chore(deps): bump gittools/actions to v4.4.2

[dependabot]

User description

Bumps gittools/actions from 4.3.3 to 4.4.2.

Release notes

Sourced from gittools/actions's releases.

v4.4.2

As part of this release we had 3 commits which resulted in 1 issue being closed.

Bug

• [#2006](GitTools/actions#2006) [ISSUE]: Upgrade GitVersionTask from 4.3.3 to 4.4.1 breaks /overrideconfig

SHA256 Hashes of the release artifacts

• 203023fae8db443599353c7a3d5fc2cf84efc7c6e5aa0b6a466bb6ac20b205c0 - gittools.gittools-4.4.2.260316134.vsix

v4.4.1

As part of this release we had 4 commits which resulted in 1 issue being closed.

Bug

• [#2001](GitTools/actions#2001) [Bug]: Updating the versions in docs and workflows on new release

SHA256 Hashes of the release artifacts

• c8c9754a01a5c4de9def15f1012776d9a42cd904d5c1119ebe169bc88eb9e69b - gittools.gittools-4.4.1.260316032.vsix

v4.4.0

As part of this release we had 49 commits which resulted in 2 issues being closed.

Bug

• [#1912](GitTools/actions#1912) [ISSUE]: gitversion-execute@4.2.0 fails on Windows (with self hosted agent?)

Improvements

• [#1992](GitTools/actions#1992) [ISSUE]: NodeJS20 will be deprecated in Github ACtions

SHA256 Hashes of the release artifacts

• a9c2459127afc0451fb36b38a68d9755b212d707218bd5181bdcff531f84975f - gittools.gittools-4.4.0.260316014.vsix

Commits

• e0d584e Merge pull request #2005 from denisbredikhin/argument-escaping-fix
• bc42486 fix: remove escape logic to make execFile compatible
• 4669e3b update examples version to 4.4.1
• 63daa16 Merge pull request #2002 from GitTools/fix/update-version
• d8a3bc7 ci(versioning): Enhance GitVersion update logic in workflows
• a7cf940 ci(examples-version): Use service account for checkout and enhance logging
• 153a67d update examples version to 4.4.0
• 639a719 refactor(node): Use node: protocol for built-in module imports
• 5ee1a94 dist update
• aa5b939 Merge pull request #1988 from denisbredikhin/exec-fix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

PR Type

Enhancement

---

Description

• Update GitVersion actions to v4.4.2

• Refresh deploy workflow dependency versions

---

Diagram Walkthrough

flowchart LR
  deploy["Deploy workflow"]
  setup["`gitversion/setup@v4.4.2`"]
  execute["`gitversion/execute@v4.4.2`"]
  deploy -- "installs" --> setup
  deploy -- "runs versioning" --> execute

Loading

File Walkthrough

	Relevant files
Dependencies	deploy.yml Upgrade GitVersion actions in deploy workflow                        .github/workflows/deploy.yml Bump gittools/actions/gitversion/setup from v4.3.3 to v4.4.2 Bump gittools/actions/gitversion/execute from v4.3.3 to v4.4.2 +2/-2

---

[sophie-syntax]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns GitHub Action pinning: the updated workflow references gittools/actions by a mutable version tag (@v4.4.2) instead of an immutable commit SHA. This carries some supply-chain risk if the tag is ever moved or the upstream action is compromised. Consider pinning to a full commit SHA for stronger integrity guarantees.

⚡ Recommended focus areas for review Compatibility Validate that gittools/actions v4.4.2 does not change gitversion outputs, defaults, or execution behavior in a way that affects downstream tagging or versioning steps in this workflow. uses: gittools/actions/gitversion/setup@v4.4.2 with: versionSpec: "6.x" - name: Version with GitVersion # https://github.com/marketplace/actions/use-actions id: gitversion uses: gittools/actions/gitversion/execute@v4.4.2

[sophie-syntax]

Suggestion: Pin these third-party GitHub Actions to immutable commit SHAs instead of a movable tag. Relying on v4.4.2 leaves the workflow exposed to a supply-chain compromise if that tag is ever retargeted upstream. [security, importance: 8]

Suggested change

	uses: gittools/actions/gitversion/setup@v4.4.2
	with:
	versionSpec: "6.x"
	- name: Version with GitVersion # https://github.com/marketplace/actions/use-actions
	id: gitversion
	uses: gittools/actions/gitversion/execute@v4.3.3
	uses: gittools/actions/gitversion/execute@v4.4.2
	uses: gittools/actions/gitversion/setup@<full-length-commit-sha> # v4.4.2
	...
	uses: gittools/actions/gitversion/execute@<full-length-commit-sha> # v4.4.2

[dependabot]

Superseded by #69.