Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the github-actions group across 1 directory with 13 updates #302

Closed
wants to merge 1 commit into from
Closed

Bump the github-actions group across 1 directory with 13 updates #302

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 10, 2024 •
edited
Loading

Bumps the github-actions group with 13 updates in the / directory:

Package From To
step-security/harden-runner 2.5.1 2.8.1
actions/checkout 3.5.3 4.1.6
EmbarkStudios/cargo-deny-action 1.5.5 1.6.3
docker/login-action 3.0.0 3.2.0
docker/metadata-action 5.0.0 5.5.1
docker/build-push-action 5.0.0 5.4.0
peter-evans/dockerhub-description 3.4.2 4.0.0
fsfe/reuse-action 2 3
github/codeql-action 2.22.5 3.25.8
ossf/scorecard-action 2.3.1 2.3.3
actions/upload-artifact 3.1.2 4.3.3
crate-ci/typos 1.16.21 1.22.3
codecov/codecov-action 3 4

Updates step-security/harden-runner from 2.5.1 to 2.8.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.8.1

What's Changed

  • Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in step-security/harden-runner#425 The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

v2.8.0

What's Changed

Release v2.8.0 by @​h0x0er and @​varunsh-coder in step-security/harden-runner#416 This release includes:

  • File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
  • Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

v2.7.1

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in step-security/harden-runner#397 This release:

  • Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
  • Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
  • Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

v2.7.0

What's Changed

Release 2.7.0 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#376 This release:

  1. Updates the node runtime to node20
  2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

v2.6.1

What's Changed

Release v2.6.1 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#356 This release:

  1. Improves the job summary markdown written by the Harden-Runner Action
  2. Improves detection of cache endpoint used by the job
  3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
  4. Updates dependencies

Full Changelog: step-security/harden-runner@v2...v2.6.1

v2.6.0

... (truncated)

Commits
  • 17d0e2b Merge pull request #425 from step-security/rc-9
  • bb112d0 Update isGitHubHosted implementation
  • f4f3f44 Merge pull request #407 from step-security/dependabot/github_actions/actions/...
  • 7a946b5 Bump actions/dependency-review-action from 3.1.3 to 4.3.2
  • 75a01c2 Merge pull request #417 from step-security/dependabot/github_actions/step-sec...
  • 53413f1 Bump step-security/harden-runner from 2.7.1 to 2.8.0
  • f086349 Merge pull request #416 from step-security/rc-8
  • b9c325d Update image
  • 808a771 Add info about file and process events
  • 7171429 Update agent
  • Additional commits viewable in compare view

Updates actions/checkout from 3.5.3 to 4.1.6

Release notes

Sourced from actions/checkout's releases.

v4.1.6

What's Changed

Full Changelog: actions/checkout@v4.1.5...v4.1.6

v4.1.5

What's Changed

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

What's Changed

Full Changelog: actions/checkout@v4.1.3...v4.1.4

v4.1.3

What's Changed

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

We are investigating the following issue with this release and have rolled-back the v4 tag to point to v4.1.1

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.1.1...v4.1.2

... (truncated)

Commits

Updates EmbarkStudios/cargo-deny-action from 1.5.5 to 1.6.3

Release notes

Sourced from EmbarkStudios/cargo-deny-action's releases.

v1.6.1

Fixed

  • PR#626 resolved #625 by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license.

v1.6.0

action changes

  • Color output is now always enabled so that colors show up in the action output.

0.14.15

Added

  • PR#618 added metadata notes to diagnostics when a license is rejected, as well as removing span information for accepted licenses unless the log level is info or higher to make the diagnostic clearer by default.

0.14.14

Fixed

  • PR#617 resolved #576 by updating the SPDX license list to 3.23.

0.14.13

Fixed

  • PR#615 fixed an issue introduced in PR#605 where the various bans diagnostic codes could not have their lint level changed via the CLI. It also introduced the deprecated diagnostic code.

0.14.12

Changed

  • PR#605 did a major refactor of configuration, both how it is deserialized and changing (hopefully improving) many options.
  • PR#605 moved targets, exclude, all-features, features, no-default-features, and exclude into the [graph] table.
  • PR#605 moved feature-depth into the [output] table.

Added

  • PR#613 added support for basic shell expansion to advisories.db-path, which expands support beyond just ~ to include environment variable expansion.

Fixed

  • PR#601 resolved #600 by outputting the correct spans when a license was both allowed and denied.
  • PR#605 resolved #264 be replacing toml and serde with toml-span.
  • PR#605 resolved #539 by simplifying the very common name = "<crate_name>", version = "<requirements>" used to target specific crates into either a plain package spec string or the simpler crate = "<package spec>".
  • PR#605 resolved #578 by adding a reason = "<reason>" field to many fields within the configuration that are provided in diagnostics. [bans.deny] also has an additional use-instead = "<url/crate_name>". PR#610 did this for the advisories.ignore field.
  • PR#605 resolved #579 by allowing yanked crates to be ignored by specifying a PackageSpec in the [advisories.ignore] array.

Deprecated

  • PR#606 and PR#611 together deprecated several fields listed below. See PR#611 for how to change your config to opt-in to the new behavior that will become the default when the deprecated fields are removed in a future minor version.
    • [advisories]
      • vulnerability
      • unmaintained
      • unsound
      • notice
      • severity-threshold
    • [licenses]
      • unlicensed
      • allow-osi-fsf-free
      • copyleft
      • default
      • deny
Commits

Updates docker/login-action from 3.0.0 to 3.2.0

Release notes

Sourced from docker/login-action's releases.

v3.2.0

Full Changelog: docker/login-action@v3.1.0...v3.2.0

v3.1.0

Full Changelog: docker/login-action@v3.0.0...v3.1.0

Commits
  • 0d4c9c5 Merge pull request #722 from crazy-max/update-readme
  • b29e14f add contributing section to README
  • 218a70c Merge pull request #721 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • b820080 build(deps): bump @​docker/actions-toolkit from 0.23.0 to 0.24.0
  • 27530a9 Merge pull request #720 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • d072a60 chore: update generated content
  • 7c627b5 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • 787cfc6 Merge pull request #694 from docker/dependabot/npm_and_yarn/undici-5.28.4
  • 8e66e91 chore: update generated content
  • 5ba5e97 build(deps): bump undici from 5.28.3 to 5.28.4
  • Additional commits viewable in compare view

Updates docker/metadata-action from 5.0.0 to 5.5.1

Release notes

Sourced from docker/metadata-action's releases.

v5.5.1

Full Changelog: docker/metadata-action@v5.5.0...v5.5.1

v5.5.0

Full Changelog: docker/metadata-action@v5.4.0...v5.5.0

v5.4.0

Full Changelog: docker/metadata-action@v5.3.0...v5.4.0

v5.3.0

Full Changelog: docker/metadata-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/metadata-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/metadata-action@v5.0.0...v5.1.0

Commits
  • 8e5442c Merge pull request #382 from crazy-max/dont-set-cwd-prefix
  • eda41b7 chore: update generated content
  • 388c08f don't set cwd:// prefix for local bake files
  • dbef880 Merge pull request #374 from docker/dependabot/npm_and_yarn/moment-timezone-0...
  • b73e7a7 chore: update generated content
  • b9fba69 chore(deps): Bump moment-timezone from 0.5.43 to 0.5.44
  • ac82374 Merge pull request #373 from docker/dependabot/npm_and_yarn/moment-2.30.1
  • c92519a chore: update generated content
  • 3b4179d chore(deps): Bump moment from 2.29.4 to 2.30.1
  • 0784993 Merge pull request #371 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates docker/build-push-action from 5.0.0 to 5.4.0

Release notes

Sourced from docker/build-push-action's releases.

v5.4.0

Full Changelog: docker/build-push-action@v5.3.0...v5.4.0

v5.3.0

Full Changelog: docker/build-push-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/build-push-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/build-push-action@v5.0.0...v5.1.0

Commits
  • ca052bb Merge pull request #1128 from crazy-max/builder-info
  • 025c205 chore: update generated content
  • 12076d2 show builder information before building
  • ef6cba3 Merge pull request #1127 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 4c16cf9 chore: update generated content
  • a3118a8 fixes since moved types
  • c86eb8b chore(deps): Bump @​docker/actions-toolkit from 0.23.0 to 0.24.0
  • 2a53c6c Merge pull request #1122 from crazy-max/update-dev-deps
  • ccef1f2 chore: update generated content
  • 79117b6 chore: update dev dependencies
  • Additional commits viewable in compare view

Updates peter-evans/dockerhub-description from 3.4.2 to 4.0.0

Release notes

Sourced from peter-evans/dockerhub-description's releases.

Docker Hub Description v4.0.0

⚙️ Updated runtime to Node.js 20

  • The action now requires a minimum version of v2.308.0 for the Actions runner. Update self-hosted runners to v2.308.0 or later to ensure compatibility.

What's Changed

... (truncated)

Commits
  • e98e4d1 feat: update runtime to node 20 (#246)
  • 487b453 build(deps-dev): bump @​types/node from 16.18.70 to 16.18.73 (#245)
  • f4367f9 build(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#244)
  • 48ae68f build(deps-dev): bump @​types/node from 16.18.69 to 16.18.70 (#241)
  • dfc61b8 build(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#243)
  • 74967fb build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#242)
  • 7ea9d27 build(deps-dev): bump @​types/node from 16.18.68 to 16.18.69 (#240)
  • 7bc76ab build(deps-dev): bump eslint-plugin-prettier from 5.0.1 to 5.1.2 (#239)
  • 5a219e7 build(deps): bump actions/download-artifact from 3 to 4 (#236)
  • fb37f44 build(deps-dev): bump eslint from 8.55.0 to 8.56.0 (#238)
  • Additional commits viewable in compare view

Updates fsfe/reuse-action from 2 to 3

Release notes

Sourced from fsfe/reuse-action's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: fsfe/reuse-action@v2.0.0...v3.0.0

Commits
  • a46482c Merge pull request #28 from fsfe/reuse-v3
  • cd6bf02 test all major versions in workflow
  • 577d39f bump to reuse-tool major version 3
  • 4a900d3 Merge pull request #25 from ChristianTackeGSI/main
  • 1e652d5 chore: upgrade checkout step to v4
  • 9522816 rename master -> main
  • c1c6c29 Merge pull request #23 from fsfe/ci-expand-tests
  • 7247931 improve and extend CI pipeline
  • See full diff in compare view

Updates github/codeql-action from 2.22.5 to 3.25.8

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.8 - 04 Jun 2024

  • Update default CodeQL bundle version to 2.17.4. #2321

3.25.7 - 31 May 2024

  • We are rolling out a feature in May/June 2024 that will reduce the Actions cache usage of the Action by keeping only the newest TRAP cache for each language. #2306

3.25.6 - 20 May 2024

  • Update default CodeQL bundle version to 2.17.3. #2295

3.25.5 - 13 May 2024

  • Add a compatibility matrix of supported CodeQL Action, CodeQL CLI, and GitHub Enterprise Server versions to the https://github.com/github/codeql-action/blob/main/README.md. #2273
  • Avoid printing out a warning for a missing on.push trigger when the CodeQL Action is triggered via a workflow_call event. #2274
  • The tools: latest input to the init Action has been renamed to tools: linked. This option specifies that the Action should use the tools shipped at the same time as th...

    Description has been truncated

@dependabot
Bump the github-actions group across 1 directory with 13 updates
bdbae85 
Bumps the github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.5.1` | `2.8.1` |
| [actions/checkout](https://github.com/actions/checkout) | `3.5.3` | `4.1.6` |
| [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) | `1.5.5` | `1.6.3` |
| [docker/login-action](https://github.com/docker/login-action) | `3.0.0` | `3.2.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.0.0` | `5.5.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `5.0.0` | `5.4.0` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `3.4.2` | `4.0.0` |
| [fsfe/reuse-action](https://github.com/fsfe/reuse-action) | `2` | `3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `2.22.5` | `3.25.8` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.3.3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `3.1.2` | `4.3.3` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.16.21` | `1.22.3` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `4` |



Updates `step-security/harden-runner` from 2.5.1 to 2.8.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.5.1...17d0e2b)

Updates `actions/checkout` from 3.5.3 to 4.1.6
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v3.5.3...v4.1.6)

Updates `EmbarkStudios/cargo-deny-action` from 1.5.5 to 1.6.3
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](EmbarkStudios/cargo-deny-action@1e59595...3f4a782)

Updates `docker/login-action` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@343f7c4...0d4c9c5)

Updates `docker/metadata-action` from 5.0.0 to 5.5.1
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@96383f4...8e5442c)

Updates `docker/build-push-action` from 5.0.0 to 5.4.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@0565240...ca052bb)

Updates `peter-evans/dockerhub-description` from 3.4.2 to 4.0.0
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@dc67fad...e98e4d1)

Updates `fsfe/reuse-action` from 2 to 3
- [Release notes](https://github.com/fsfe/reuse-action/releases)
- [Commits](fsfe/reuse-action@v2...v3)

Updates `github/codeql-action` from 2.22.5 to 3.25.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@74483a3...2e230e8)

Updates `ossf/scorecard-action` from 2.3.1 to 2.3.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@0864cf1...dc50aa9)

Updates `actions/upload-artifact` from 3.1.2 to 4.3.3
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v3.1.2...6546280)

Updates `crate-ci/typos` from 1.16.21 to 1.22.3
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@47dd297...8382594)

Updates `codecov/codecov-action` from 3 to 4
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v4)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: peter-evans/dockerhub-description
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: fsfe/reuse-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 10, 2024
@dependabot dependabot bot mentioned this pull request Jun 10, 2024
Closed
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Jun 17, 2024

Superseded by #303.

@dependabot dependabot bot closed this Jun 17, 2024
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-22dcf093de branch June 17, 2024 17:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants