Merge branch 'main' into hook-thinking-status

Author: trobrock

.github/workflows/build-cli.yml

@@ -80,13 +80,13 @@ jobs:
 
       - name: Cache Cargo artifacts (Linux/macOS)
         if: matrix.use-cross
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2.8.2
         with:
           key: ${{ matrix.architecture }}-${{ matrix.target-suffix }}
 
       - name: Cache Cargo artifacts (Windows)
         if: matrix.use-docker
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2.8.2
         with:
           key: ${{ matrix.architecture }}-${{ matrix.target-suffix }}
 

.github/workflows/bundle-desktop-intel.yml

@@ -64,7 +64,7 @@ jobs:
           npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2.8.2
         with:
           key: intel
 
@@ -139,7 +139,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: ${{ inputs.signing }}
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
         with:
           role-to-assume: "${{ secrets.OSX_CODESIGN_ROLE }}"
           aws-region: us-west-2

.github/workflows/bundle-desktop-linux.yml

@@ -95,7 +95,7 @@ jobs:
         run: source ./bin/activate-hermit && cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2.8.2
         with:
           key: linux
 

.github/workflows/bundle-desktop-windows.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: inputs.signing && inputs.signing == true
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # ratchet:aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
         with:
           role-to-assume: ${{ github.ref == 'refs/heads/main' && secrets.WINDOW_SIGNING_ROLE || secrets.WINDOW_SIGNING_ROLE_TAG }}
           aws-region: us-west-2

.github/workflows/bundle-desktop.yml

@@ -169,7 +169,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: ${{ inputs.signing }}
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
         with:
           role-to-assume: "${{ secrets.OSX_CODESIGN_ROLE }}"
           aws-region: us-west-2

.github/workflows/canary.yml

@@ -109,7 +109,7 @@ jobs:
 
       # Create/update the canary release
       - name: Release canary
-        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # pin@v1
+        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0
         with:
           tag: canary
           name: Canary
@@ -119,7 +119,7 @@ jobs:
             Goose*.zip
             *.deb
             *.rpm
-            *.flatpak
+            **/*.flatpak
             download_cli.sh
           allowUpdates: true
           omitBody: true

.github/workflows/create-release-pr.yaml

@@ -44,7 +44,7 @@ jobs:
         fetch-depth: 0 # to generate complete release log
 
     - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
-    - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+    - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b  # v7.2.0
 
     - name: Validate input and set old version
       run: |

.github/workflows/deploy-docs-and-extensions.yml

@@ -74,7 +74,7 @@ jobs:
 
       - name: Deploy to /gh-pages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # pin@v3
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e  # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: documentation/build

.github/workflows/docs-update-recipe-ref.yml

@@ -191,7 +191,7 @@ jobs:
         if: |
           steps.extract.outputs.has_changes == 'true' && 
           (github.event.inputs.dry_run != 'true' || github.event_name == 'release')
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           branch: docs/auto-recipe-reference-${{ steps.versions.outputs.new_version }}
           delete-branch: true

.github/workflows/goose-issue-solver.yml

@@ -219,7 +219,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.goose.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # pin@v7.0.8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "fix: ${{ steps.issue.outputs.title }}"