chore(deps): update github-actions by renovate[bot] · Pull Request #1072 · defenseunicorns/uds-cli

renovate · 2025-02-07T20:36:26Z

This PR contains the following updates:

Package	Type	Update	Change
Homebrew/actions	action	digest	`96b6254` -> `a7a3621`
actions/checkout	action	patch	`v4.2.1` -> `v4.2.2`
actions/create-github-app-token	action	patch	`v1.11.0` -> `v1.11.3`
actions/dependency-review-action	action	minor	`v4.4.0` -> `v4.5.0`
actions/setup-go	action	minor	`v5.2.0` -> `v5.3.0`
actions/setup-node	action	digest	`48b9067` -> `8026329`
actions/setup-node	action	minor	`v4.1.0` -> `v4.2.0`
actions/upload-artifact	action	minor	`v4.4.3` -> `v4.6.0`
anchore/sbom-action	action	minor	`v0.17.9` -> `v0.18.0`
docker/setup-buildx-action	action	minor	`v3.7.1` -> `v3.9.0`
github/codeql-action	action	minor	`v3.27.1` -> `v3.28.9`
sigstore/cosign-installer	action	minor	`v3.7.0` -> `v3.8.0`

Release Notes

actions/checkout (actions/checkout)

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in https://github.com/actions/checkout/pull/1941
Expand unit test coverage for isGhes by @jww3 in https://github.com/actions/checkout/pull/1946

actions/create-github-app-token (actions/create-github-app-token)

What's Changed

Bug Fixes

deps: bump the production-dependencies group across 1 directory with 3 updates by @dependabot in https://github.com/actions/create-github-app-token/pull/193

Full Changelog: actions/create-github-app-token@v1.11.0...v1.11.1

actions/dependency-review-action (actions/dependency-review-action)

`v4.5.0`

Compare Source

What's Changed

Bump got from 14.4.2 to 14.4.3 by @dependabot in https://github.com/actions/dependency-review-action/pull/844
Bump nodemon from 3.1.0 to 3.1.7 by @dependabot in https://github.com/actions/dependency-review-action/pull/847
Bump @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in https://github.com/actions/dependency-review-action/pull/849
Overriding the cross-spawn dependency to use a safe version by @Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/850
fix: add summary comment on failure when warn-only: true by @ebickle in https://github.com/actions/dependency-review-action/pull/827
Prepare for 4.5.0 release by @Ahmed3lmallah in https://github.com/actions/dependency-review-action/pull/851

New Contributors

@ebickle made their first contribution in https://github.com/actions/dependency-review-action/pull/827

Full Changelog: actions/dependency-review-action@v4...v4.5.0

actions/setup-go (actions/setup-go)

`v5.3.0`

Compare Source

What's Changed

Use the new cache service: upgrade @actions/cache to ^4.0.0 by @Link- in https://github.com/actions/setup-go/pull/531
Configure Dependabot settings by @HarithaVattikuti in https://github.com/actions/setup-go/pull/530
Document update - permission section by @HarithaVattikuti in https://github.com/actions/setup-go/pull/533
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 by @dependabot in https://github.com/actions/setup-go/pull/534

New Contributors

@Link- made their first contribution in https://github.com/actions/setup-go/pull/531

Full Changelog: actions/setup-go@v5...v5.3.0

actions/setup-node (actions/setup-node)

`v4.2.0`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v4.6.0`

Compare Source

What's Changed

Expose env vars to control concurrency and timeout by @yacaovsnc in https://github.com/actions/upload-artifact/pull/662

Full Changelog: actions/upload-artifact@v4...v4.6.0

`v4.5.0`

Compare Source

anchore/sbom-action (anchore/sbom-action)

`v0.18.0`

Compare Source

Changes in v0.18.0

chore(deps): update Syft to v1.19.0 (#513)
- See Syft changelog for latest changes

docker/setup-buildx-action (docker/setup-buildx-action)

`v3.9.0`

Compare Source

`v3.8.0`

Compare Source

github/codeql-action (github/codeql-action)

`v3.28.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.9 - 07 Feb 2025

Update default CodeQL bundle version to 2.20.4. #2753

See the full CHANGELOG.md for more information.

`v3.28.8`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.8 - 29 Jan 2025

Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

See the full CHANGELOG.md for more information.

`v3.28.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.7 - 29 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.28.6`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.6 - 27 Jan 2025

Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

See the full CHANGELOG.md for more information.

`v3.28.5`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.5 - 24 Jan 2025

Update default CodeQL bundle version to 2.20.3. #2717

See the full CHANGELOG.md for more information.

`v3.28.4`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.4 - 23 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.28.3`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.3 - 22 Jan 2025

Update default CodeQL bundle version to 2.20.2. #2707
Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #2710
Uploading debug artifacts for CodeQL analysis is temporarily disabled. #2712

See the full CHANGELOG.md for more information.

`v3.28.2`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.2 - 21 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.28.1`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.1 - 10 Jan 2025

CodeQL Action v2 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v3. For more information, see this changelog post. #2677
Update default CodeQL bundle version to 2.20.1. #2678

See the full CHANGELOG.md for more information.

`v3.28.0`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.28.0 - 20 Dec 2024

Bump the minimum CodeQL bundle version to 2.15.5. #2655
Don't fail in the unusual case that a file is on the search path. #2660.

See the full CHANGELOG.md for more information.

`v3.27.9`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.9 - 12 Dec 2024

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.27.8`

Compare Source

`v3.27.7`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.7 - 10 Dec 2024

We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631
Update default CodeQL bundle version to 2.20.0. #2636

See the full CHANGELOG.md for more information.

`v3.27.6`

Compare Source

`v3.27.5`

Compare Source

`v3.27.4`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.4 - 14 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.27.3`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.3 - 12 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.27.2`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.2 - 12 Nov 2024

Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #2590

See the full CHANGELOG.md for more information.

sigstore/cosign-installer (sigstore/cosign-installer)

`v3.8.0`

Compare Source

What's Changed

test action against all non-rc releases, verify entry in rekor log by @bobcallaway in https://github.com/sigstore/cosign-installer/pull/179
bump for cosign v2.4.2 release by @bobcallaway in https://github.com/sigstore/cosign-installer/pull/181

Full Changelog: sigstore/cosign-installer@v3...v3.8.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

| datasource | package | from | to | | ----------- | -------------------------------- | ------- | ------- | | github-tags | actions/checkout | v4.2.1 | v4.2.2 | | github-tags | actions/create-github-app-token | v1.11.0 | v1.11.3 | | github-tags | actions/dependency-review-action | v4.4.0 | v4.5.0 | | github-tags | actions/setup-go | v5.2.0 | v5.3.0 | | github-tags | actions/setup-node | v4.1.0 | v4.2.0 | | github-tags | actions/upload-artifact | v4.4.3 | v4.6.0 | | github-tags | anchore/sbom-action | v0.17.9 | v0.18.0 | | github-tags | docker/setup-buildx-action | v3.7.1 | v3.9.0 | | github-tags | github/codeql-action | v3.27.1 | v3.28.9 | | github-tags | sigstore/cosign-installer | v3.7.0 | v3.8.0 |

* main: chore: set helm buildflags the way Zarf does (#1052) chore(deps): update github-actions (#1081) chore(deps): update github-actions (#1077) chore: copy over our own save-logs (#1075) chore(deps): update github-actions (#1072) chore: regroup and unlimit renovate (#1071) fix(deps): update module github.com/defenseunicorns/maru-runner to v0.5.0 (#1067) chore(config): migrate renovate config (#1069) chore: update zarf version ref to v0.48.1 (#1066) fix(deps): update golang.org/x/exp digest to 7d7fa50 (#1016) chore(deps): update actions/setup-go action to v5.2.0 (#1050) fix(deps): update module github.com/goccy/go-yaml to v1.15.12 (#1049)

renovate Bot requested a review from a team as a code owner February 7, 2025 20:36

catsby approved these changes Feb 7, 2025

View reviewed changes

catsby merged commit a085d96 into main Feb 7, 2025

catsby deleted the renovate/github-actions branch February 7, 2025 21:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update github-actions#1072

chore(deps): update github-actions#1072
catsby merged 1 commit intomainfrom
renovate/github-actions

renovate Bot commented Feb 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Feb 7, 2025

Release Notes

Bug Fixes

Bug Fixes

What's Changed

Bug Fixes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Changes in v0.18.0

CodeQL Action Changelog

3.28.9 - 07 Feb 2025

CodeQL Action Changelog

3.28.8 - 29 Jan 2025

CodeQL Action Changelog

3.28.7 - 29 Jan 2025

CodeQL Action Changelog

3.28.6 - 27 Jan 2025

CodeQL Action Changelog

3.28.5 - 24 Jan 2025

CodeQL Action Changelog

3.28.4 - 23 Jan 2025

CodeQL Action Changelog

3.28.3 - 22 Jan 2025

CodeQL Action Changelog

3.28.2 - 21 Jan 2025

CodeQL Action Changelog

3.28.1 - 10 Jan 2025

CodeQL Action Changelog

3.28.0 - 20 Dec 2024

CodeQL Action Changelog

3.27.9 - 12 Dec 2024

CodeQL Action Changelog

3.27.7 - 10 Dec 2024

CodeQL Action Changelog

3.27.4 - 14 Nov 2024

CodeQL Action Changelog

3.27.3 - 12 Nov 2024

CodeQL Action Changelog

3.27.2 - 12 Nov 2024

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant