Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[pull] main from ossf:main #104

Open
wants to merge 80 commits into
base: main
Choose a base branch
from
Open

[pull] main from ossf:main #104

wants to merge 80 commits into from

Conversation

pull[bot]
Copy link

@pull pull bot commented Jul 28, 2024 •
edited
Loading

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

justaugustus and others added 28 commits July 2, 2024 10:38
@justaugustus @jeffmendoza
.github: Add initial CODEOWNERS
eb99bd4 
Signed-off-by: Stephen Augustus <foo@auggie.dev>
@dependabot @justaugustus
Bump github.com/hashicorp/go-retryablehttp in the go_modules group
c3b98e3 
Bumps the go_modules group with 1 update: [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp).


Updates `github.com/hashicorp/go-retryablehttp` from 0.7.5 to 0.7.7
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](hashicorp/go-retryablehttp@v0.7.5...v0.7.7)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.10.0 to 2.11.0
4c1aa07 
Bumps [github.com/bradleyfalzon/ghinstallation/v2](https://github.com/bradleyfalzon/ghinstallation) from 2.10.0 to 2.11.0.
- [Release notes](https://github.com/bradleyfalzon/ghinstallation/releases)
- [Commits](bradleyfalzon/ghinstallation@v2.10.0...v2.11.0)

---
updated-dependencies:
- dependency-name: github.com/bradleyfalzon/ghinstallation/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ko-build/setup-ko from 0.6 to 0.7
a23f50d 
Bumps [ko-build/setup-ko](https://github.com/ko-build/setup-ko) from 0.6 to 0.7.
- [Release notes](https://github.com/ko-build/setup-ko/releases)
- [Commits](ko-build/setup-ko@ace48d7...3aebd05)

---
updated-dependencies:
- dependency-name: ko-build/setup-ko
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump golangci/golangci-lint-action from 4 to 6
398db45 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 4 to 6.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v4...v6)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ossf/scorecard-action from 2.1.3 to 2.3.3
8172222 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.3 to 2.3.3.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@v2.1.3...v2.3.3)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump sigstore/cosign-installer from 3.4.0 to 3.5.0
ae7f629 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@e1523de...59acb62)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github.com/rs/zerolog from 1.32.0 to 1.33.0
7939932 
Bumps [github.com/rs/zerolog](https://github.com/rs/zerolog) from 1.32.0 to 1.33.0.
- [Commits](rs/zerolog@v1.32.0...v1.33.0)

---
updated-dependencies:
- dependency-name: github.com/rs/zerolog
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github.com/rhysd/actionlint from 1.6.27 to 1.7.1
9adcbec 
Bumps [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) from 1.6.27 to 1.7.1.
- [Release notes](https://github.com/rhysd/actionlint/releases)
- [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md)
- [Commits](rhysd/actionlint@v1.6.27...v1.7.1)

---
updated-dependencies:
- dependency-name: github.com/rhysd/actionlint
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@step-security-bot @justaugustus
[StepSecurity] ci: Harden GitHub Actions
a10a639 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@dependabot
Bump actions/setup-go from 4.0.1 to 5.0.1
8751603 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.0.1 to 5.0.1.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v4.0.1...cdcb360)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/checkout from 4.1.1 to 4.1.7
dd0a6d4 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.1.7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4.1.1...692973e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@justaugustus @jeffmendoza
go.mod: Update Scorecard to v5.0.0-rc2
5d71b29 
Signed-off-by: Stephen Augustus <foo@auggie.dev>
@justaugustus @jeffmendoza
.github: Create codeql.yml
c66f943 
Signed-off-by: Stephen Augustus <justaugustus@users.noreply.github.com>
@justaugustus @jeffmendoza
CodeQL: Dedupe post-merge configs, pin SHAs, strip add'l permissions
9bcc5c7 
Signed-off-by: Stephen Augustus <foo@auggie.dev>
@justaugustus
docs: Correct instances of "Security Scorecards" to "OpenSSF Scorecard"
e329fdf 
Includes minor fixes to surrounding documentation.

Signed-off-by: Stephen Augustus <foo@auggie.dev>
@justaugustus
README: Correct Scorecard API URL
3ff8fdf 
Signed-off-by: Stephen Augustus <foo@auggie.dev>
@dependabot @justaugustus
Bump actions/upload-artifact from 4.3.3 to 4.3.4
c6ddfbd 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.3.3 to 4.3.4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@6546280...0b2256b)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @jeffmendoza
Bump actions/setup-go from 5.0.1 to 5.0.2
dfc5f57 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.1 to 5.0.2.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@cdcb360...0a12ed9)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 3.25.11 to 3.25.12
a70d55b 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.11 to 3.25.12.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b611370...4fa2a79)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/dependency-review-action from 4.3.3 to 4.3.4
3b9c886 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.3.3 to 4.3.4.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@72eb03d...5a2ce3f)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 3.25.12 to 3.25.13
a89f5bc 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.12 to 3.25.13.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@4fa2a79...2d79040)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github.com/ossf/scorecard/v5 from 5.0.0-rc2 to 5.0.0
e63e249 
Bumps [github.com/ossf/scorecard/v5](https://github.com/ossf/scorecard) from 5.0.0-rc2 to 5.0.0.
- [Release notes](https://github.com/ossf/scorecard/releases)
- [Changelog](https://github.com/ossf/scorecard/blob/main/RELEASE.md)
- [Commits](ossf/scorecard@v5.0.0-rc2...v5.0.0)

---
updated-dependencies:
- dependency-name: github.com/ossf/scorecard/v5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@justaugustus @dependabot
go.mod: Update go directive to go1.12.12
38d990d 
Signed-off-by: Stephen Augustus <foo@auggie.dev>
@dependabot
Bump github/codeql-action from 3.25.13 to 3.25.14
e1316aa 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.13 to 3.25.14.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2d79040...5cf07d8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump gocloud.dev from 0.37.0 to 0.38.0
434ff60 
Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.37.0 to 0.38.0.
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](google/go-cloud@v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: gocloud.dev
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 3.25.14 to 3.25.15
5d4062e 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.14 to 3.25.15.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5cf07d8...afb54ba)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump ossf/scorecard-action from 2.3.3 to 2.4.0
07cd81d 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.3.3 to 2.4.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@dc50aa9...62b2cac)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@pull pull bot requested a review from a team as a code owner July 28, 2024 11:06
@pull pull bot added the ⤵️ pull label Jul 28, 2024
@dependabot
Bump github/codeql-action from 3.27.1 to 3.27.4
24c6ada 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.1 to 3.27.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@4f3212b...ea9e4e3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@contentful-automation contentful-automation bot enabled auto-merge (squash) November 18, 2024 04:18
@dependabot
Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.11.0 to 2.12.0
8a6fbdf 
Bumps [github.com/bradleyfalzon/ghinstallation/v2](https://github.com/bradleyfalzon/ghinstallation) from 2.11.0 to 2.12.0.
- [Release notes](https://github.com/bradleyfalzon/ghinstallation/releases)
- [Commits](bradleyfalzon/ghinstallation@v2.11.0...v2.12.0)

---
updated-dependencies:
- dependency-name: github.com/bradleyfalzon/ghinstallation/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump actions/dependency-review-action from 4.4.0 to 4.5.0
dd40517 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@4081bf9...3b139cf)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1
b5a8d4a 
Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](Masterminds/semver@v3.3.0...v3.3.1)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 3.27.4 to 3.27.5
81e9d7a 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.4 to 3.27.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ea9e4e3...f09c1c0)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump golang.org/x/sync from 0.9.0 to 0.10.0
f92c72c 
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.9.0 to 0.10.0.
- [Commits](golang/sync@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump github/codeql-action from 3.27.5 to 3.27.7
3f9627a 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.5 to 3.27.7.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f09c1c0...babb554)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump golang.org/x/crypto in the go_modules group
00e2013 
Bumps the go_modules group with 1 update: [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `golang.org/x/crypto` from 0.26.0 to 0.31.0
- [Commits](golang/crypto@v0.26.0...v0.31.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @jeffmendoza
build(deps): bump actions/setup-go from 5.1.0 to 5.2.0
e775a1d 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.1.0 to 5.2.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@41dfa10...3041bf5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
auto-merge was automatically disabled December 17, 2024 22:38

Head branch was pushed to by a user without write access

dependabot bot and others added 3 commits December 17, 2024 14:38
@dependabot @jeffmendoza
build(deps): bump github/codeql-action from 3.27.7 to 3.27.9
b00098d 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.27.7 to 3.27.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@babb554...df409f7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@blockmar @jeffmendoza
Build container images for both amd64 and arm64 platforms
b1e2230 
Signed-off-by: Anders Blockmar <blockmar@users.noreply.github.com>
@dependabot @jeffmendoza
build(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0
13447b7 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.4.3 to 4.5.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@b4b15b8...6f51ac0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@contentful-automation contentful-automation[bot] contentful-automation[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
⤵️ pull merge-conflict Resolve conflicts manually
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@justaugustus @step-security-bot @coheigea @SebastianBezold @jeffmendoza @markdboyd @blockmar