Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the github-actions group across 1 directory with 13 updates #303

Closed
wants to merge 1 commit into from
Closed

Bump the github-actions group across 1 directory with 13 updates #303

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 17, 2024 •
edited
Loading

Bumps the github-actions group with 13 updates in the / directory:

Package From To
step-security/harden-runner 2.5.1 2.8.1
actions/checkout 3.5.3 4.1.7
EmbarkStudios/cargo-deny-action 1.5.5 1.6.3
docker/login-action 3.0.0 3.2.0
docker/metadata-action 5.0.0 5.5.1
docker/build-push-action 5.0.0 6.0.0
peter-evans/dockerhub-description 3.4.2 4.0.0
fsfe/reuse-action 2 3
github/codeql-action 2.22.5 3.25.10
ossf/scorecard-action 2.3.1 2.3.3
actions/upload-artifact 3.1.2 4.3.3
crate-ci/typos 1.16.21 1.22.7
codecov/codecov-action 3 4

Updates step-security/harden-runner from 2.5.1 to 2.8.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.8.1

What's Changed

  • Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in step-security/harden-runner#425 The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

v2.8.0

What's Changed

Release v2.8.0 by @​h0x0er and @​varunsh-coder in step-security/harden-runner#416 This release includes:

  • File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
  • Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

v2.7.1

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in step-security/harden-runner#397 This release:

  • Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
  • Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
  • Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

v2.7.0

What's Changed

Release 2.7.0 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#376 This release:

  1. Updates the node runtime to node20
  2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

v2.6.1

What's Changed

Release v2.6.1 by @​varunsh-coder and @​h0x0er in step-security/harden-runner#356 This release:

  1. Improves the job summary markdown written by the Harden-Runner Action
  2. Improves detection of cache endpoint used by the job
  3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
  4. Updates dependencies

Full Changelog: step-security/harden-runner@v2...v2.6.1

v2.6.0

... (truncated)

Commits
  • 17d0e2b Merge pull request #425 from step-security/rc-9
  • bb112d0 Update isGitHubHosted implementation
  • f4f3f44 Merge pull request #407 from step-security/dependabot/github_actions/actions/...
  • 7a946b5 Bump actions/dependency-review-action from 3.1.3 to 4.3.2
  • 75a01c2 Merge pull request #417 from step-security/dependabot/github_actions/step-sec...
  • 53413f1 Bump step-security/harden-runner from 2.7.1 to 2.8.0
  • f086349 Merge pull request #416 from step-security/rc-8
  • b9c325d Update image
  • 808a771 Add info about file and process events
  • 7171429 Update agent
  • Additional commits viewable in compare view

Updates actions/checkout from 3.5.3 to 4.1.7

Release notes

Sourced from actions/checkout's releases.

v4.1.7

What's Changed

New Contributors

Full Changelog: actions/checkout@v4.1.6...v4.1.7

v4.1.6

What's Changed

Full Changelog: actions/checkout@v4.1.5...v4.1.6

v4.1.5

What's Changed

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

What's Changed

Full Changelog: actions/checkout@v4.1.3...v4.1.4

v4.1.3

What's Changed

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

... (truncated)

Commits

Updates EmbarkStudios/cargo-deny-action from 1.5.5 to 1.6.3

Release notes

Sourced from EmbarkStudios/cargo-deny-action's releases.

v1.6.1

Fixed

  • PR#626 resolved #625 by explicitly checking that a license identified as Pixar was actually (probably) the Pixar license, instead of a normal Apache-2.0 license.

v1.6.0

action changes

  • Color output is now always enabled so that colors show up in the action output.

0.14.15

Added

  • PR#618 added metadata notes to diagnostics when a license is rejected, as well as removing span information for accepted licenses unless the log level is info or higher to make the diagnostic clearer by default.

0.14.14

Fixed

  • PR#617 resolved #576 by updating the SPDX license list to 3.23.

0.14.13

Fixed

  • PR#615 fixed an issue introduced in PR#605 where the various bans diagnostic codes could not have their lint level changed via the CLI. It also introduced the deprecated diagnostic code.

0.14.12

Changed

  • PR#605 did a major refactor of configuration, both how it is deserialized and changing (hopefully improving) many options.
  • PR#605 moved targets, exclude, all-features, features, no-default-features, and exclude into the [graph] table.
  • PR#605 moved feature-depth into the [output] table.

Added

  • PR#613 added support for basic shell expansion to advisories.db-path, which expands support beyond just ~ to include environment variable expansion.

Fixed

  • PR#601 resolved #600 by outputting the correct spans when a license was both allowed and denied.
  • PR#605 resolved #264 be replacing toml and serde with toml-span.
  • PR#605 resolved #539 by simplifying the very common name = "<crate_name>", version = "<requirements>" used to target specific crates into either a plain package spec string or the simpler crate = "<package spec>".
  • PR#605 resolved #578 by adding a reason = "<reason>" field to many fields within the configuration that are provided in diagnostics. [bans.deny] also has an additional use-instead = "<url/crate_name>". PR#610 did this for the advisories.ignore field.
  • PR#605 resolved #579 by allowing yanked crates to be ignored by specifying a PackageSpec in the [advisories.ignore] array.

Deprecated

  • PR#606 and PR#611 together deprecated several fields listed below. See PR#611 for how to change your config to opt-in to the new behavior that will become the default when the deprecated fields are removed in a future minor version.
    • [advisories]
      • vulnerability
      • unmaintained
      • unsound
      • notice
      • severity-threshold
    • [licenses]
      • unlicensed
      • allow-osi-fsf-free
      • copyleft
      • default
      • deny
Commits

Updates docker/login-action from 3.0.0 to 3.2.0

Release notes

Sourced from docker/login-action's releases.

v3.2.0

Full Changelog: docker/login-action@v3.1.0...v3.2.0

v3.1.0

Full Changelog: docker/login-action@v3.0.0...v3.1.0

Commits
  • 0d4c9c5 Merge pull request #722 from crazy-max/update-readme
  • b29e14f add contributing section to README
  • 218a70c Merge pull request #721 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • b820080 build(deps): bump @​docker/actions-toolkit from 0.23.0 to 0.24.0
  • 27530a9 Merge pull request #720 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • d072a60 chore: update generated content
  • 7c627b5 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • 787cfc6 Merge pull request #694 from docker/dependabot/npm_and_yarn/undici-5.28.4
  • 8e66e91 chore: update generated content
  • 5ba5e97 build(deps): bump undici from 5.28.3 to 5.28.4
  • Additional commits viewable in compare view

Updates docker/metadata-action from 5.0.0 to 5.5.1

Release notes

Sourced from docker/metadata-action's releases.

v5.5.1

Full Changelog: docker/metadata-action@v5.5.0...v5.5.1

v5.5.0

Full Changelog: docker/metadata-action@v5.4.0...v5.5.0

v5.4.0

Full Changelog: docker/metadata-action@v5.3.0...v5.4.0

v5.3.0

Full Changelog: docker/metadata-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/metadata-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/metadata-action@v5.0.0...v5.1.0

Commits
  • 8e5442c Merge pull request #382 from crazy-max/dont-set-cwd-prefix
  • eda41b7 chore: update generated content
  • 388c08f don't set cwd:// prefix for local bake files
  • dbef880 Merge pull request #374 from docker/dependabot/npm_and_yarn/moment-timezone-0...
  • b73e7a7 chore: update generated content
  • b9fba69 chore(deps): Bump moment-timezone from 0.5.43 to 0.5.44
  • ac82374 Merge pull request #373 from docker/dependabot/npm_and_yarn/moment-2.30.1
  • c92519a chore: update generated content
  • 3b4179d chore(deps): Bump moment from 2.29.4 to 2.30.1
  • 0784993 Merge pull request #371 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • Additional commits viewable in compare view

Updates docker/build-push-action from 5.0.0 to 6.0.0

Release notes

Sourced from docker/build-push-action's releases.

v6.0.0

[!NOTE] This major release adds support for generating Build summary and exporting build record for your build. You can disable this feature by setting DOCKER_BUILD_NO_SUMMARY: true environment variable in your workflow.

Full Changelog: docker/build-push-action@v5.4.0...v6.0.0

v5.4.0

Full Changelog: docker/build-push-action@v5.3.0...v5.4.0

v5.3.0

Full Changelog: docker/build-push-action@v5.2.0...v5.3.0

v5.2.0

Full Changelog: docker/build-push-action@v5.1.0...v5.2.0

v5.1.0

Full Changelog: docker/build-push-action@v5.0.0...v5.1.0

Commits
  • c382f71 Merge pull request #1120 from crazy-max/build-summary
  • 5a5b70d chore: update generated content
  • dc24cf9 don't generate summary for cloud driver
  • 667cb22 DOCKER_BUILD_NO_SUMMARY env to disable summary
  • d880b19 generate build summary
  • e51051a export build record and upload artifact
  • 86c2bd0 Merge pull request #1137 from docker/dependabot/npm_and_yarn/braces-3.0.3
  • 268d2b1 Merge pull request #1138 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 2b8dc7f chore: update generated content
  • 840c12b chore(deps): Bump @​docker/actions-toolkit from 0.25.1 to 0.26.0
  • Additional commits viewable in compare view

Updates peter-evans/dockerhub-description from 3.4.2 to 4.0.0

Release notes

Sourced from peter-evans/dockerhub-description's releases.

Docker Hub Description v4.0.0

⚙️ Updated runtime to Node.js 20

  • The action now requires a minimum version of v2.308.0 for the Actions runner. Update self-hosted runners to v2.308.0 or later to ensure compatibility.

What's Changed

... (truncated)

Commits
  • e98e4d1 feat: update runtime to node 20 (#246)
  • 487b453 build(deps-dev): bump @​types/node from 16.18.70 to 16.18.73 (#245)
  • f4367f9 build(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#244)
  • 48ae68f build(deps-dev): bump @​types/node from 16.18.69 to 16.18.70 (#241)
  • dfc61b8 build(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#243)
  • 74967fb build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#242)
  • 7ea9d27 build(deps-dev): bump @​types/node from 16.18.68 to 16.18.69 (#240)
  • 7bc76ab build(deps-dev): bump eslint-plugin-prettier from 5.0.1 to 5.1.2 (#239)
  • 5a219e7 build(deps): bump actions/download-artifact from 3 to 4 (#236)
  • fb37f44 build(deps-dev): bump eslint from 8.55.0 to 8.56.0 (#238)
  • Additional commits viewable in compare view

Updates fsfe/reuse-action from 2 to 3

Release notes

Sourced from fsfe/reuse-action's releases.

v3.0.0

What's Changed

New Contributors

Full Changelog: fsfe/reuse-action@v2.0.0...v3.0.0

Commits
  • a46482c Merge pull request #28 from fsfe/reuse-v3
  • cd6bf02 test all major versions in workflow
  • 577d39f bump to reuse-tool major version 3
  • 4a900d3 Merge pull request #25 from ChristianTackeGSI/main
  • 1e652d5 chore: upgrade checkout step to v4
  • 9522816 rename master -> main
  • c1c6c29 Merge pull request #23 from fsfe/ci-expand-tests
  • 7247931 improve and extend CI pipeline
  • See full diff in compare view

Updates github/codeql-action from 2.22.5 to 3.25.10

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.25.10 - 13 Jun...

Description has been truncated

@dependabot
Bump the github-actions group across 1 directory with 13 updates
0cd2051 
Bumps the github-actions group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.5.1` | `2.8.1` |
| [actions/checkout](https://github.com/actions/checkout) | `3.5.3` | `4.1.7` |
| [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) | `1.5.5` | `1.6.3` |
| [docker/login-action](https://github.com/docker/login-action) | `3.0.0` | `3.2.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.0.0` | `5.5.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `5.0.0` | `6.0.0` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `3.4.2` | `4.0.0` |
| [fsfe/reuse-action](https://github.com/fsfe/reuse-action) | `2` | `3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `2.22.5` | `3.25.10` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.3.3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `3.1.2` | `4.3.3` |
| [crate-ci/typos](https://github.com/crate-ci/typos) | `1.16.21` | `1.22.7` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `4` |



Updates `step-security/harden-runner` from 2.5.1 to 2.8.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.5.1...17d0e2b)

Updates `actions/checkout` from 3.5.3 to 4.1.7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v3.5.3...v4.1.7)

Updates `EmbarkStudios/cargo-deny-action` from 1.5.5 to 1.6.3
- [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases)
- [Commits](EmbarkStudios/cargo-deny-action@1e59595...3f4a782)

Updates `docker/login-action` from 3.0.0 to 3.2.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@343f7c4...0d4c9c5)

Updates `docker/metadata-action` from 5.0.0 to 5.5.1
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@96383f4...8e5442c)

Updates `docker/build-push-action` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@0565240...c382f71)

Updates `peter-evans/dockerhub-description` from 3.4.2 to 4.0.0
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@dc67fad...e98e4d1)

Updates `fsfe/reuse-action` from 2 to 3
- [Release notes](https://github.com/fsfe/reuse-action/releases)
- [Commits](fsfe/reuse-action@v2...v3)

Updates `github/codeql-action` from 2.22.5 to 3.25.10
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@74483a3...23acc5c)

Updates `ossf/scorecard-action` from 2.3.1 to 2.3.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@0864cf1...dc50aa9)

Updates `actions/upload-artifact` from 3.1.2 to 4.3.3
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v3.1.2...6546280)

Updates `crate-ci/typos` from 1.16.21 to 1.22.7
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@47dd297...cfe759a)

Updates `codecov/codecov-action` from 3 to 4
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v4)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: EmbarkStudios/cargo-deny-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/dockerhub-description
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: fsfe/reuse-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 17, 2024
@dependabot dependabot bot mentioned this pull request Jun 17, 2024
Closed
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Jun 24, 2024

Superseded by #305.

@dependabot dependabot bot closed this Jun 24, 2024
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-a14cc1bc7c branch June 24, 2024 17:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants