initial commit

2023-01-04 13:01:54 -08:00
parent ef566c8d68
commit 908e812733
328 changed files with 3340 additions and 1426 deletions
@@ -13,7 +13,7 @@ jobs:
  make-all:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make all
      run: make all

@@ -24,7 +24,7 @@ jobs:
      DEVNULLRIGHTS: 1
      READFROMBLOCKDEVICE: 1
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make test
      run: make test

@@ -32,28 +32,28 @@ jobs:
  make-test-osx:
    runs-on: macos-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: OS-X test
      run: make test # make -c lib all doesn't work because of the fact that it's not a tty

  no-intrinsics-fuzztest:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: no intrinsics fuzztest
      run: MOREFLAGS="-DZSTD_NO_INTRINSICS" make -C tests fuzztest

  tsan-zstreamtest:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: thread sanitizer zstreamtest
      run: CC=clang ZSTREAM_TESTTIME=-T3mn make tsan-test-zstream

  ubsan-zstreamtest:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: undefined behavior sanitizer zstreamtest
      run: CC=clang make uasan-test-zstream

@@ -61,7 +61,7 @@ jobs:
  tsan-fuzztest:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: thread sanitizer fuzztest
      run: CC=clang make tsan-fuzztest

@@ -69,7 +69,7 @@ jobs:
  gcc-8-asan-ubsan-testzstd:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: gcc-8 + ASan + UBSan + Test Zstd
      # See https://askubuntu.com/a/1428822
      run: |
@@ -81,14 +81,14 @@ jobs:
  clang-asan-ubsan-testzstd:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + ASan + UBSan + Test Zstd
      run: CC=clang make -j uasan-test-zstd </dev/null V=1

  gcc-asan-ubsan-testzstd-32bit:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: ASan + UBSan + Test Zstd, 32bit mode
      run: |
        sudo apt-get -qqq update
@@ -102,7 +102,7 @@ jobs:
  gcc-8-asan-ubsan-fuzz:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: gcc-8 + ASan + UBSan + Fuzz Test
      # See https://askubuntu.com/a/1428822
      run: |
@@ -114,14 +114,14 @@ jobs:
  clang-asan-ubsan-fuzz:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + ASan + UBSan + Fuzz Test
      run: CC=clang FUZZER_FLAGS="--long-tests" make clean uasan-fuzztest

  gcc-asan-ubsan-fuzz32:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: ASan + UBSan + Fuzz Test 32bit
      run: |
        sudo apt-get -qqq update
@@ -131,7 +131,7 @@ jobs:
  clang-asan-ubsan-fuzz32:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + ASan + UBSan + Fuzz Test 32bit
      run: |
        sudo apt-get -qqq update
@@ -141,28 +141,28 @@ jobs:
  asan-ubsan-regression:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: ASan + UBSan + Regression Test
      run: make -j uasanregressiontest

  clang-ubsan-regression:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + ASan + UBSan + Regression Test
      run: CC=clang make -j uasanregressiontest

  msan-regression:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: MSan + Regression Test
      run: make -j msanregressiontest

  clang-msan-fuzz:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + MSan + Fuzz Test
      run: |
        sudo apt-get -qqq update
@@ -173,7 +173,7 @@ jobs:
  clang-msan-testzstd:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: clang + MSan + Test Zstd
      run: |
        sudo apt-get update
@@ -183,7 +183,7 @@ jobs:
  armfuzz:
      runs-on: ubuntu-latest
      steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
      - name: Qemu ARM emulation + Fuzz Test
        run: |
          sudo apt-get -qqq update
@@ -193,7 +193,7 @@ jobs:
  valgrind-fuzz-test:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: valgrind + fuzz test stack mode    # ~ 7mn
      shell: 'script -q -e -c "bash {0}"'
      run: |
@@ -213,7 +213,7 @@ jobs:
          { compiler: gcc, platform: x64, action: test, script: ""},
        ]
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Mingw long test
      run: |
        $env:PATH_ORIGINAL = $env:PATH
@@ -279,7 +279,7 @@ jobs:
        dry-run: false
        sanitizer: ${{ matrix.sanitizer }}
    - name: Upload Crash
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # tag=v3.1.1
      if: failure() && steps.build.outcome == 'success'
      with:
        name: ${{ matrix.sanitizer }}-artifacts
@@ -14,21 +14,21 @@ jobs:
  linux-kernel:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: linux kernel, library + build + test
      run: make -C contrib/linux-kernel test CFLAGS="-Werror -Wunused-const-variable -Wunused-but-set-variable"

  benchmarking:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make benchmarking
      run: make benchmarking

  check-32bit: # designed to catch https://github.com/facebook/zstd/issues/2428
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make check on 32-bit
      run: |
        sudo apt update
@@ -38,7 +38,7 @@ jobs:
  check-x32:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make check on x32 ABI # https://en.wikipedia.org/wiki/X32_ABI
      env:
        CHECK_CONSTRAINED_MEM: true
@@ -50,7 +50,7 @@ jobs:
  gcc-7-libzstd:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: gcc-7 + libzstdmt compilation
      # See https://askubuntu.com/a/1428822
      run: |
@@ -67,7 +67,7 @@ jobs:
  cmake-build-and-test-check:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: cmake build and test check
      run: |
        FUZZERTEST=-T1mn ZSTREAM_TESTTIME=-T1mn make cmakebuild
@@ -78,7 +78,7 @@ jobs:
  cpp-gnu90-c99-compatibility:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: C++, gnu90 and c99 compatibility
      run: |
        make cxxtest
@@ -92,7 +92,7 @@ jobs:
  mingw-cross-compilation:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: mingw cross-compilation
      run: |
        # sudo update-alternatives --set x86_64-w64-mingw32-g++ /usr/bin/x86_64-w64-mingw32-g++-posix; (doesn't work)
@@ -103,7 +103,7 @@ jobs:
  armbuild:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: ARM Build Test
      run: |
        sudo apt-get -qqq update
@@ -113,7 +113,7 @@ jobs:
  bourne-shell:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Bourne shell compatibility (shellcheck)
      run: |
        wget https://github.com/koalaman/shellcheck/releases/download/v0.7.1/shellcheck-v0.7.1.linux.x86_64.tar.xz
@@ -123,7 +123,7 @@ jobs:
  zlib-wrapper:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: zlib wrapper test
      run: |
        sudo apt-get -qqq update
@@ -134,7 +134,7 @@ jobs:
  lz4-threadpool-libs:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: LZ4, thread pool, and libs build testslib wrapper test
      run: |
        make lz4install
@@ -148,7 +148,7 @@ jobs:
  gcc-make-tests-32bit:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Make all, 32bit mode
      run: |
        sudo apt-get -qqq update
@@ -158,7 +158,7 @@ jobs:
  gcc-8-make:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
      - name: gcc-8 build
        # See https://askubuntu.com/a/1428822
        run: |
@@ -170,7 +170,7 @@ jobs:
  implicit-fall-through:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
      - name: -Wimplicit-fallthrough build
        run: |
          make clean
@@ -178,6 +178,51 @@ jobs:
          make clean
          CC=clang MOREFLAGS="-Werror -Wimplicit-fallthrough -O0" make -C lib -j libzstd.a ZSTD_LEGACY_SUPPORT=0

+  meson-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
+      - name: Install packages
+        run: |
+          sudo apt-get update
+          sudo apt-get -y install build-essential python3-pip ninja-build liblz4-dev
+          pip install --pre meson
+      - name: Build with Meson
+        run: |
+          meson setup \
+            --buildtype=debugoptimized \
+            -Db_lundef=false \
+            -Dauto_features=enabled \
+            -Dbin_programs=true \
+            -Dbin_tests=true \
+            -Dbin_contrib=true \
+            -Ddefault_library=both \
+            build/meson builddir
+          ninja -C builddir/
+          meson test -C builddir/ --print-errorlogs
+          meson install -C builddir --destdir staging/
+
+  meson-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
+      - name: Install packages
+        run: pip install --pre meson
+      - name: Initialize the MSVC dev command prompt
+        uses: ilammy/msvc-dev-cmd@7315a94840631165970262a99c72cfb48a65d25d
+      - name: Configure with Meson
+        run: |
+          meson setup build/meson/ builddir -Dbin_tests=true -Dbin_programs=true -Dbin_contrib=true
+      - name: Build with Meson
+        run: |
+          ninja -C builddir/
+      - name: Test with Meson
+        run: |
+          meson test -C builddir/ --print-errorlogs
+      - name: Install with Meson
+        run: |
+          meson install -C builddir --destdir staging/
+
  cmake-visual-2019:
    runs-on: windows-2019
    strategy:
@@ -189,9 +234,9 @@ jobs:
            flags: "-A Win32"
          - generator: "MinGW Makefiles"
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.1.3
+      uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # tag=v1.1.3
    - name: Build
      working-directory: ${{env.GITHUB_WORKSPACE}}
      run: |
@@ -208,9 +253,9 @@ jobs:
        platform: [x64, Win32]
        configuration: [Debug, Release]
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.1.3
+      uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # tag=v1.1.3
    - name: Build
      working-directory: ${{env.GITHUB_WORKSPACE}}
      # See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
@@ -227,19 +272,33 @@ jobs:
 #        platform: [x64, Win32]
 #        configuration: [Debug, Release]
 #    steps:
-#    - uses: actions/checkout@v3
+#    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
 #    - name: Add MSBuild to PATH
-#      uses: microsoft/setup-msbuild@v1.1.3
+#      uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # tag=v1.1.3
 #    - name: Build
 #      working-directory: ${{env.GITHUB_WORKSPACE}}
 #      run: >
 #        msbuild "build\VS2010\zstd.sln" /m /verbosity:minimal /property:PlatformToolset=v140
 #        /t:Clean,Build /p:Platform=${{matrix.platform}} /p:Configuration=${{matrix.configuration}}

+  # This tests that we don't accidently grow the size too much.
+  # If the size grows intentionally, you can raise these numbers.
+  # But we do need to think about binary size, since it is a concern.
+  libzstd-size:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
+    - name: libzstd size test
+      run: |
+        make clean && make -j -C lib libzstd && ./tests/check_size.py lib/libzstd.so 1100000
+        make clean && make -j -C lib libzstd ZSTD_LIB_COMPRESSION=0 ZSTD_LIB_DICTBUILDER=0 && ./tests/check_size.py lib/libzstd.so 400000
+        make clean && make -j -C lib libzstd ZSTD_LIB_MINIFY=1 && ./tests/check_size.py lib/libzstd.so 300000
+        make clean && make -j -C lib libzstd ZSTD_LIB_MINIFY=1 ZSTD_LIB_COMPRESSION=0 ZSTD_LIB_DICTBUILDER=0 && ./tests/check_size.py lib/libzstd.so 80000
+
  minimal-decompressor-macros:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: minimal decompressor macros
      run: |
        make clean && make -j all ZSTD_LIB_MINIFY=1 MOREFLAGS="-Werror"
@@ -254,7 +313,7 @@ jobs:
  dynamic-bmi2:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: dynamic bmi2 tests
      run: |
        make clean && make -j check MOREFLAGS="-O0 -Werror -mbmi2"
@@ -266,7 +325,7 @@ jobs:
  test-variants:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: make all variants & validate
      run: |
        make -j -C programs allVariants MOREFLAGS=-O0
@@ -292,7 +351,7 @@ jobs:
      XCC: ${{ matrix.xcc }}
      XEMU: ${{ matrix.xemu }}
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: apt update & install
      run: |
        sudo apt-get update
@@ -345,7 +404,7 @@ jobs:
          { compiler: clang, platform: x64, script: "CFLAGS='--target=x86_64-w64-mingw32 -Werror -Wconversion -Wno-sign-conversion' make -j allzstd V=1"},
        ]
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Mingw short test
      run: |
        ECHO "Building ${{matrix.compiler}} ${{matrix.platform}}"
@@ -378,9 +437,9 @@ jobs:
        platform: [x64, Win32]
        configuration: [Release]
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.1.3
+      uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # tag=v1.1.3
    - name: Build and run tests
      working-directory: ${{env.GITHUB_WORKSPACE}}
      env:
@@ -398,7 +457,7 @@ jobs:
  intel-cet-compatibility:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
    - name: Build Zstd
      run: |
        make -j zstd V=1
@@ -419,7 +478,7 @@ jobs:
    container:
      image: debian:testing
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
      - name: Install dependencies
        run: |
          apt -y update
@@ -431,18 +490,21 @@ jobs:
          cc -Wall -Wextra -Wpedantic -Werror -o simple examples/simple_compression.c $(pkg-config --cflags --libs libzstd)
          ./simple LICENSE

+  versions-compatibility:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
+    - name: Versions Compatibility Test
+      run: |
+        make -C tests versionsTest

-# This test currently fails on Github Actions specifically.
-# Possible reason : TTY emulation.
-# Note that the same test works fine locally and on travisCI.
-# This will have to be fixed before transferring the test to GA.
-#  versions-compatibility:
-#    runs-on: ubuntu-latest
-#    steps:
-#    - uses: actions/checkout@v3
-#    - name: Versions Compatibility Test
-#      run: |
-#        make -C tests versionsTest
+  clangbuild:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
+    - name: make clangbuild
+      run: |
+        make clangbuild


 # For reference : icc tests
@@ -463,7 +525,7 @@ jobs:
 #        sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
 #        sudo apt-get update
 #        sudo apt-get install -y intel-basekit intel-hpckit
-#    - uses: actions/checkout@v3
+#    - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
 #    - name: make check
 #      run: |
 #        make CC=/opt/intel/oneapi/compiler/latest/linux/bin/intel64/icc check
@@ -19,7 +19,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3

      - name: Archive
        env:
@@ -27,12 +27,12 @@ jobs:

    steps:
      - name: "Checkout code"
-        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # tag=v3
        with:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # tag=v2.0.6
+        uses: ossf/scorecard-action@937ffa90d79c7d720498178154ad4c7ba1e4ad8c # tag=v2.1.0
        with:
          results_file: results.sarif
          results_format: sarif
@@ -51,7 +51,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
+        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # tag=v3.1.1
        with:
          name: SARIF file
          path: results.sarif
@@ -59,6 +59,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # tag=v1.0.26
+        uses: github/codeql-action/upload-sarif@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # tag=v2.1.37
        with:
          sarif_file: results.sarif