Skip to content

Bump the github-actions group with 4 updates#62

Merged
tsutsu3 merged 1 commit intomainfrom
dependabot/github_actions/github-actions-497c564a26
Oct 10, 2024
Merged

Bump the github-actions group with 4 updates#62
tsutsu3 merged 1 commit intomainfrom
dependabot/github_actions/github-actions-497c564a26

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Oct 10, 2024

Bumps the github-actions group with 4 updates: actions/checkout, actions/setup-python, codecov/codecov-action and pypa/gh-action-pypi-publish.

Updates actions/checkout from 3 to 4

Release notes

Sourced from actions/checkout's releases.

v4.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v3...v4.0.0

v3.6.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v3.5.3...v3.6.0

v3.5.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v3...v3.5.3

v3.5.2

What's Changed

Full Changelog: actions/checkout@v3.5.1...v3.5.2

v3.5.1

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

v4.1.2

v4.1.1

v4.1.0

v4.0.0

... (truncated)

Commits
  • eef6144 Prepare 4.2.1 release (#1925)
  • 6b42224 Add workflow file for publishing releases to immutable action package (#1919)
  • de5a000 Check out other refs/* by commit if provided, fall back to ref (#1924)
  • d632683 Prepare 4.2.0 release (#1878)
  • 6d193bf Bump braces from 3.0.2 to 3.0.3 (#1777)
  • db0cee9 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)
  • b684943 Add Ref and Commit outputs (#1180)
  • 2d7d9f7 Provide explanation for where user email came from (#1869)
  • 9a9194f Bump docker/build-push-action from 5.3.0 to 6.5.0 (#1832)
  • dd960bd Bump docker/login-action in the minor-actions-dependencies group (#1831)
  • Additional commits viewable in compare view

Updates actions/setup-python from 4 to 5

Release notes

Sourced from actions/setup-python's releases.

v5.0.0

What's Changed

In scope of this release, we update node version runtime from node16 to node20 (actions/setup-python#772). Besides, we update dependencies to the latest versions.

Full Changelog: actions/setup-python@v4.8.0...v5.0.0

v4.8.0

What's Changed

In scope of this release we added support for GraalPy (actions/setup-python#694). You can use this snippet to set up GraalPy:

steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v4 
  with:
    python-version: 'graalpy-22.3' 
- run: python my_script.py

Besides, the release contains such changes as:

New Contributors

Full Changelog: actions/setup-python@v4...v4.8.0

v4.7.1

What's Changed

Full Changelog: actions/setup-python@v4...v4.7.1

v4.7.0

In scope of this release, the support for reading python version from pyproject.toml was added (actions/setup-python#669).

      - name: Setup Python
        uses: actions/setup-python@v4
</tr></table>

... (truncated)

Commits
  • f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
  • 2bd53f9 Documentation update for caching poetry dependencies (#908)
  • 80b49d3 fix: add arch to cache key (#896)
  • 036a523 Fix: Add .zip extension to Windows package downloads for Expand-Archive C...
  • 04c1311 Fix display of emojis in contributors doc (#899)
  • cb68456 Updated @​iarna/toml version to 3.0.0 (#912)
  • 39cd149 Documentation update for cache (#873)
  • a0d74c0 fix(ci): update all failing workflows (#863)
  • 4eb7dbc Bump braces from 3.0.2 to 3.0.3 (#893)
  • 82c7e63 Documentation changes for avoiding rate limit issues on GHES (#835)
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 3 to 4

Release notes

Sourced from codecov/codecov-action's releases.

v4.0.0

v4 of the Codecov Action uses the CLI as the underlying upload. The CLI has helped to power new features including local upload, the global upload token, and new upcoming features.

Breaking Changes

  • The Codecov Action runs as a node20 action due to node16 deprecation. See this post from GitHub on how to migrate.
  • Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token). This doc shows instructions on how to add the Codecov token.
  • OS platforms have been added, though some may not be automatically detected. To see a list of platforms, see our CLI download page
  • Various arguments to the Action have been changed. Please be aware that the arguments match with the CLI's needs

v3 versions and below will not have access to CLI features (e.g. global upload token, ATS).

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

4.0.0-beta.2

Fixes

  • #1085 not adding -n if empty to do-upload command

4.0.0-beta.1

v4 represents a move from the universal uploader to the Codecov CLI. Although this will unlock new features for our users, the CLI is not yet at feature parity with the universal uploader.

Breaking Changes

  • No current support for aarch64 and alpine architectures.
  • Tokenless uploading is unsuported
  • Various arguments to the Action have been removed

3.1.4

Fixes

  • #967 Fix typo in README.md
  • #971 fix: add back in working dir
  • #969 fix: CLI option names for uploader

Dependencies

  • #970 build(deps-dev): bump @​types/node from 18.15.12 to 18.16.3
  • #979 build(deps-dev): bump @​types/node from 20.1.0 to 20.1.2
  • #981 build(deps-dev): bump @​types/node from 20.1.2 to 20.1.4

3.1.3

Fixes

  • #960 fix: allow for aarch64 build

Dependencies

  • #957 build(deps-dev): bump jest-junit from 15.0.0 to 16.0.0
  • #958 build(deps): bump openpgp from 5.7.0 to 5.8.0
  • #959 build(deps-dev): bump @​types/node from 18.15.10 to 18.15.12

3.1.2

Fixes

  • #718 Update README.md
  • #851 Remove unsupported path_to_write_report argument
  • #898 codeql-analysis.yml
  • #901 Update README to contain correct information - inputs and negate feature
  • #955 fix: add in all the extra arguments for uploader

Dependencies

  • #819 build(deps): bump openpgp from 5.4.0 to 5.5.0
  • #835 build(deps): bump node-fetch from 3.2.4 to 3.2.10
  • #840 build(deps): bump ossf/scorecard-action from 1.1.1 to 2.0.4
  • #841 build(deps): bump @​actions/core from 1.9.1 to 1.10.0
  • #843 build(deps): bump @​actions/github from 5.0.3 to 5.1.1
  • #869 build(deps): bump node-fetch from 3.2.10 to 3.3.0
  • #872 build(deps-dev): bump jest-junit from 13.2.0 to 15.0.0
  • #879 build(deps): bump decode-uri-component from 0.2.0 to 0.2.2

... (truncated)

Commits
  • b9fd7d1 chore(release):4.6.0 (#1587)
  • 6f7612c fix: bump eslint parser deps (#1586)
  • 26c7e28 build(deps): bump actions/checkout from 4.1.7 to 4.2.0 (#1583)
  • 6f744f7 build(deps): bump github/codeql-action from 3.26.8 to 3.26.9 (#1584)
  • 543c3d4 chore: fix typo of OSS (#1578)
  • e379426 build(deps-dev): bump @​vercel/ncc from 0.38.1 to 0.38.2 (#1577)
  • 42656e4 build(deps): bump github/codeql-action from 3.26.7 to 3.26.8 (#1575)
  • 2296b6b build(deps-dev): bump eslint from 8.57.0 to 8.57.1 (#1571)
  • bd77bc3 build(deps): bump github/codeql-action from 3.26.6 to 3.26.7 (#1569)
  • 180b964 build(deps-dev): bump @​types/jest from 29.5.12 to 29.5.13 (#1567)
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.1.0 to 1.10.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.10.3

💅 Cosmetic Output Improvements

In #270, @​facutuesca💰 made a follow-up to their previous PR #250, making the hints show up more granularly. This effectively makes sure that the suggestion to enable Trusted Publishing does not get displayed when it's already in use. It also makes the message nicer in a few places on the UI.

🛠️ Internal Dependencies

@​mosfet80💰 updated a few internal linter versions in #266, #267, and #271, no user impact. This is usually automated otherwise.

💪 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.10.2...v1.10.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

v1.10.2

💅 Cosmetic Output Improvements

In #250 and #258, @​facutuesca💰 added a nudge message with a magic link to pre-fill the creation of new Trusted Publishers configurations on PyPI. The users are now suggested to configure tokenless publishing by clicking a link printed in the job summary when it's detected that they publish to PyPI or TestPyPI. Just like magic! 🦄

🛠️ Internal Dependencies

@​woodruffw💰 bumped pypi-attestations to v0.0.12 in #262, fixing #263.

[!TIP] Please keep in mind that reusable workflows are not yet supported, even though they sometimes work, mostly by accident.

💪 New Contributors

@​facutuesca made their first contribution in pypa/gh-action-pypi-publish#258

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.10.1...v1.10.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​henryiii💰 for promptly pointing up possible fixes for #263.

v1.10.1

🚑🔏 Oopsie... We missed a tiny bug in the attestations feature the other day

The problem was that the distribution file validity check was failing on any valid distribution being present and ready to be signed. What a silly mistake! It's now been fixed via pypa/gh-action-pypi-publish@0ab0b79, though. So everything's good!

-- @​webknjaz💰

[!IMPORTANT] ✨ Despite this minor hiccup, we invite you to still opt into trying this feature out early. It can be enabled like this:

  with:
    attestations: true

Leave feedback in the v1.10.0 release discussion or the PR.

... (truncated)

Commits
  • f760068 Merge pull request #271 from mosfet80/patch-3
  • 6edc294 Fix node.js v16 deprecation self-smoke-test-action.yml
  • 85a5a80 Merge pull request #270 from trail-of-forks/fix-magic-link-summary
  • 954318b Merge pull request #267 from mosfet80/patch-2
  • 24791c7 Merge pull request #266 from mosfet80/patch-1
  • d8c8948 Fix magic link nudge formatting in job summary
  • a1ce384 Check for Trusted Publishing in magic link logic
  • 00b87c8 Update check-jsonschema and pre-commit libs
  • a571f1e Update pylint lib
  • 897895f Merge pull request #262 from trail-of-forks/ww/bump-attestations-req
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group with 4 updates
60373fd 
Bumps the github-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-python](https://github.com/actions/setup-python), [codecov/codecov-action](https://github.com/codecov/codecov-action) and [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).


Updates `actions/checkout` from 3 to 4
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

Updates `actions/setup-python` from 4 to 5
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v5)

Updates `codecov/codecov-action` from 3 to 4
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v4)

Updates `pypa/gh-action-pypi-publish` from 1.1.0 to 1.10.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@v1.1.0...v1.10.3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/github-actions-497c564a26 branch from a7b40bf to 60373fd Compare October 10, 2024 15:58
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 10, 2024
@cclauss cclauss mentioned this pull request Oct 10, 2024
Merged
@tsutsu3 tsutsu3 merged commit 00d5923 into main Oct 10, 2024
@tsutsu3 tsutsu3 deleted the dependabot/github_actions/github-actions-497c564a26 branch October 10, 2024 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tsutsu3