Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure hidden files input is used #609

Merged

Conversation

joshmgross
Copy link
Member

In #604/#606, the include-hidden-files input is never used so users cannot opt-into including hidden files in their artifact.

With this change, we're now matching v4.4.0 which properly respects this input:
https://github.com/actions/upload-artifact/blob/v4.4.0/src/upload/upload-artifact.ts#L27-L30

@joshmgross joshmgross requested a review from a team as a code owner September 2, 2024 16:35
@joshmgross joshmgross merged commit ff15f03 into v3/node16 Sep 2, 2024
6 checks passed
@joshmgross joshmgross deleted the joshmgross/fix-include-hidden-files-input-node16 branch September 2, 2024 16:45
hogo6002 referenced this pull request in google/osv.dev Sep 5, 2024
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/setup-python](https://github.com/actions/setup-python)
| action | minor | `v5.1.1` -> `v5.2.0` |
|
[actions/upload-artifact](https://github.com/actions/upload-artifact)
| action | minor | `v3.1.3` -> `v3.2.1` |
|
[github/codeql-action](https://github.com/github/codeql-action)
| action | minor | `v2.25.12` -> `v2.26.6` |
|
[ossf/scorecard-action](https://github.com/ossf/scorecard-action)
| action | minor | `v2.3.3` -> `v2.4.0` |
|
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish)
| action | minor | `v1.9.0` -> `v1.10.1` |

---

### Release Notes

<details>
<summary>actions/setup-python (actions/setup-python)</summary>

###
[`v5.2.0`](https://github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

[Compare
Source](https://github.com/actions/setup-python/compare/v5.1.1...v5.2.0)

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.2.1`](https://github.com/actions/upload-artifact/releases/tag/v3.2.1)

[Compare
Source](https://github.com/actions/upload-artifact/compare/v3.2.0...v3.2.1)

#### What's Changed

This fixes the `include-hidden-files` input introduced in
https://github.com/actions/upload-artifact/releases/tag/v3.2.0

- Ensure hidden files input is used by
[@&#8203;joshmgross](https://github.com/joshmgross) in
[https://github.com/actions/upload-artifact/pull/609](https://github.com/actions/upload-artifact/pull/609)

**Full Changelog**:
actions/upload-artifact@v3.2.0...v3.2.1

###
[`v3.2.0`](https://github.com/actions/upload-artifact/releases/tag/v3.2.0)

[Compare
Source](https://github.com/actions/upload-artifact/compare/v3.1.3...v3.2.0)

#### Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the
`upload-artifact` action of this version. This reduces the risk that
credentials are accidentally uploaded into artifacts. Customers who need
to continue to upload these files can use a new option,
`include-hidden-files`, to continue to do so.

See ["Notice of upcoming deprecations and breaking changes in GitHub
Actions
runners"](https://github.blog/changelog/2024-08-19-notice-of-upcoming-deprecations-and-breaking-changes-in-github-actions-runners/)
changelog and [this
issue](https://github.com/actions/upload-artifact/issues/602)
for more details.

#### What's Changed

- V3 backport: Exclude hidden files by default by
[@&#8203;SrRyan](https://github.com/SrRyan) in
[https://github.com/actions/upload-artifact/pull/604](https://github.com/actions/upload-artifact/pull/604)

**Full Changelog**:
actions/upload-artifact@v3.1.3...v3.2.0

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v2.26.6`](https://github.com/github/codeql-action/compare/v2.26.5...v2.26.6)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.5...v2.26.6)

###
[`v2.26.5`](https://github.com/github/codeql-action/compare/v2.26.4...v2.26.5)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.4...v2.26.5)

###
[`v2.26.4`](https://github.com/github/codeql-action/compare/v2.26.3...v2.26.4)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.3...v2.26.4)

###
[`v2.26.3`](https://github.com/github/codeql-action/compare/v2.26.2...v2.26.3)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.2...v2.26.3)

###
[`v2.26.2`](https://github.com/github/codeql-action/compare/v2.26.1...v2.26.2)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.1...v2.26.2)

###
[`v2.26.1`](https://github.com/github/codeql-action/compare/v2.26.0...v2.26.1)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.26.0...v2.26.1)

###
[`v2.26.0`](https://github.com/github/codeql-action/compare/v2.25.15...v2.26.0)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.25.15...v2.26.0)

###
[`v2.25.15`](https://github.com/github/codeql-action/compare/v2.25.14...v2.25.15)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.25.14...v2.25.15)

###
[`v2.25.14`](https://github.com/github/codeql-action/compare/v2.25.13...v2.25.14)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.25.13...v2.25.14)

###
[`v2.25.13`](https://github.com/github/codeql-action/compare/v2.25.12...v2.25.13)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.25.12...v2.25.13)

</details>

<details>
<summary>ossf/scorecard-action (ossf/scorecard-action)</summary>

###
[`v2.4.0`](https://github.com/ossf/scorecard-action/releases/tag/v2.4.0)

[Compare
Source](https://github.com/ossf/scorecard-action/compare/v2.3.3...v2.4.0)

#### What's Changed

This update bumps the Scorecard version to the v5 release. For a
complete list of changes, please refer to the [v5.0.0 release
notes](https://github.com/ossf/scorecard/releases/tag/v5.0.0).
Of special note to Scorecard Action is the Maintainer Annotation
feature, which can be used to suppress some Code Scanning false
positives. Alerts will not be generated for any Scorecard Check with an
annotation.

- 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0
by [@&#8203;spencerschrock](https://github.com/spencerschrock)
in
[https://github.com/ossf/scorecard-action/pull/1410](https://github.com/ossf/scorecard-action/pull/1410)
- 🐛 lower license sarif alert threshold to 9 by
[@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1411](https://github.com/ossf/scorecard-action/pull/1411)

##### Documentation

- docs: dogfooding badge by
[@&#8203;jkowalleck](https://github.com/jkowalleck) in
[https://github.com/ossf/scorecard-action/pull/1399](https://github.com/ossf/scorecard-action/pull/1399)

#### New Contributors

- [@&#8203;jkowalleck](https://github.com/jkowalleck) made
their first contribution in
[https://github.com/ossf/scorecard-action/pull/1399](https://github.com/ossf/scorecard-action/pull/1399)

**Full Changelog**:
ossf/scorecard-action@v2.3.3...v2.4.0

</details>

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.10.1`](https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.10.1)

[Compare
Source](https://github.com/pypa/gh-action-pypi-publish/compare/v1.10.0...v1.10.1)

#### 🚑🔏 Oopsie... We missed a tiny bug in the attestations feature the
other day

The problem was that the distribution file validity check was failing on
any valid distribution being present and ready to be signed. What a
silly mistake! It's now been fixed via
pypa/gh-action-pypi-publish@0ab0b79, though.
So everything's good!

\--
[@&#8203;webknjaz](https://github.com/webknjaz)[💰](https://github.com/sponsors/webknjaz)

> \[!IMPORTANT]
> ✨ Despite this minor hiccup, we invite you to still opt into trying
this feature out early. [It can be
enabled](https://github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations)
like this:
>
> ```yml
>   with:
>     attestations: true
> ```
>
> Leave feedback in [the v1.10.0 release
discussion](https://github.com/pypa/gh-action-pypi-publish/discussions/255)
or [the
PR](https://github.com/pypa/gh-action-pypi-publish/pull/236).

**🪞 Full Diff**:
pypa/gh-action-pypi-publish@v1.10.0...v1.10.1

**🧔‍♂️ Release Manager:** [@&#8203;webknjaz
🇺🇦](https://github.com/sponsors/webknjaz)

**🙏 Special Thanks** to
[@&#8203;hugovk](https://github.com/hugovk)[💰](https://github.com/sponsors/hugovk)
for [promptly validating the bug
fix](https://github.com/pypa/gh-action-pypi-publish/issues/256#issuecomment-2325925847),
mere minutes after I pushed it — I even haven't finished writing this
text by then!

###
[`v1.10.0`](https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.10.0)

[Compare
Source](https://github.com/pypa/gh-action-pypi-publish/compare/v1.9.0...v1.10.0)

#### 🔏 Anything fancy, eh?

This time,
[@&#8203;woodruffw](https://github.com/woodruffw)[💰](https://github.com/sponsors/woodruffw)
implemented support for [PEP 740] attestations functionality in
[#&#8203;236](https://github.com/pypa/gh-action-pypi-publish/issues/236)
and
[#&#8203;245](https://github.com/pypa/gh-action-pypi-publish/issues/245).
This is a big deal, as it is a huge step forward to replacing what the
deprecated GPG signatures used to provide in a more meaningful way.

> \[!IMPORTANT]
> ✨ Please, do opt into trying this feature out early. [It can be
enabled](https://github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations)
as follows:
>
> ```yml
>   with:
>     attestations: true
> ```
>
> Leave any feedback on this in [this release
discussion](https://github.com/pypa/gh-action-pypi-publish/discussions/255)
or [the
PR](https://github.com/pypa/gh-action-pypi-publish/pull/236).

🙏 And please, thank William for working on this amazing improvement for
the ecosystem! The overall effort is tracked
@&#[https://github.com/pypi/warehouse/issues/15871](https://github.com/pypi/warehouse/issues/15871)/15871,
by the way.

**🪞 Full Diff**:
pypa/gh-action-pypi-publish@v1.9.0...v1.10.0

**🧔‍♂️ Release Manager:** [@&#8203;webknjaz
🇺🇦](https://github.com/sponsors/webknjaz)

[PEP 740]: https://peps.python.org/pep-0740/

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
github-merge-queue bot referenced this pull request in AmadeusITGroup/otter Sep 9, 2024
This PR contains the following updates:

| Package | Type | Update | Change | Age | Adoption | Passing |
Confidence |
|---|---|---|---|---|---|---|---|
|
[actions/upload-artifact](https://github.com/actions/upload-artifact)
| action | patch | `v3.2.0` -> `v3.2.1` |
[![age](https://developer.mend.io/api/mc/badges/age/github-tags/actions%2fupload-artifact/v3.2.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/github-tags/actions%2fupload-artifact/v3.2.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/github-tags/actions%2fupload-artifact/v3.2.0/v3.2.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/actions%2fupload-artifact/v3.2.0/v3.2.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [sass](https://github.com/sass/dart-sass) | peerDependencies
| minor | [`~1.77.0` ->
`~1.78.0`](https://renovatebot.com/diffs/npm/sass/1.77.8/1.78.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/sass/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/sass/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/sass/1.77.8/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass/1.77.8/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [sass](https://github.com/sass/dart-sass) | devDependencies |
minor | [`~1.77.0` ->
`~1.78.0`](https://renovatebot.com/diffs/npm/sass/1.77.8/1.78.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/sass/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/sass/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/sass/1.77.8/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/sass/1.77.8/1.78.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.2.1`](https://github.com/actions/upload-artifact/releases/tag/v3.2.1)

[Compare
Source](https://github.com/actions/upload-artifact/compare/v3.2.0...v3.2.1)

#### What's Changed

This fixes the `include-hidden-files` input introduced in
https://github.com/actions/upload-artifact/releases/tag/v3.2.0

- Ensure hidden files input is used by
[@&#8203;joshmgross](https://github.com/joshmgross) in
[https://github.com/actions/upload-artifact/pull/609](https://github.com/actions/upload-artifact/pull/609)

**Full Changelog**:
actions/upload-artifact@v3.2.0...v3.2.1

</details>

<details>
<summary>sass/dart-sass (sass)</summary>

###
[`v1.78.0`](https://github.com/sass/dart-sass/blob/HEAD/CHANGELOG.md#1780)

[Compare
Source](https://github.com/sass/dart-sass/compare/1.77.8...1.78.0)

- The `meta.feature-exists` function is now deprecated. This deprecation
is
    named `feature-exists`.

- Fix a crash when using `@at-root` without any queries or children in
the
    indented syntax.

##### JS API

- Backport the deprecation options (`fatalDeprecations`,
`futureDeprecations`,
and `silenceDeprecations`) to the legacy JS API. The legacy JS API is
itself
deprecated, and you should move off of it if possible, but this will
allow
users of bundlers and other tools that are still using the legacy API to
    still control deprecation warnings.

- Fix a bug where accessing `SourceSpan.url` would crash when a relative
URL was
    passed to the Sass API.

##### Embedded Sass

- Explicitly expose a `sass` executable from the `sass-embedded` npm
package.
    This was intended to be included in 1.63.0, but due to the way
platform-specific dependency executables are installed it did not work
as
intended. Now users can run `npx sass` for local installs or just `sass`
when
    `sass-embedded` is installed globally.

- Add linux-riscv64, linux-musl-riscv64, and android-riscv64 support for
the
    `sass-embedded` npm package.

- Fix an edge case where the Dart VM could hang when shutting down when
requests
    were in flight.

- Fix a race condition where the embedded host could fail to shut down
if it was
    closed around the same time a new compilation was started.

- Fix a bug where parse-time deprecation warnings could not be
controlled by
    the deprecation options in some circumstances.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/AmadeusITGroup/otter).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC41OS4yIiwidXBkYXRlZEluVmVyIjoiMzguNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants