ccf-release-bot · Oct 23, 2026
diff --git a/.github/workflows/attention-digest.yml b/.github/workflows/attention-digest.yml
@@ -55,7 +55,7 @@ jobs:
             echo "repos=$repos"
             echo "dry_run=$([ "$DRY_RUN" = true ] && echo true || echo false)"
           } >> "$GITHUB_OUTPUT"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -17,23 +17,23 @@ jobs:
     timeout-minutes: 7
     steps:
       - name: Checkout workflows repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: compliance-framework/workflows
           path: workflows
           ref: main
           fetch-depth: 1
           show-progress: false
       - name: Checkout assessment-runtime repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: compliance-framework/assessment-runtime
           path: assessment-runtime
           ref: main
           fetch-depth: 1
           show-progress: false
       - name: Checkout configuration-service repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: compliance-framework/configuration-service
           path: configuration-service

diff --git a/.github/workflows/ccf-bump-merge.yml b/.github/workflows/ccf-bump-merge.yml
@@ -54,7 +54,7 @@ jobs:
             echo "repos=$repos"
             echo "dry_run=$([ "$DRY_RUN" = true ] && echo true || echo false)"
           } >> "$GITHUB_OUTPUT"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/ccf-bump-sync.yml b/.github/workflows/ccf-bump-sync.yml
@@ -96,7 +96,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/ci-common.yml b/.github/workflows/ci-common.yml
@@ -30,7 +30,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
     with:
       # Repos without lockfiles (policies, helm) would otherwise fail the scan.
       scan-args: |-

diff --git a/.github/workflows/ci-go-lib.yml b/.github/workflows/ci-go-lib.yml
@@ -102,7 +102,7 @@ jobs:
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         id: golangci-lint
         with:
-          version: v2.11.4
+          version: v2.15.0
           args: ${{ steps.args.outputs.args }}
           # The action's own verify fetches the schema from golangci-lint.run and fails the job
           # when that host is unreachable; the next step verifies the config instead.
@@ -190,9 +190,9 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: v2.18.2
+          version: v2.18.3
           install-only: true
       - name: goreleaser check
         # Exit code 2 means a valid config with deprecated properties: a warning, not a failure.

diff --git a/.github/workflows/ci-go-plugin.yml b/.github/workflows/ci-go-plugin.yml
@@ -102,7 +102,7 @@ jobs:
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         id: golangci-lint
         with:
-          version: v2.11.4
+          version: v2.15.0
           args: ${{ steps.args.outputs.args }}
           # The action's own verify fetches the schema from golangci-lint.run and fails the job
           # when that host is unreachable; the next step verifies the config instead.
@@ -199,9 +199,9 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: v2.18.2
+          version: v2.18.3
           install-only: true
       - name: goreleaser check
         # Exit code 2 means a valid config with deprecated properties: a warning, not a failure.

diff --git a/.github/workflows/ci-go-service.yml b/.github/workflows/ci-go-service.yml
@@ -110,7 +110,7 @@ jobs:
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         id: golangci-lint
         with:
-          version: v2.11.4
+          version: v2.15.0
           args: ${{ steps.args.outputs.args }}
           # The action's own verify fetches the schema from golangci-lint.run and fails the job
           # when that host is unreachable; the next step verifies the config instead.

diff --git a/.github/workflows/ci-helm.yml b/.github/workflows/ci-helm.yml
@@ -45,7 +45,7 @@ jobs:
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         id: setup
         with:
-          version: v3.22.0
+          version: v3.22.1
       # kubeconform is built from source at a pinned version, like actionlint in ci-common.yml.
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         id: go
@@ -106,10 +106,10 @@ jobs:
           persist-credentials: false
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: v3.22.0
-      - uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
+          version: v3.22.1
+      - uses: helm/chart-testing-action@720270857a28afd41e2426521a7801db09e9b510 # v2.9.0
         with:
-          version: 3.14.0
+          version: 3.15.0
       - name: ct lint
         env:
           CHARTS_DIR: ${{ inputs.charts-dir }}

diff --git a/.github/workflows/ci-ui.yml b/.github/workflows/ci-ui.yml
@@ -56,7 +56,7 @@ jobs:
             echo "No .nvmrc; using Node $NODE_VERSION."
             echo "version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           # One of the two is empty; setup-node prefers node-version when both are set.
           node-version: ${{ steps.node.outputs.version }}

diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml
@@ -55,7 +55,7 @@ jobs:
             echo "::error::refusing to mint a release token: repo name '$REPO_NAME' vs $GITHUB_REPOSITORY"
             exit 1
           fi
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/plugin-health.yml b/.github/workflows/plugin-health.yml
@@ -87,7 +87,7 @@ jobs:
             exit 1
           fi
       # Read-only, scoped to the agent and the plugins. GHCR images are read anonymously.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
@@ -112,9 +112,9 @@ jobs:
         with:
           go-version-file: go.mod
       # A snapshot: the archives gooci uploads, without publishing a release.
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: v2.18.2
+          version: v2.18.3
           args: release --snapshot --clean
       - name: Install gooci
         run: go install github.com/compliance-framework/gooci@v0.0.7

diff --git a/.github/workflows/release-finished.yml b/.github/workflows/release-finished.yml
@@ -46,7 +46,7 @@ jobs:
             echo "::error::refusing to mint a release token: repository scope '$TOKEN_REPO' is not one repo"
             exit 1
           fi
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/release-go-lib.yml b/.github/workflows/release-go-lib.yml
@@ -71,7 +71,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           version: v2.18.2
           args: release --clean

diff --git a/.github/workflows/release-go-plugin.yml b/.github/workflows/release-go-plugin.yml
@@ -110,7 +110,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           version: v2.18.2
           args: release --clean

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -46,7 +46,7 @@ jobs:
             echo "::error::refusing to mint a release token: repo name '$REPO_NAME' vs $GITHUB_REPOSITORY"
             exit 1
           fi
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
@@ -88,7 +88,7 @@ jobs:
           go run ./cmd/renovate-config config --manifest "$MANIFEST" --repos "$REPOS" --dry-run "$DRY_RUN" --slot "$SLOT" > "$config"
           echo "path=$config" >> "$GITHUB_OUTPUT"
           jq '{repositories, dryRun}' "$config"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
@@ -102,7 +102,7 @@ jobs:
           permission-workflows: ${{ env.DRY_RUN == 'off' && 'write' || '' }} # action updates in .github/workflows
           permission-checks: read # branch status
           permission-vulnerability-alerts: read # Dependabot alerts, for vulnerability fixes
-      - uses: renovatebot/github-action@230ce922b08968d0a4f6f70f295601daff09ef1d # v46.3.7
+      - uses: renovatebot/github-action@f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 # v46.3.8
         timeout-minutes: 55 # within the token's hour
         with:
           configurationFile: ${{ steps.config.outputs.path }}
@@ -114,7 +114,7 @@ jobs:
       # shard, and only after the select step succeeded: an empty list would mint a token for every
       # repo the app is installed on (all of them). After a failed or timed-out Renovate step too:
       # the PRs it opened earlier are still there.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: merge-token
         if: ${{ !cancelled() && env.DRY_RUN == 'off' && steps.select.outcome == 'success' && steps.select.outputs.repos != '' }}
         with:

diff --git a/.github/workflows/repo-settings.yml b/.github/workflows/repo-settings.yml
@@ -72,7 +72,7 @@ jobs:
             exit 1
           fi
           echo "repos=$repos" >> "$GITHUB_OUTPUT"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.REPO_ADMIN_APP_ID }}

diff --git a/.github/workflows/train.yml b/.github/workflows/train.yml
@@ -104,7 +104,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
       # The release bot is installed on every org repo: a token minted with an owner and no
       # repositories would reach all of them, so only mint one for a non-empty list.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         if: steps.plan.outputs.repos != ''
         with:
@@ -125,7 +125,7 @@ jobs:
       # Every live run may read commands: one on an open train, and one that starts a live train
       # and keeps reconciling it (--watch). A dry run closes its train in the run that starts it
       # and reads none, so write (open, or a live start) is the condition.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: members
         if: steps.plan.outputs.write == 'true'
         continue-on-error: true

diff --git a/.github/workflows/vuln-summary.yml b/.github/workflows/vuln-summary.yml
@@ -43,7 +43,7 @@ jobs:
             exit 1
           fi
           echo "repos=$repos" >> "$GITHUB_OUTPUT"
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: token
         with:
           app-id: ${{ secrets.RELEASE_BOT_APP_ID }}

diff --git a/go.mod b/go.mod
@@ -2,18 +2,18 @@ module github.com/compliance-framework/workflows
 
 go 1.26.1
 
-require go.yaml.in/yaml/v3 v3.0.4
+require go.yaml.in/yaml/v3 v3.0.5
 
 require (
 	github.com/compliance-framework/agent v0.9.0
 	github.com/compliance-framework/gooci v0.0.6
-	github.com/google/go-containerregistry v0.21.2
+	github.com/google/go-containerregistry v0.22.1
 	github.com/hashicorp/go-hclog v1.6.3
-	github.com/hashicorp/go-plugin v1.7.0
+	github.com/hashicorp/go-plugin v1.8.0
 	github.com/open-policy-agent/opa v1.14.1
-	golang.org/x/crypto v0.57.0
-	golang.org/x/mod v0.41.0
-	google.golang.org/grpc v1.83.2
+	golang.org/x/crypto v0.58.0
+	golang.org/x/mod v0.42.0
+	google.golang.org/grpc v1.84.0
 )
 
 require (
@@ -37,11 +37,9 @@ require (
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.12.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/compliance-framework/api v0.21.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/defenseunicorns/go-oscal v0.7.0 // indirect
-	github.com/docker/cli v29.3.0+incompatible // indirect
-	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/cli v29.7.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
@@ -50,7 +48,7 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
-	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/dsig v1.0.0 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
@@ -70,21 +68,20 @@ require (
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/valyala/fastjson v1.6.10 // indirect
-	github.com/vbatts/tar-split v0.12.2 // indirect
 	github.com/vektah/gqlparser/v2 v2.5.32 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
 	go.opentelemetry.io/otel v1.45.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	golang.org/x/net v0.60.0 // indirect
-	golang.org/x/sync v0.23.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )