chore(deps): update github-actions by renovate-bot · Pull Request #3642 · slsa-framework/slsa-github-generator

renovate-bot · 2024-05-15T16:10:33Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	digest	`b4ffde6` -> `a5ac7e5`
actions/checkout	action	patch	`v4.1.1` -> `v4.1.6`
actions/download-artifact	action	patch	`v4.1.4` -> `v4.1.7`
actions/upload-artifact	action	patch	`v4.3.1` -> `v4.3.3`
ianlewis/todo-issue-reopener	action	patch	`v1.2.0` -> `v1.2.1`
ossf/scorecard-action	action	patch	`v2.3.0` -> `v2.3.3`
sigstore/cosign-installer	action	minor	`v3.4.0` -> `v3.5.0`

Release Notes

actions/checkout (actions/checkout)

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in https://github.com/actions/checkout/pull/1732

What's Changed

Update actions/checkout version in update-main-version.yml by @jww3 in https://github.com/actions/checkout/pull/1650
Check git version before attempting to disable sparse-checkout by @jww3 in https://github.com/actions/checkout/pull/1656
Add SSH user parameter by @cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in https://github.com/actions/checkout/pull/1598

actions/download-artifact (actions/download-artifact)

`v4.1.7`

Compare Source

What's Changed

Update @actions/artifact dependency by @bethanyj28 in https://github.com/actions/download-artifact/pull/325

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

`v4.1.6`

Compare Source

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in https://github.com/actions/download-artifact/pull/324

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

`v4.1.5`

Compare Source

What's Changed

Update readme with v3/v2/v1 deprecation notice by @robherley in https://github.com/actions/download-artifact/pull/322
Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

actions/upload-artifact (actions/upload-artifact)

`v4.3.3`

Compare Source

What's Changed

updating @actions/artifact dependency to v2.1.6 by @eggyhead in https://github.com/actions/upload-artifact/pull/565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

`v4.3.2`

Compare Source

What's Changed

Update release-new-action-version.yml by @konradpabjan in https://github.com/actions/upload-artifact/pull/516
Minor fix to the migration readme by @andrewakim in https://github.com/actions/upload-artifact/pull/523
Update readme with v3/v2/v1 deprecation notice by @robherley in https://github.com/actions/upload-artifact/pull/561
updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @eggyhead in https://github.com/actions/upload-artifact/pull/562

New Contributors

@andrewakim made their first contribution in https://github.com/actions/upload-artifact/pull/523

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

ianlewis/todo-issue-reopener (ianlewis/todo-issue-reopener)

`v1.2.1`

Compare Source

Fixed in 1.2.1

Fixed the "error updating to TUF remote mirror: invalid key" error (#688).

All changes

fix: Update slsa-verifier version by @ianlewis in https://github.com/ianlewis/todo-issue-reopener/pull/689
chore(deps): Bump github/codeql-action from 3.23.2 to 3.25.5 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/711
chore(deps): Bump codecov/codecov-action from 4.0.1 to 4.4.0 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/705
chore(deps): Bump actions/upload-artifact from 4.3.0 to 4.3.3 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/670
chore(deps-dev): Bump @types/jest from 29.5.11 to 29.5.12 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/664
chore(deps): Bump actions/setup-node from 4.0.1 to 4.0.2 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/605
chore(deps): Bump yamllint from 1.33.0 to 1.35.1 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/598
chore(deps-dev): Bump eslint-plugin-github from 4.9.1 to 4.10.2 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/592
chore(deps): Bump thehanimo/pr-title-checker from 1.4.1 to 1.4.2 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/604
chore(deps): Bump yaml from 2.3.4 to 2.4.2 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/727
chore(deps-dev): Bump @vercel/ncc from 0.36.1 to 0.38.1 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/635
chore(deps-dev): Bump eslint from 8.56.0 to 8.57.0 by @dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/634
chore(release): v1.2.1 by @ianlewis in https://github.com/ianlewis/todo-issue-reopener/pull/833

Full Changelog: ianlewis/todo-issue-reopener@v1.2.0...v1.2.1

ossf/scorecard-action (ossf/scorecard-action)

`v2.3.3`

Compare Source

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1366
🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1374
🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

📖 Move token discussion out of main README. by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1279
📖 link to ossf/scorecard workflow instead of maintaining an example by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1352
📖 update api links to new scorecard.dev site by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1376

Full Changelog: ossf/scorecard-action@v2.3.1...v2.3.3

`v2.3.2`

Compare Source

`v2.3.1`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
- Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

sigstore/cosign-installer (sigstore/cosign-installer)

`v3.5.0`

Compare Source

What's Changed

Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in https://github.com/sigstore/cosign-installer/pull/157
use go 1.22 now by @bobcallaway in https://github.com/sigstore/cosign-installer/pull/160
bump default version to v2.2.4, prep for v3.5.0 release by @bobcallaway in https://github.com/sigstore/cosign-installer/pull/159

Full Changelog: sigstore/cosign-installer@v3.4.0...v3.5.0

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Signed-off-by: Mend Renovate <bot@renovateapp.com>

renovate-bot requested review from joshuagl, kpk47, laurentsimon and ramonpetgrave64 as code owners May 15, 2024 16:10

ramonpetgrave64 mentioned this pull request May 15, 2024

chore(renovate): use cron syntax for schedule #3638

Merged

5 tasks

renovate-bot force-pushed the renovate/github-actions branch 4 times, most recently from e371760 to d67a32e Compare May 16, 2024 07:09

ramonpetgrave64 approved these changes May 16, 2024

View reviewed changes

ramonpetgrave64 enabled auto-merge (squash) May 16, 2024 16:29

chore(deps): update github-actions

e371d72

Signed-off-by: Mend Renovate <bot@renovateapp.com>

auto-merge was automatically disabled May 17, 2024 00:41
Head branch was pushed to by a user without write access

renovate-bot force-pushed the renovate/github-actions branch from 4c75a15 to e371d72 Compare May 17, 2024 00:41

ianlewis approved these changes May 17, 2024

View reviewed changes

ianlewis merged commit 5917e48 into slsa-framework:main May 17, 2024

renovate-bot deleted the renovate/github-actions branch May 17, 2024 01:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update github-actions#3642

chore(deps): update github-actions#3642
ianlewis merged 1 commit intoslsa-framework:mainfrom
renovate-bot:renovate/github-actions

renovate-bot commented May 15, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

renovate-bot commented May 15, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Fixed in 1.2.1

All changes

What's Changed

Documentation

What's Changed

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate-bot commented May 15, 2024 •

edited

Loading