chore(deps): update github-actions by renovate-bot · Pull Request #817 · slsa-framework/slsa-verifier

renovate-bot · 2024-12-01T01:00:32Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	`v4.1.7` -> `v4.2.2`
actions/dependency-review-action	action	minor	`v4.3.3` -> `v4.5.0`
actions/download-artifact	action	patch	`v4.1.7` -> `v4.1.8`
actions/setup-go	action	minor	`v5.0.2` -> `v5.1.0`
actions/setup-go	action	minor	`v5.0.1` -> `v5.1.0`
actions/setup-node	action	minor	`v4.0.2` -> `v4.1.0`
actions/upload-artifact	action	minor	`v4.3.3` -> `v4.4.3`
github/codeql-action	action	minor	`v3.25.11` -> `v3.27.6`
ossf/scorecard-action	action	minor	`v2.3.3` -> `v2.4.0`
slsa-framework/slsa-verifier	action	minor	`v2.5.1` -> `v2.6.0`
thehanimo/pr-title-checker	action	patch	`v1.4.2` -> `v1.4.3`

Release Notes

actions/checkout (actions/checkout)

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in https://github.com/actions/checkout/pull/1941
Expand unit test coverage for isGhes by @jww3 in https://github.com/actions/checkout/pull/1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in https://github.com/actions/checkout/pull/1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in https://github.com/actions/checkout/pull/1180
Dependency updates by @dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872

actions/dependency-review-action (actions/dependency-review-action)

What's Changed

Include all added dependencies in scorecard entries by @elireisman in https://github.com/actions/dependency-review-action/pull/783
Update SPDX Expression Parsing by @febuiles in https://github.com/actions/dependency-review-action/pull/719
- This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.

Full Changelog: actions/dependency-review-action@v4.3.3...v4.3.4

actions/download-artifact (actions/download-artifact)

`v4.1.8`

Compare Source

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in https://github.com/actions/download-artifact/pull/341

Full Changelog: actions/download-artifact@v4...v4.1.8

actions/setup-go (actions/setup-go)

`v5.1.0`

Compare Source

What's Changed

Add workflow file for publishing releases to immutable action package by @Jcambass in https://github.com/actions/setup-go/pull/500
Upgrade IA Publish by @Jcambass in https://github.com/actions/setup-go/pull/502
Add architecture to cache key by @Zxilly in https://github.com/actions/setup-go/pull/493
This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts.
Note: This change may break previous cache keys as they will no longer be compatible with the new format.
Enhance workflows and Upgrade micromatch Dependency by @priyagupta108 in https://github.com/actions/setup-go/pull/510

Bug Fixes

Revise isGhes logic by @jww3 in https://github.com/actions/setup-go/pull/511

New Contributors

@Zxilly made their first contribution in https://github.com/actions/setup-go/pull/493
@Jcambass made their first contribution in https://github.com/actions/setup-go/pull/500
@jww3 made their first contribution in https://github.com/actions/setup-go/pull/511
@priyagupta108 made their first contribution in https://github.com/actions/setup-go/pull/510

Full Changelog: actions/setup-go@v5...v5.1.0

actions/setup-node (actions/setup-node)

`v4.1.0`

Compare Source

`v4.0.4`

Compare Source

`v4.0.3`

Compare Source

actions/upload-artifact (actions/upload-artifact)

`v4.4.3`

Compare Source

What's Changed

Undo indirect dependency updates from #627 by @joshmgross in https://github.com/actions/upload-artifact/pull/632

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

`v4.4.2`

Compare Source

What's Changed

Bump @actions/artifact to 2.1.11 by @robherley in https://github.com/actions/upload-artifact/pull/627
- Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

`v4.4.1`

Compare Source

What's Changed

Add a section about hidden files by @joshmgross in https://github.com/actions/upload-artifact/pull/607
Add workflow file for publishing releases to immutable action package by @Jcambass in https://github.com/actions/upload-artifact/pull/621
Update @actions/artifact to latest version, includes symlink and timeout fixes by @robherley in https://github.com/actions/upload-artifact/pull/625

New Contributors

@Jcambass made their first contribution in https://github.com/actions/upload-artifact/pull/621

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

`v4.4.0`

Compare Source

`v4.3.6`

Compare Source

`v4.3.5`

Compare Source

`v4.3.4`

Compare Source

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in https://github.com/actions/upload-artifact/pull/584

Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4

github/codeql-action (github/codeql-action)

`v3.27.6`

Compare Source

`v3.27.5`

Compare Source

`v3.27.4`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.4 - 14 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.27.3`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.3 - 12 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

`v3.27.2`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.2 - 12 Nov 2024

Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #2590

See the full CHANGELOG.md for more information.

`v3.27.1`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.1 - 08 Nov 2024

The CodeQL Action now downloads bundles compressed using Zstandard on GitHub Enterprise Server when using Linux or macOS runners. This speeds up the installation of the CodeQL tools. This feature is already available to GitHub.com users. #2573
Update default CodeQL bundle version to 2.19.3. #2576

See the full CHANGELOG.md for more information.

`v3.27.0`

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.0 - 22 Oct 2024

Bump the minimum CodeQL bundle version to 2.14.6. #2549
Fix an issue where the upload-sarif Action would fail with "upload-sarif post-action step failed: Input required and not supplied: token" when called in a composite Action that had a different set of inputs to the ones expected by the upload-sarif Action. #2557
Update default CodeQL bundle version to 2.19.2. #2552

See the full CHANGELOG.md for more information.

`v3.26.13`

Compare Source

`v3.26.12`

Compare Source

`v3.26.11`

Compare Source

`v3.26.10`

Compare Source

`v3.26.9`

Compare Source

`v3.26.8`

Compare Source

`v3.26.7`

Compare Source

`v3.26.6`

Compare Source

`v3.26.5`

Compare Source

`v3.26.4`

Compare Source

`v3.26.3`

Compare Source

`v3.26.2`

Compare Source

`v3.26.1`

Compare Source

`v3.26.0`

Compare Source

`v3.25.15`

Compare Source

`v3.25.14`

Compare Source

`v3.25.13`

Compare Source

`v3.25.12`

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

`v2.4.0`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1410
🐛 lower license sarif alert threshold to 9 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1411

Documentation

docs: dogfooding badge by @jkowalleck in https://github.com/ossf/scorecard-action/pull/1399

New Contributors

@jkowalleck made their first contribution in https://github.com/ossf/scorecard-action/pull/1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)

`v2.6.0`

Compare Source

What's Changed

chore: Update doc and digests for v2.5.1 by @laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/748
fix(deps): update module google.golang.org/protobuf to v1.33.0 [security] by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/743
fix(deps): update dependency org.apache.maven:maven-core to v3.9.6 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/718
chore: Update @actions/github v6 by @laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/749
fix: use sigstore/pkg/fulcioroots to lessen deps by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/746
feat: add ramonpetgrave64 as CODEOWNER by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/750
chore(deps): update gcr.io/distroless/base:nonroot docker digest to 1a8ece8 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/701
chore(deps): update github-actions (major) by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/719
fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.6 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/751
chore(deps): update npm dev (major) by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/753
fix(deps): update dependency org.apache.maven.plugin-tools:maven-plugin-annotations to v3.11.0 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/752
feat: fixes #547: add npm sigstore-tuf suport by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/731
fix(deps): update module github.com/sigstore/cosign/v2 to v2.2.4 [security] by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/723
chore(deps): update golang:1.21 docker digest to 81811f8 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/693
chore: slsa-framework/slsa-github-generator@v2.0.0: add testdata by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/758
chore(deps): update golang:1.21 docker digest to d83472f by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/764
chore(deps): update gcr.io/distroless/base:nonroot docker digest to 53745e9 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/763
feat: workflow to update actions dist by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/760
fix(deps): update dependency @actions/core to v1.10.1 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/717
chore: fix pr-title-checker by @ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/770
chore: Update Renovate config by @ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/769
fix: use pr_number as env variable by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/771
fix: signoff commit by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/767
chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in https://github.com/slsa-framework/slsa-verifier/pull/781
chore(deps): bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7 by @dependabot in https://github.com/slsa-framework/slsa-verifier/pull/782
chore(deps): bump undici from 5.28.3 to 5.28.4 in /actions/installer by @dependabot in https://github.com/slsa-framework/slsa-verifier/pull/779
chore(deps-dev): bump braces from 3.0.2 to 3.0.3 in /actions/installer by @dependabot in https://github.com/slsa-framework/slsa-verifier/pull/780
chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot in https://github.com/slsa-framework/slsa-verifier/pull/784
fix(deps): update golang.org/x/exp digest to 7f521ea by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/775
fix: make download-artifacts.sh more flexible by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/761
chore(deps): update golang:1.21 docker digest to b405b62 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/774
chore(deps): update npm dev by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/650
fix(deps): update dependency org.apache.maven:maven-core to v3.9.8 by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/787
chore(deps): update github-actions by @renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/786
feat: vsa support by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/777
fix: use tag for the builder in the release workflow by @ramonpetgrave64 in https://github.com/slsa-framework/slsa-verifier/pull/788

Full Changelog: v2.5.1...v2.6.0

thehanimo/pr-title-checker (thehanimo/pr-title-checker)

`v1.4.3`

Compare Source

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate-bot requested a review from a team December 1, 2024 01:00

chore(deps): update github-actions

d6eb26b

renovate-bot force-pushed the renovate/github-actions branch from d9f53c6 to d6eb26b Compare December 3, 2024 14:40

ramonpetgrave64 approved these changes Dec 4, 2024

View reviewed changes

ramonpetgrave64 merged commit 190fdda into slsa-framework:main Dec 4, 2024

renovate-bot deleted the renovate/github-actions branch December 4, 2024 18:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update github-actions#817

chore(deps): update github-actions#817
ramonpetgrave64 merged 1 commit intoslsa-framework:mainfrom
renovate-bot:renovate/github-actions

renovate-bot commented Dec 1, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate-bot commented Dec 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

CodeQL Action Changelog

3.27.4 - 14 Nov 2024

CodeQL Action Changelog

3.27.3 - 12 Nov 2024

CodeQL Action Changelog

3.27.2 - 12 Nov 2024

CodeQL Action Changelog

3.27.1 - 08 Nov 2024

CodeQL Action Changelog

3.27.0 - 22 Oct 2024

What's Changed

Documentation

New Contributors

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate-bot commented Dec 1, 2024 •

edited

Loading