update actions versions

.github/workflows/lock.yaml

@@ -3,23 +3,19 @@ name: 'Lock threads'
 # two weeks. This does not close open issues, only humans may do that.
 # We find that it is easier to respond to new issues with fresh examples
 # rather than continuing discussions on old issues.
-
 on:
  schedule:
  - cron: '0 0 * * *'
-
 permissions:
  issues: write
  pull-requests: write
-
 concurrency:
  group: lock
-
 jobs:
  lock:
  runs-on: ubuntu-latest
  steps:
- - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21
+ - uses: dessant/lock-threads@7de207be1d3ce97a9abe6ff1306222982d1ca9f9
  with:
  issue-inactive-days: 14
  pr-inactive-days: 14

.github/workflows/publish.yaml

@@ -9,8 +9,8 @@ jobs:
  outputs:
  hash: ${{ steps.hash.outputs.hash }}
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
- - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+ - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
  with:
  python-version: '3.x'
  cache: pip
@@ -23,17 +23,17 @@ jobs:
  - name: generate hash
  id: hash
  run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
- - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
+ - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
  with:
+ name: dist
  path: ./dist
  provenance:
  needs: [build]
  permissions:
  actions: read
  id-token: write
  contents: write
- # Can't pin with hash due to how this workflow works.
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@07e64b653f10a80b6510f4568f685f8b7b9ea830
  with:
  base64-subjects: ${{ needs.build.outputs.hash }}
  create-release:
@@ -47,9 +47,8 @@ jobs:
  - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
  - name: create release
  run: >
- gh release create --draft --repo ${{ github.repository }}
- ${{ github.ref_name }}
- *.intoto.jsonl/* artifact/*
+ gh release create --draft --repo ${{ github.repository }} ${{ github.ref_name }} *.intoto.jsonl/* artifact/*
+
  env:
  GH_TOKEN: ${{ github.token }}
  publish-pypi:
@@ -62,10 +61,7 @@ jobs:
  id-token: write
  steps:
  - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
- - uses: pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e
+ - uses: pypa/gh-action-pypi-publish@f946db0f765b9ae754e44bfd5ae5b8b91cfb37ef
  with:
  repository-url: https://test.pypi.org/legacy/
- packages-dir: artifact/
- - uses: pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e
- with:
- packages-dir: artifact/
+ - uses: pypa/gh-action-pypi-publish@f946db0f765b9ae754e44bfd5ae5b8b91cfb37ef

.github/workflows/tests.yaml

@@ -33,14 +33,14 @@ jobs:
  - {name: 'Development Versions', python: '3.8', os: ubuntu-latest, tox: py38-dev}
  - {name: Typing, python: '3.12', os: ubuntu-latest, tox: typing}
  steps:
- - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
- - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+ - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
  with:
  python-version: ${{ matrix.python }}
  cache: 'pip'
  cache-dependency-path: requirements*/*.txt
  - name: cache mypy
- uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8
+ uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
  with:
  path: ./.mypy_cache
  key: mypy|${{ matrix.python }}|${{ hashFiles('pyproject.toml') }}