chore(deps): update github-actions #786

renovate-bot · 2024-07-01T01:48:40Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	patch	`v4.1.1` -> `v4.1.7`
actions/dependency-review-action	action	minor	`v4.2.5` -> `v4.3.3`
actions/download-artifact	action	patch	`v4.1.4` -> `v4.1.7`
actions/setup-go	action	patch	`v5.0.0` -> `v5.0.1`
actions/upload-artifact	action	patch	`v4.3.1` -> `v4.3.3`
actionsdesk/lfs-warning	action	minor	`v3.2` -> `v3.3`
github/codeql-action	action	minor	`v3.24.9` -> `v3.25.11`
golangci/golangci-lint-action	action	pinDigest	-> `d6238b0`
ossf/scorecard-action	action	patch	`v2.3.1` -> `v2.3.3`
slsa-framework/slsa-github-generator	action	pinDigest	-> `c747fe7`
slsa-framework/slsa-verifier	action	minor	`v2.4.1` -> `v2.5.1`

Release Notes

actions/checkout (actions/checkout)

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in https://github.com/actions/checkout/pull/1739
Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/actions/checkout/pull/1697
Check out other refs/* by commit by @orhantoy in https://github.com/actions/checkout/pull/1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in https://github.com/actions/checkout/pull/1776

What's Changed

Update actions/checkout version in update-main-version.yml by @jww3 in https://github.com/actions/checkout/pull/1650
Check git version before attempting to disable sparse-checkout by @jww3 in https://github.com/actions/checkout/pull/1656
Add SSH user parameter by @cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in https://github.com/actions/checkout/pull/1598

actions/dependency-review-action (actions/dependency-review-action)

`v4.3.3`: Notes for v4.3.3

Compare Source

What's Changed

Allow slashes in purl package names by @juxtin in https://github.com/actions/dependency-review-action/pull/765
use the v3 version of the deps.dev API by @josieang in https://github.com/actions/dependency-review-action/pull/741
PR with suggestions - [Improvement]: Help streamline / simplify dependency review action README by @am-stead in https://github.com/actions/dependency-review-action/pull/773
fix show-openssf-scorecard-levels input by @ramann in https://github.com/actions/dependency-review-action/pull/776
Updates to the contribution guidelines by @jonjanego in https://github.com/actions/dependency-review-action/pull/778
Create issue templates by @jonjanego in https://github.com/actions/dependency-review-action/pull/777
Fix the max comment length issue by @jhutchings1 and @elireisman in https://github.com/actions/dependency-review-action/pull/767
Bump project version to 4.3.3 in prep for a release by @elireisman in https://github.com/actions/dependency-review-action/pull/781

New Contributors

@josieang made their first contribution in https://github.com/actions/dependency-review-action/pull/741
@am-stead made their first contribution in https://github.com/actions/dependency-review-action/pull/773
@ramann made their first contribution in https://github.com/actions/dependency-review-action/pull/776

Full Changelog: actions/dependency-review-action@v4.3.2...v4.3.3

`v4.3.2`

Compare Source

What's Changed

Fix package-url parsing for allow-dependencies-licenses by @juxtin in https://github.com/actions/dependency-review-action/pull/761

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

`v4.3.1`

Compare Source

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See https://github.com/actions/dependency-review-action/pull/753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

`v4.3.0`

Compare Source

New Features

The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

Fix action variable name for scorecard by @lukehinds in https://github.com/actions/dependency-review-action/pull/735
Fix extra https:// in summary by @jhutchings1 in https://github.com/actions/dependency-review-action/pull/748
Bump typescript from 5.3.3 to 5.4.5 by @dependabot in https://github.com/actions/dependency-review-action/pull/744
Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @dependabot in https://github.com/actions/dependency-review-action/pull/737
Show denied packages with red X by @juxtin in https://github.com/actions/dependency-review-action/pull/750
deny-packages configuration option can deny specified version or all packages by @febuiles and @bteng22 in https://github.com/actions/dependency-review-action/pull/733

New Contributors

@bteng22 made their first contribution in https://github.com/actions/dependency-review-action/pull/733
@lukehinds made their first contribution in https://github.com/actions/dependency-review-action/pull/735

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

actions/download-artifact (actions/download-artifact)

`v4.1.7`

Compare Source

What's Changed

Update @actions/artifact dependency by @bethanyj28 in https://github.com/actions/download-artifact/pull/325

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

`v4.1.6`

Compare Source

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in https://github.com/actions/download-artifact/pull/324

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

`v4.1.5`

Compare Source

What's Changed

Update readme with v3/v2/v1 deprecation notice by @robherley in https://github.com/actions/download-artifact/pull/322
Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

actions/setup-go (actions/setup-go)