mirrors/hdf5
2
0
Fork 0
mirror of https://github.com/HDFGroup/hdf5.git synced 2026-09-25 04:09:44 +03:00
Code Issues Packages Projects Releases Wiki Activity
24,555 Commits 80 Branches 157 Tags
develop
Commit Graph
17 Commits
Author SHA1 Message Date
dependabot[bot] 80b691787b build(deps): bump the github-actions group with 11 updates (#6656) 
Bumps the github-actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.4.1` | `4.4.2` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `6.0.0` |
| [fortran-lang/setup-fortran](https://github.com/fortran-lang/setup-fortran) | `1.9.2` | `1.10.0` |
| [EndBug/add-and-commit](https://github.com/endbug/add-and-commit) | `10.0.0` | `11.1.1` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.2` | `4.0.3` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.3` | `4.37.9` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.3` | `4.37.9` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.3` | `4.37.9` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.5.2` | `1.5.5` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.4.5` | `1.4.7` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.2` | `3.0.3` |


Updates `lukka/get-cmake` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/lukka/get-cmake/releases)
- [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/lukka/get-cmake/compare/4a7d025fc60f00db0c7b44ebf783d19b52444830...fffaaafeea488556c2c12dad60690008bc1caacb)

Updates `actions/setup-java` from 5.6.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...dd06d9cba3e5552c54d9f8ea23572deb30010f7c)

Updates `fortran-lang/setup-fortran` from 1.9.2 to 1.10.0
- [Release notes](https://github.com/fortran-lang/setup-fortran/releases)
- [Commits](https://github.com/fortran-lang/setup-fortran/compare/195bac823dc6e05bb7c706311ad4540ffc34d5b9...be037f0a45b1160f139d4ccd0b96f9e9bfd6a682)

Updates `EndBug/add-and-commit` from 10.0.0 to 11.1.1
- [Release notes](https://github.com/endbug/add-and-commit/releases)
- [Commits](https://github.com/endbug/add-and-commit/compare/290ea2c423ad77ca9c62ae0f5b224379612c0321...cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8)

Updates `dorny/paths-filter` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d)

Updates `github/codeql-action/init` from 4.37.3 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...cdf488f595d80d6e07e03d4674febd5ab45fa938)

Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](https://github.com/github/codeql-action/compare/v4.37.3...v4.37.9)

Updates `vmactions/freebsd-vm` from 1.5.2 to 1.5.5
- [Release notes](https://github.com/vmactions/freebsd-vm/releases)
- [Commits](https://github.com/vmactions/freebsd-vm/compare/77ed28d336d03fe19a3f4f7266c1d2c4714dd79d...f0552d3b69211736abd97f02ff3d4674c56b73b1)

Updates `vmactions/openbsd-vm` from 1.4.5 to 1.4.7
- [Release notes](https://github.com/vmactions/openbsd-vm/releases)
- [Commits](https://github.com/vmactions/openbsd-vm/compare/c941015845c0f0c429676840963dc63b226d4f69...86cdc08415d9d0865267e686561e276c52d62530)

Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64)

---
updated-dependencies:
- dependency-name: lukka/get-cmake
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: fortran-lang/setup-fortran
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: EndBug/add-and-commit
  dependency-version: 11.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vmactions/freebsd-vm
  dependency-version: 1.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vmactions/openbsd-vm
  dependency-version: 1.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-02 09:06:37 -05:00
Mark KittisopikulClaude Opus 4.8Larry Knox
 		3131956eb0 Harden workflow checkout credential hygiene + permissions (#6545) 
* Harden workflow checkout credential hygiene + permissions

Address zizmor static-analysis findings:

- artipacked: add `persist-credentials: false` to actions/checkout
  steps in codeql.yml (2), test-binary-installation.yml (2),
  clang-format-check.yml, freebsd.yml, h5py.yml, openbsd.yml,
  signed-plugins.yml, and update-progress.yml. None of these jobs
  push to git, so dropping the persisted checkout credential is safe.

- excessive-permissions: restrict call-workflows.yml top-level
  permissions to `contents: read`, and grant `packages: write` /
  `pull-requests: write` only on the two jobs that call the
  maven-staging reusable workflow (which declares those needs).

No behavioral change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Removed extra blank lines.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
 2026-08-04 16:41:53 -04:00
dependabot[bot] 4fd1bd4545 build(deps): bump the github-actions group with 17 updates (#6588) 
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.4` | `4.4.1` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.4.0` | `5.6.0` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.3` |
| [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `3abb875e3aa9713e40eed5aea082672a42f7f95c` | `3c04c03694eb927ff908b8b5abfe9c58b239b0ae` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.1` | `6.2.3` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.5.0` | `1.5.2` |
| [julia-actions/julia-runtest](https://github.com/julia-actions/julia-runtest) | `1.11.5` | `1.12.0` |
| [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) | `2.8.0` | `2.9.0` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.4.4` | `1.4.5` |
| [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.3` | `1.4.4` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.3.0` | `7.0.0` |
 2026-08-04 10:23:32 -05:00
Larry Knox f44ad7d57e Address these zizmor githu-advanced-secureity alerts in workflows: (#6502) 
- action's hash pin has mismatched or missing version comment
  - credential persistence through GitHub Actions artifacts: does not set
  persist-credentials: false
 2026-07-04 05:23:23 -05:00
dependabot[bot]Claude Opus 4.8H. Joe Lee
 		9d5d995bec build(deps): bump the github-actions group with 21 updates (#6500) 
* build(deps): bump the github-actions group with 21 updates

Bumps the github-actions group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.0` |
| [DamianReeves/write-file-action](https://github.com/damianreeves/write-file-action) | `1d019960841941be46b139298996df6f139cc7a4` | `d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7` |
| [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.3` | `4.3.4` |
| [actions/setup-java](https://github.com/actions/setup-java) | `5.2.0` | `5.4.0` |
| [fortran-lang/setup-fortran](https://github.com/fortran-lang/setup-fortran) | `1.9.0` | `1.9.2` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.1` | `4.36.2` |
| [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `3b7da264292a727fcdc4acdc9eaf9a5abb92ba10` | `3abb875e3aa9713e40eed5aea082672a42f7f95c` |
| [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `4ef15ca7fd18a18f1000989fcfd968e06d146ce8` | `a3d72946b163026bbd0fa9a88379ccbda4bd86bb` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.2.1` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.6` | `1.5.0` |
| [julia-actions/julia-runtest](https://github.com/julia-actions/julia-runtest) | `1.11.4` | `1.11.5` |
| [msys2/setup-msys2](https://github.com/msys2/setup-msys2) | `2.31.1` | `2.32.0` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.4.3` | `1.4.4` |
| [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.2` | `1.4.3` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.0` | `3.0.1` |
| [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` |
| [actions/cache/save](https://github.com/actions/cache) | `5.0.5` | `6.1.0` |


Updates `actions/checkout` from 4.2.2 to 7.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...v7)

Updates `DamianReeves/write-file-action` from 1d019960841941be46b139298996df6f139cc7a4 to d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7
- [Release notes](https://github.com/damianreeves/write-file-action/releases)
- [Commits](https://github.com/damianreeves/write-file-action/compare/1d019960841941be46b139298996df6f139cc7a4...d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7)

Updates `actions/cache` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `lukka/get-cmake` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/lukka/get-cmake/releases)
- [Changelog](https://github.com/lukka/get-cmake/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/lukka/get-cmake/compare/591817e96fcad43505fb4eae36172462abb3a42e...f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9)

Updates `actions/setup-java` from 5.2.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...1bcf9fb12cf4aa7d266a90ae39939e61372fe520)

Updates `fortran-lang/setup-fortran` from 1.9.0 to 1.9.2
- [Release notes](https://github.com/fortran-lang/setup-fortran/releases)
- [Commits](https://github.com/fortran-lang/setup-fortran/compare/2a1b9c55897d827a9dfeb114408f3615e53b2b72...195bac823dc6e05bb7c706311ad4540ffc34d5b9)

Updates `github/codeql-action/init` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/analyze` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/87557b9c84dde89fdd9b10e88954ac2f4248e463...8aad20d150bbac5944a9f9d289da16a4b0d87c1e)

Updates `github/codeql-action/upload-sarif` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](https://github.com/github/codeql-action/compare/v4.36.1...v4.36.2)

Updates `codespell-project/actions-codespell` from 3b7da264292a727fcdc4acdc9eaf9a5abb92ba10 to 3abb875e3aa9713e40eed5aea082672a42f7f95c
- [Release notes](https://github.com/codespell-project/actions-codespell/releases)
- [Commits](https://github.com/codespell-project/actions-codespell/compare/3b7da264292a727fcdc4acdc9eaf9a5abb92ba10...3abb875e3aa9713e40eed5aea082672a42f7f95c)

Updates `cygwin/cygwin-install-action` from 4ef15ca7fd18a18f1000989fcfd968e06d146ce8 to a3d72946b163026bbd0fa9a88379ccbda4bd86bb
- [Release notes](https://github.com/cygwin/cygwin-install-action/releases)
- [Commits](https://github.com/cygwin/cygwin-install-action/compare/4ef15ca7fd18a18f1000989fcfd968e06d146ce8...a3d72946b163026bbd0fa9a88379ccbda4bd86bb)

Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/e7f100cf4c008499ea8adda475de1042d6975c7b...254c19bd240aabef8777f48595e9d2d7b972184b)

Updates `vmactions/freebsd-vm` from 1.4.6 to 1.5.0
- [Release notes](https://github.com/vmactions/freebsd-vm/releases)
- [Commits](https://github.com/vmactions/freebsd-vm/compare/a6de9343ef5747433d9c25784c90e84998b9d69a...5a72679103d223925653750faa878a143340fbd0)

Updates `julia-actions/julia-runtest` from 1.11.4 to 1.11.5
- [Release notes](https://github.com/julia-actions/julia-runtest/releases)
- [Commits](https://github.com/julia-actions/julia-runtest/compare/d60b785c6f2bdf4ebfb18b2b6f7d93b7dfb0efe3...fc07e51ec99db23b29943e95406b5762501e2897)

Updates `msys2/setup-msys2` from 2.31.1 to 2.32.0
- [Release notes](https://github.com/msys2/setup-msys2/releases)
- [Changelog](https://github.com/msys2/setup-msys2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/msys2/setup-msys2/compare/e9898307ac31d1a803454791be09ab9973336e1c...66cd2cce69caa17b53920067426061ca1de3a884)

Updates `vmactions/openbsd-vm` from 1.4.3 to 1.4.4
- [Release notes](https://github.com/vmactions/openbsd-vm/releases)
- [Commits](https://github.com/vmactions/openbsd-vm/compare/fcf799d7ce9c305ad89eabef1fb2fa5c1c42d0ee...18edb32f4e48dae5865d7b8b3a9587bc01218a20)

Updates `mpi4py/setup-mpi` from 1.4.2 to 1.4.3
- [Release notes](https://github.com/mpi4py/setup-mpi/releases)
- [Commits](https://github.com/mpi4py/setup-mpi/compare/dbbb80b116bea57fc1788daf7dbbf7ab3df3a0f1...f200dce75b64188be849b46657dcf86c721937b2)

Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b)

Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

Updates `actions/setup-python` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1)

Updates `actions/cache/save` from 5.0.5 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: DamianReeves/write-file-action
  dependency-version: d4ee8a06aec5db0c57a036b86f2f428e1f8b00e7
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: lukka/get-cmake
  dependency-version: 4.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-java
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: fortran-lang/setup-fortran
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: codespell-project/actions-codespell
  dependency-version: 3abb875e3aa9713e40eed5aea082672a42f7f95c
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: cygwin/cygwin-install-action
  dependency-version: a3d72946b163026bbd0fa9a88379ccbda4bd86bb
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vmactions/freebsd-vm
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: julia-actions/julia-runtest
  dependency-version: 1.11.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: msys2/setup-msys2
  dependency-version: 2.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: vmactions/openbsd-vm
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: mpi4py/setup-mpi
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/cache/save
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci(zizmor): hash-pin actions/checkout in signed-plugins.yml

Dependabot bumped this reference from the bare tag @v6 to @v7.0.0,
leaving it unpinned. zizmor's blanket policy requires a hash pin,
which failed the code-scanning check with an error. Pin to the same
v7.0.0 commit used across the other workflows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: H. Joe Lee <hyoklee@hdfgroup.org>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-02 13:51:49 -05:00
dependabot[bot] 71b4aba68d Bump the github-actions group with 12 updates (#6429) 
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `6` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.2` | `4.3.3` |
| [softwareforgood/check-artifact-v4-existence](https://github.com/softwareforgood/check-artifact-v4-existence) | `0.4.1` | `0.4.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.3` | `4.36.1` |
| [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) | `cf810cf4cbd6cdefe6ef86e55b64d524a16654a7` | `3b7da264292a727fcdc4acdc9eaf9a5abb92ba10` |
| [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `1.2.0` | `2.0.0` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.1.0` | `6.2.0` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.5` | `1.4.6` |
| [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) | `3.0.1` | `3.0.2` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `23b3fb94fbb4729a51b1c937f609483e759c8f28` | `fcf799d7ce9c305ad89eabef1fb2fa5c1c42d0ee` |
| [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `4.0.0` | `4.1.0` |
| [adriangl/check-new-commits-action](https://github.com/adriangl/check-new-commits-action) | `1.0.7` | `2.0.1` |
 2026-06-03 12:41:20 -05:00
dependabot[bot] 6e6273e573 Bump the github-actions group with 13 updates (#6393) 
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.3.1` | `4.3.2` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.2` | `4.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.32.4` | `4.35.3` |
| [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `b09c8ce7e6add6720f12f30042d7c972cf4a75ec` | `4ef15ca7fd18a18f1000989fcfd968e06d146ce8` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.0.0` | `6.1.0` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.4.4` | `1.4.5` |
| [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia) | `2.7.0` | `3.0.1` |
| [msys2/setup-msys2](https://github.com/msys2/setup-msys2) | `2.31.0` | `2.31.1` |
| [robinraju/release-downloader](https://github.com/robinraju/release-downloader) | `1.12` | `1.13` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.1` | `3.0.0` |
 2026-05-02 07:45:28 -05:00
dependabot[bot] c1fa9a9b8f Bump the github-actions group with 15 updates (#6342) 
Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [actions/download-artifact](https://github.com/actions/download-artifact), [actions/cache](https://github.com/actions/cache), [lukka/get-cmake](https://github.com/lukka/get-cmake), [actions/setup-java](https://github.com/actions/setup-java), [EndBug/add-and-commit](https://github.com/endbug/add-and-commit), [github/codeql-action](https://github.com/github/codeql-action), [advanced-security/filter-sarif](https://github.com/advanced-security/filter-sarif), [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell), [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action), [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm), [julia-actions/setup-julia](https://github.com/julia-actions/setup-julia), [msys2/setup-msys2](https://github.com/msys2/setup-msys2), [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release) to permit the latest version.

* Keep vmactions/openbsd-vm@271a1ba623 # v1.3.4 until ssh doesn't fail with newer version.
 2026-04-07 21:55:50 -05:00
Scot Breitenfeld 00499095d6 ci: only upload empty SARIF for pull_request events (#6353) 
Restrict empty SARIF upload to pull_request events only, so that
push-to-develop (e.g. after merging a text-only PR) does not overwrite
the real CodeQL results in the Security tab with an empty SARIF.
 2026-04-07 07:51:12 -05:00
Scot Breitenfeld 970efad7e1 ci: upload empty SARIF when CodeQL analysis is skipped (#6351) 
so that the "Require code scanning results" branch
protection rule is satisfied for text-only PRs.
 2026-04-06 12:37:20 -05:00
Scot Breitenfeld a8e1719655 ci: add gate job to CodeQL workflow for text-only PRs (#6346) 
* ci: add gate job to CodeQL workflow for text-only PRs

Remove paths-ignore from the workflow trigger and add a check-changes
job with dorny/paths-filter to detect code changes at the job level.
This ensures the workflow always triggers so the codeql-complete gate
job can report a passing status when analyze is skipped, preventing
text-only PRs from being blocked by required status checks.

* ci: check both check-changes and analyze results in gate job

Add check-changes to the needs array of codeql-complete so that a
failure in the change-detection job is not silently treated as a
skipped analysis.
 2026-04-04 10:39:46 -06:00
Scot Breitenfeld 05758a6168 Security hardening (#6302) 
Addresses CodeQL issues (Critical and High).
 2026-03-18 22:32:03 -05:00
Scot Breitenfeld 262802ec36 Outlines security policy (#6199) 
* Updated SECURITY.md to meet OSSF Badge Standard
* Disable CodeQL on MD file changes
* Updated version support policy
* Suppress non-constant format string CodeQL alerts

Exclude cpp/non-constant-format and cpp/uncontrolled-format-string
rules. All flagged uses are intentional format-string-as-template
patterns for family file naming (%d) and configurable output
formatting (%g), not security vulnerabilities.
* Add justification comments for CodeQL exclusions
* Harden CI workflows: pin actions to SHAs and apply least-privilege permissions
- Pin all third-party actions to commit SHAs in codeql.yml and arm-main.yml
- Add top-level permissions: contents: read to codeql.yml and markdown-link-check.yml
- Move contents: write from top-level to job-level in daily-schedule.yml

* Exclude non-security CodeQL rules and tainted-format-string false positives
- Add cpp/tainted-format-string to exclusions (same justification as
  existing format string rules: bounded snprintf with app-controlled formats)
- Exclude code style rules with no security severity: cpp/long-switch,
  cpp/guarded-free, cpp/commented-out-code, cpp/use-of-goto
- These 350+ alerts are structural C patterns inherent to HDF5, not vulnerabilities

* Add OpenSSF Best Practices badge to README.md
 2026-03-17 11:42:07 -05:00
dependabot[bot] 9849bda32a Bump the github-actions group with 9 updates (#6255) 
| Package | From | To |
| --- | --- | --- |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.2.1` | `4.2.3` |
| [fortran-lang/setup-fortran](https://github.com/fortran-lang/setup-fortran) | `1.8.1` | `1.9.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.32.2` | `4.32.4` |
| [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `0.5.11` | `1.1.0` |
| [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `2566376092c4e280f21131be027af3f5bb2420a4` | `b09c8ce7e6add6720f12f30042d7c972cf4a75ec` |
| [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) | `2.7.0` | `2.8.0` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.3.4` | `1.3.6` |
 2026-03-05 11:58:01 -06:00
dependabot[bot] 3c617d23a5 Bump the github-actions group across 1 directory with 11 updates (#6215) 
* Bump the github-actions group across 1 directory with 11 updates

Bumps the github-actions group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/cache](https://github.com/actions/cache) | `5.0.1` | `5.0.3` |
| [lukka/get-cmake](https://github.com/lukka/get-cmake) | `4.2.1` | `4.2.3` |
| [softwareforgood/check-artifact-v4-existence](https://github.com/softwareforgood/check-artifact-v4-existence) | `0.3.0` | `0.4.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.31.9` | `4.32.2` |
| [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `0.5.11` | `1.1.0` |
| [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `7d2dc1e241644c3318bed9ec74115d1929baa681` | `2566376092c4e280f21131be027af3f5bb2420a4` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `5.1.1` | `6.0.0` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.3.4` | `1.4.2` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.3.1` | `1.3.5` |
| [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.1` | `1.4.2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `6.1.0` | `6.2.0` |

 vmactions/openbsd-vm@d6c29ce1b4 (`1.3.5`) failed to run ssh on the github runner.  271a1ba62300483cfc58345ff9f425f1349a2cab for v1.3.4 was used instead.
 2026-02-13 07:42:14 -06:00
dependabot[bot] 13ee56c5d3 Bump the github-actions group with 11 updates (#6138) 
Bumps the github-actions group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `3` | `6` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `7.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `5.0.0` | `6.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `5.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) | `0.5.10` | `0.5.11` |
| [cygwin/cygwin-install-action](https://github.com/cygwin/cygwin-install-action) | `b9bf9147075ee9811ac11beee9351eeb93e2f2fb` | `7d2dc1e241644c3318bed9ec74115d1929baa681` |
| [vmactions/freebsd-vm](https://github.com/vmactions/freebsd-vm) | `1.3.0` | `1.3.4` |
| [msys2/setup-msys2](https://github.com/msys2/setup-msys2) | `2.29.0` | `2.30.0` |
| [vmactions/openbsd-vm](https://github.com/vmactions/openbsd-vm) | `1.2.5` | `1.3.1` |
| [mpi4py/setup-mpi](https://github.com/mpi4py/setup-mpi) | `1.4.0` | `1.4.1` |
 2026-01-02 11:13:52 -06:00
Scot Breitenfeld e34bbfefbf added codeql workflow (#6121) 
Adds CodeQL workflow for C/C++ analysis with scheduled, manual, and branch-specific triggers, including dependency setup, HDF5 configuration, and SARIF handling.
 2025-12-22 20:48:43 -06:00