Update deps (#256)

.github/workflows/compile-versions.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: 'ubuntu-latest'
 
     steps:
-      - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29' # ratchet:actions/checkout@v4
 
-      - uses: 'actions/setup-go@v5'
+      - uses: 'actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7' # ratchet:actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version-file: 'go.mod'
 
       - name: 'Get versions list'
         run: |-
@@ -51,7 +51,7 @@ jobs:
 
       - name: 'Create Pull Request'
         if: steps.updates.outputs.had_changes == 'true'
-        uses: 'actions/github-script@v7'
+        uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea' # ratchet:actions/github-script@v7
         with:
           github-token: '${{ secrets.ACTIONS_BOT_TOKEN }}'
           script: |-

.github/workflows/draft-release.yml

@@ -16,7 +16,7 @@ on:
 jobs:
   draft-release:
     name: 'Draft release'
-    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v0'
+    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v0' # ratchet:exclude
     with:
       version_strategy: '${{ github.event.inputs.version_strategy }}'
     # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow

.github/workflows/release.yml

@@ -10,22 +10,25 @@ jobs:
   release:
     if: |-
       ${{ startsWith(github.event.head_commit.message, 'Release: v') }}
-    uses: 'google-github-actions/.github/.github/workflows/release.yml@v0'
+    uses: 'google-github-actions/.github/.github/workflows/release.yml@v0' # ratchet:exclude
 
   publish:
     needs:
       - 'release'
+    permissions:
+      contents: 'read'
+      id-token: 'write'
     runs-on: 'ubuntu-latest'
 
     steps:
-      - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29' # ratchet:actions/checkout@v4
 
-      - uses: 'actions/setup-node@v4'
+      - uses: 'actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8' # ratchet:actions/setup-node@v4
         with:
           node-version: '20.x'
           registry-url: 'https://wombat-dressing-room.appspot.com/'
 
       - env:
           NODE_AUTH_TOKEN: '${{ secrets.NODE_AUTH_TOKEN }}'
         run: |-
-          npm publish
+          npm publish --provenance --access public

.github/workflows/unit.yml

@@ -27,9 +27,9 @@ jobs:
     runs-on: '${{ matrix.os }}'
 
     steps:
-      - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29' # ratchet:actions/checkout@v4
 
-      - uses: 'actions/setup-node@v4'
+      - uses: 'actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8' # ratchet:actions/setup-node@v4
         with:
           node-version: '20.12.x' # https://github.com/nodejs/node/issues/53033