[singlerider]

ubuntu-latest is a label GitHub moves. The image behind it changes on GitHub's schedule, and a pipeline nobody touched goes red on a Tuesday. This pins every job to ubuntu-24.04 so the runner moves when we move it.

Action refs are left alone. Version-tagged actions stay on their tags and Dependabot keeps bumping them.

Validation

actionlint clean on the changed workflows. No logic, matrix, or step changes: only the runs-on: value.

Part of https://github.com/blacklanternsecurity/bbot-enterprise/issues/149.

[github-actions]

📊 Performance Benchmark Report

Comparing dev (baseline) vs chore/pin-actions-sha (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	2.89ms	3.07ms	+6.4% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	11.67ms	13.12ms	+12.4% 🟡🟡	⚠️
Large Closest Match Lookup	258.75ms	266.20ms	+2.9% ⚪	✅
Realistic Closest Match Workload	142.19ms	140.98ms	-0.9% ⚪	✅
Event Memory Medium Scan	1402 B/event	1402 B/event	+0.0% ⚪	✅
Event Memory Large Scan	1527 B/event	1527 B/event	+0.0% ⚪	✅
Event Validation Full Scan Startup Small Batch	313.56ms	313.63ms	+0.0% ⚪	✅
Event Validation Full Scan Startup Large Batch	402.35ms	399.09ms	-0.8% ⚪	✅
Make Event Autodetection Small	16.46ms	16.00ms	-2.8% ⚪	✅
Make Event Autodetection Large	162.73ms	161.24ms	-0.9% ⚪	✅
Make Event Explicit Types	6.73ms	6.68ms	-0.8% ⚪	✅
Excavate Single Thread Small	3.318s	3.153s	-5.0% ⚪	✅
Excavate Single Thread Large	7.650s	7.504s	-1.9% ⚪	✅
Excavate Parallel Tasks Small	3.321s	3.196s	-3.8% ⚪	✅
Excavate Parallel Tasks Large	5.250s	5.000s	-4.8% ⚪	✅
Intercept Throughput Small	783.00ms	769.82ms	-1.7% ⚪	✅
Intercept Throughput Medium	848.93ms	815.55ms	-3.9% ⚪	✅
Dns Throughput Quiet	1.984s	1.922s	-3.1% ⚪	✅
Dns Throughput Loaded	1.469s	1.502s	+2.3% ⚪	✅
Dns Throughput Inherited	1.656s	1.694s	+2.3% ⚪	✅
Is Ip Performance	1.88ms	1.74ms	-7.3% ⚪	✅
Make Ip Type Performance	162.04µs	165.36µs	+2.0% ⚪	✅
Mixed Ip Operations	1.93ms	1.80ms	-6.7% ⚪	✅
Memory Use Web Crawl	1.2 MB	1.2 MB	+0.0% ⚪	✅
Memory Use Subdomain Enum	28.3 MB	28.3 MB	+0.0% ⚪	✅
Memory Use Deep Chain	5.0 MB	5.0 MB	+0.0% ⚪	✅
Memory Use Parallel Chains	11.6 MB	13.4 MB	+15.2% 🟡🟡	⚠️
Scan Throughput 100	2.078s	2.008s	-3.4% ⚪	✅
Scan Throughput 1000	13.741s	13.675s	-0.5% ⚪	✅
Typical Queue Shuffle	4.26µs	4.27µs	+0.4% ⚪	✅
Priority Queue Shuffle	21.08µs	21.06µs	-0.1% ⚪	✅

🎯 Performance Summary

! 2 regressions ⚠️
  29 unchanged ✅

🔍 Significant Changes (>10%)

• Bloom Filter Large Scale Dns Brute Force: 12.4% 🐌 slower
• Memory Use Parallel Chains: 15.2% 🐌 more memory

---

🐍 Python Version 3.11.16

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (f52732d) to head (81733f4).
⚠️ Report is 1 commits behind head on dev.

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3456   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        459     459           
  Lines      48523   48523           
=====================================
- Hits       43649   43645    -4     
- Misses      4874    4878    +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[liquidsec]

@singlerider My only concern is if we lose dependabot coverage, and if we do, whether we have a plan to ensure reasonable updates of the actions.