-    - uses: 'actions/setup-node@v4'
-      with:
-        node-version: '20.x'
+      - uses: 'actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
 
-    - name: 'npm build'
-      run: 'npm ci && npm run build'
+      - name: 'npm build'
+        run: 'npm ci && npm run build'
 
-    - uses: 'google-github-actions/auth@v2'
-      with:
-        workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
-        service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
+      - uses: 'google-github-actions/auth@v2' # ratchet:exclude
+        with:
+          workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
+          service_account: '${{ vars.SERVICE_ACCOUNT_EMAIL }}'
 
-    - name: 'Update app.yaml'
-      run: |-
-        echo "service: ${{ github.job }}-${{ github.run_number }}" >> ${{ github.workspace }}/example-app/app.yaml
+      - name: 'Update app.yaml'
+        run: |-
+          echo "service: ${{ github.job }}-${{ github.run_number }}" >> ${{ github.workspace }}/example-app/app.yaml
 
-    - name: 'Deploy'
-      id: 'deploy'
-      uses: './'
-      with:
-        working_directory: '${{ github.workspace }}/example-app'
-        build_env_vars: |-
-          FOO=bar
-          ZIP=zap
-        env_vars: |-
-          FOO=bar
-          ZIP=zap
+      - name: 'Deploy'
+        id: 'deploy'
+        uses: './'
+        with:
+          working_directory: '${{ github.workspace }}/example-app'
+          build_env_vars: |-
+            FOO=bar
+            ZIP=zap
+          env_vars: |-
+            FOO=bar
+            ZIP=zap
 
-    - name: 'Verify deployment'
-      run: |-
-        curl '${{ steps.deploy.outputs.url }}' \
-          --silent \
-          --fail \
-          --location \
-          --retry 5 \
-          --retry-connrefused \
-          --retry-delay 5 \
-          --retry-max-time 300
+      - name: 'Verify deployment'
+        run: |-
+          curl '${{ steps.deploy.outputs.url }}' \
+            --silent \
+            --fail \
+            --location \
+            --retry 5 \
+            --retry-connrefused \
+            --retry-delay 5 \
+            --retry-max-time 300

.github/workflows/publish.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
 
       - name: 'Publish'
         id: 'publish'
-        uses: 'actions/publish-immutable-action@4b1aa5c1cde5fedc80d52746c9546cb5560e5f53' # ratchet:actions/publish-immutable-action@v0.0.3
+        uses: 'actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978' # ratchet:actions/publish-immutable-action@v0.0.4
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/release.yml

@@ -8,10 +8,6 @@ on:
 
 jobs:
   release:
-    if: |-
-      startsWith(github.event.head_commit.message, 'Release: v')
-    name: 'Release'
-    uses: 'google-github-actions/.github/.github/workflows/release.yml@v1' # ratchet:exclude
-    # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow
+    uses: 'google-github-actions/.github/.github/workflows/release.yml@v3' # ratchet:exclude
     secrets:
       ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'

.github/workflows/unit.yml

@@ -21,26 +21,26 @@ jobs:
       fail-fast: false
       matrix:
         os:
-        - 'ubuntu-latest'
-        - 'windows-latest'
-        - 'macos-latest'
+          - 'ubuntu-latest'
+          - 'windows-latest'
+          - 'macos-latest'
     runs-on: '${{ matrix.os }}'
 
     steps:
-    - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
 
-    - uses: 'actions/setup-node@v4'
-      with:
-        node-version: '20.x'
+      - uses: 'actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
 
-    - name: 'npm build'
-      run: 'npm ci && npm run build'
+      - name: 'npm build'
+        run: 'npm ci && npm run build'
 
-    - name: 'npm lint'
-      # There's no need to run the linter for each operating system, since it
-      # will find the same thing 3x and clog up the PR review.
-      if: ${{ matrix.os == 'ubuntu-latest' }}
-      run: 'npm run lint'
+      - name: 'npm lint'
+        # There's no need to run the linter for each operating system, since it
+        # will find the same thing 3x and clog up the PR review.
+        if: ${{ matrix.os == 'ubuntu-latest' }}
+        run: 'npm run lint'
 
-    - name: 'npm test'
-      run: 'npm run test'
+      - name: 'npm test'
+        run: 'npm run test'