Merge branch 'main' into fix/ghes-server-url

bosesuneha · web-flow · commit 0cdc565a94ff · 2026-07-30T10:42:58.000-07:00
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -16,23 +16,23 @@ jobs:
 
       steps:
          - name: Checkout repository
-           uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0
+           uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
            with:
               # We must fetch at least the immediate parents so that if this is
               # a pull request then we can checkout the head.
               fetch-depth: 2
 
          # Initializes the CodeQL tools for scanning.
          - name: Initialize CodeQL
-           uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #v3.29.5
+           uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5
            # Override language selection by uncommenting this and choosing your languages
            # with:
            #   languages: go, javascript, csharp, python, cpp, java
 
          # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
          # If this step fails, then you should remove it and run the build manually (see below)
          - name: Autobuild
-           uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #v3.29.5
+           uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5
 
          # ℹ️ Command-line programs to run using the OS shell.
          # 📚 https://git.io/JvXDl
@@ -46,4 +46,4 @@ jobs:
          #   make release
 
          - name: Perform CodeQL Analysis
-           uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e #v3.29.5
+           uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a #v3.29.5
diff --git a/.github/workflows/defaultLabels.yml b/.github/workflows/defaultLabels.yml
@@ -13,7 +13,7 @@ jobs:
 
       # Steps represent a sequence of tasks that will be executed as part of the job
       steps:
-         - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+         - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
            name: Setting issue as idle
            with:
               repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -24,7 +24,7 @@ jobs:
               operations-per-run: 100
               exempt-issue-labels: 'backlog'
 
-         - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+         - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
            name: Setting PR as idle
            with:
               repo-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/prettify-code.yml b/.github/workflows/prettify-code.yml
@@ -10,7 +10,7 @@ jobs:
       runs-on: ubuntu-latest
       steps:
          - name: Checkout Repository
-           uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+           uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
          - name: install deps
            run: npm install
 
diff --git a/.github/workflows/run-integration-tests-basic.yml b/.github/workflows/run-integration-tests-basic.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-bluegreen-ingress.yml b/.github/workflows/run-integration-tests-bluegreen-ingress.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-bluegreen-service.yml b/.github/workflows/run-integration-tests-bluegreen-service.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-bluegreen-smi.yml b/.github/workflows/run-integration-tests-bluegreen-smi.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-canary-pod.yml b/.github/workflows/run-integration-tests-canary-pod.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-canary-smi.yml b/.github/workflows/run-integration-tests-canary-smi.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-namespace-optional.yml b/.github/workflows/run-integration-tests-namespace-optional.yml
@@ -21,7 +21,7 @@ jobs:
          NAMESPACE1: integration-test-namespace1-${{ github.run_id }}
          NAMESPACE2: integration-test-namespace2-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/run-integration-tests-private.yml b/.github/workflows/run-integration-tests-private.yml
@@ -19,7 +19,7 @@ jobs:
          contents: read
          id-token: write
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - name: Install dependencies
            run: |
@@ -51,7 +51,7 @@ jobs:
            run: |
               az aks command invoke --resource-group ${{ env.NAMESPACE }} --name ${{ env.NAMESPACE }} --command "kubectl create ns ${{ env.NAMESPACE }}"
 
-         - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # 6.3.0
+         - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # 7.0.0
            name: Install Python
            with:
               python-version: '3.x'
diff --git a/.github/workflows/run-integration-tests-resource-annotation.yml b/.github/workflows/run-integration-tests-resource-annotation.yml
@@ -18,7 +18,7 @@ jobs:
          KUBECONFIG: /home/runner/.kube/config
          NAMESPACE: test-${{ github.run_id }}
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
          - uses: ./.github/actions/minikube-setup
            name: Setup Minikube Environment
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
@@ -14,7 +14,7 @@ jobs:
       name: Run Unit Tests
       runs-on: ubuntu-latest
       steps:
-         - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
          - run: |
               npm install
               npm test
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,28 @@
 # Changelog
 
+## [7.0.0] - 2026-06-23
+
+### Changed
+
+- #528 [Confine manifest paths to GITHUB_WORKSPACE (**breaking**: workflows passing `manifests:` paths outside the workspace now fail with a clear error)](https://github.com/Azure/k8s-deploy/pull/528)
+- #527 [Pin release workflow to commit SHA for supply chain safety](https://github.com/Azure/k8s-deploy/pull/527)
+
+### Security
+
+- #528 [Harden URL fetcher error handling in writeYamlFromURLToFile](https://github.com/Azure/k8s-deploy/pull/528)
+- #537 [Bump undici from 6.25.0 to 6.27.0](https://github.com/Azure/k8s-deploy/pull/537)
+- #536 [Bump actions/checkout in /.github/workflows in the actions group](https://github.com/Azure/k8s-deploy/pull/536)
+- #534 [Bump the actions group with 3 updates](https://github.com/Azure/k8s-deploy/pull/534)
+- #533 [Bump esbuild from 0.28.0 to 0.28.1](https://github.com/Azure/k8s-deploy/pull/533)
+- #532 [Bump github/codeql-action in /.github/workflows in the actions group](https://github.com/Azure/k8s-deploy/pull/532)
+- #531 [Bump @types/node from 25.9.1 to 25.9.2 in the actions group](https://github.com/Azure/k8s-deploy/pull/531)
+- #530 [Bump the actions group in /.github/workflows with 2 updates](https://github.com/Azure/k8s-deploy/pull/530)
+- #529 [Bump the actions group with 2 updates](https://github.com/Azure/k8s-deploy/pull/529)
+- #526 [Bump the actions group in /.github/workflows with 2 updates](https://github.com/Azure/k8s-deploy/pull/526)
+- #525 [Bump the actions group with 2 updates](https://github.com/Azure/k8s-deploy/pull/525)
+- #524 [Bump @types/node from 25.7.0 to 25.9.0 in the actions group](https://github.com/Azure/k8s-deploy/pull/524)
+- #523 [Bump github/codeql-action in /.github/workflows in the actions group](https://github.com/Azure/k8s-deploy/pull/523)
+
 ## [6.0.0] - 2026-04-17
 
 ### Changed
diff --git a/README.md b/README.md
@@ -147,10 +147,25 @@ Following are the key capabilities of this action:
 
 ## Usage Examples
 
+### Pinning the action version
+
+For supply-chain security, GitHub [recommends](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) pinning third-party actions to a full-length commit SHA rather than a mutable tag. The examples below use `Azure/k8s-deploy@v7` for readability, but the pinned form is preferred in production workflows:
+
+```yaml
+# Pinned to a specific commit SHA (recommended)
+- uses: Azure/k8s-deploy@<full-commit-sha> # v7.0.0
+  with:
+     manifests: |
+        deployment.yaml
+        service.yaml
+```
+
+Replace `<full-commit-sha>` with the 40-character commit SHA of the [release](https://github.com/Azure/k8s-deploy/releases) you want to pin to. Dependabot can keep pinned SHAs up to date automatically — see [Keeping your actions up to date with Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
+
 ### Basic deployment (without any deployment strategy)
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      manifests: |
@@ -164,7 +179,7 @@ Following are the key capabilities of this action:
 ### Private cluster deployment
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      resource-group: yourResourceGroup
      name: yourClusterName
@@ -184,7 +199,7 @@ Following are the key capabilities of this action:
 ### Canary deployment without service mesh
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'
@@ -203,7 +218,7 @@ Following are the key capabilities of this action:
 To promote/reject the canary created by the above snippet, the following YAML snippet could be used:
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'
@@ -221,7 +236,7 @@ To promote/reject the canary created by the above snippet, the following YAML sn
 ### Canary deployment based on Service Mesh Interface
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'
@@ -242,7 +257,7 @@ To promote/reject the canary created by the above snippet, the following YAML sn
 To promote/reject the canary created by the above snippet, the following YAML snippet could be used:
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }} '
@@ -261,7 +276,7 @@ To promote/reject the canary created by the above snippet, the following YAML sn
 ### Blue-Green deployment with different route methods
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'
@@ -281,7 +296,7 @@ To promote/reject the canary created by the above snippet, the following YAML sn
 To promote/reject the green workload created by the above snippet, the following YAML snippet could be used:
 
 ```yaml
-- uses: Azure/k8s-deploy@v5
+- uses: Azure/k8s-deploy@v7
   with:
      namespace: 'myapp'
      images: 'contoso.azurecr.io/myapp:${{ event.run_id }}'
@@ -338,7 +353,7 @@ jobs:
               container-registry-password: ${{ secrets.REGISTRY_PASSWORD }}
               secret-name: demo-k8s-secret
 
-         - uses: Azure/k8s-deploy@v5
+         - uses: Azure/k8s-deploy@v7
            with:
               action: deploy
               manifests: |
@@ -384,7 +399,7 @@ jobs:
               container-registry-password: ${{ secrets.REGISTRY_PASSWORD }}
               secret-name: demo-k8s-secret
 
-         - uses: Azure/k8s-deploy@v5
+         - uses: Azure/k8s-deploy@v7
            with:
               action: deploy
               manifests: |
@@ -468,7 +483,7 @@ jobs:
               helm-version: 'latest'
            id: bake
 
-         - uses: Azure/k8s-deploy@v5
+         - uses: Azure/k8s-deploy@v7
            with:
               action: deploy
               manifests: ${{ steps.bake.outputs.manifestsBundle }}
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
    "name": "k8s-deploy-action",
-   "version": "6.0.0",
+   "version": "7.0.0",
    "author": "Deepak Sattiraju",
    "license": "MIT",
    "type": "module",
@@ -20,7 +20,7 @@
       "@actions/tool-cache": "4.0.0",
       "@octokit/core": "^7.0.6",
       "@octokit/plugin-retry": "^8.1.0",
-      "js-yaml": "4.2.0",
+      "js-yaml": "4.3.0",
       "minimist": "^1.2.8"
    },
    "devDependencies": {
diff --git a/src/types/kubectl.test.ts b/src/types/kubectl.test.ts
diff --git a/src/types/kubectl.ts b/src/types/kubectl.ts
