Bump the actions group across 1 directory with 12 updates#299
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the actions group across 1 directory with 12 updates#299dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the actions group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.2` | `2.14.1` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.2` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.3.1` | `5.5.2` | | [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance) | `0.0.16` | `0.0.25` | | [theupdateframework/tuf-conformance](https://github.com/theupdateframework/tuf-conformance) | `2.3.0` | `2.4.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.5.0` | `4.8.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.0` | `6.0.0` | | [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `7.0.0` | | [rubygems/configure-rubygems-credentials](https://github.com/rubygems/configure-rubygems-credentials) | `f456a002d58f0de60b44383d10ae82316b18a166` | `31a1b8b3f3e2e6ed22769fe272dae83e92b3c754` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.2.1` | `2.5.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.3` | Updates `step-security/harden-runner` from 2.12.2 to 2.14.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@6c439dc...e3f713f) Updates `actions/checkout` from 4.2.2 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...de0fac2) Updates `codecov/codecov-action` from 5.3.1 to 5.5.2 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@13ce06b...671740a) Updates `sigstore/sigstore-conformance` from 0.0.16 to 0.0.25 - [Release notes](https://github.com/sigstore/sigstore-conformance/releases) - [Commits](sigstore/sigstore-conformance@d658ea7...eae6eb1) Updates `theupdateframework/tuf-conformance` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/theupdateframework/tuf-conformance/releases) - [Commits](theupdateframework/tuf-conformance@9bfc222...500c525) Updates `actions/dependency-review-action` from 4.5.0 to 4.8.2 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@3b139cf...3c4e3dc) Updates `actions/upload-artifact` from 4.6.0 to 6.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@65c4c4a...b7c566a) Updates `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` from 2.0.0 to 2.1.0 - [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases) - [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) - [Commits](slsa-framework/slsa-github-generator@v2.0.0...v2.1.0) Updates `actions/download-artifact` from 4.1.8 to 7.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@fa0a91b...37930b1) Updates `rubygems/configure-rubygems-credentials` from f456a002d58f0de60b44383d10ae82316b18a166 to 31a1b8b3f3e2e6ed22769fe272dae83e92b3c754 - [Release notes](https://github.com/rubygems/configure-rubygems-credentials/releases) - [Commits](rubygems/configure-rubygems-credentials@f456a00...31a1b8b) Updates `softprops/action-gh-release` from 2.2.1 to 2.5.0 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@c95fe14...a06a81a) Updates `ossf/scorecard-action` from 2.4.0 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@62b2cac...4eaacf0) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/sigstore-conformance dependency-version: 0.0.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: theupdateframework/tuf-conformance dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: 4.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: rubygems/configure-rubygems-credentials dependency-version: 31a1b8b3f3e2e6ed22769fe272dae83e92b3c754 dependency-type: direct:production dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Currently this action needs to be referred by tag. More details at: | ||
| # https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 |
Check failure
Code scanning / zizmor
unpinned action reference Error
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 12 updates in the / directory:
2.12.22.14.14.2.26.0.25.3.15.5.20.0.160.0.252.3.02.4.04.5.04.8.24.6.06.0.02.0.02.1.04.1.87.0.0f456a002d58f0de60b44383d10ae82316b18a16631a1b8b3f3e2e6ed22769fe272dae83e92b3c7542.2.12.5.02.4.02.4.3Updates
step-security/harden-runnerfrom 2.12.2 to 2.14.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
e3f713fMerge pull request #631 from step-security/rc-31423acddchore: fix npm audit vulnerabilities0ddb86cupdate agent20cf305Merge pull request #622 from step-security/feature/custom-property-skipc51e8eefeat: skip agent install and post step on subsequent runs for GitHub-hosted r...e152b90feat: skip harden-runner based on repository custom propertyee1faecfeat: replace skip-harden-runner with skip-on-custom-property input1dc7c17feat: add skip-harden-runner input to conditionally skip executiondf199fbMerge pull request #620 from step-security/rc-2903d096aupdate agentUpdates
actions/checkoutfrom 4.2.2 to 6.0.2Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
codecov/codecov-actionfrom 5.3.1 to 5.5.2Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
671740achore(release): 5.5.2 (#1902)96b38e9chore:disable_searchalignment (#1881)9b6d1f8check gpg only when skip-validation = false (#1894)5a10915chore(release): 5.5.1 (#1873)3e0ce21fix: overwrite pr number on fork (#1871)c4741c8build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#1868)17370e8build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 (#1867)18fdacffix: update to use local app/ dir (#1872)206148cdocs: fix typo in README (#1866)3cb13a1Document acodecov-cliversion reference example (#1774)Updates
sigstore/sigstore-conformancefrom 0.0.16 to 0.0.25Release notes
Sourced from sigstore/sigstore-conformance's releases.
... (truncated)
Commits
eae6eb1suggest implementation strategy for managed key verify tests (#306)d375b73Add bundle with SCT with extensions to tests (#319)468e8b2add a test for message digest mismatch with artifact hash (#312)120147fworkflows: Add sigstore-rust to client conformance report (#316)ecb8250add a simple corrupted inclusion proof check (#315)70c3a2eBump the actions group with 2 updates (#310)6c410c9Bump certifi from 2025.11.12 to 2026.1.4 (#313)6f2bf82add some checks for malformed content (#314)c301dafBump urllib3 from 2.6.2 to 2.6.3 (#311)ef55a33Bump the python-minor-and-patch-updates group with 2 updates (#308)Updates
theupdateframework/tuf-conformancefrom 2.3.0 to 2.4.0Release notes
Sourced from theupdateframework/tuf-conformance's releases.
Commits
500c525Prepare 2.4 release (#324)68e81e9Publish a conformance report (#322)daf5ad1Bump ruff from 0.14.2 to 0.14.3 in the python-dependencies group (#320)8b425a2Bump ruff from 0.14.1 to 0.14.2 in the python-dependencies group (#319)eaca9f1Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#318)032d542Bump ruff from 0.14.0 to 0.14.1 in the python-dependencies group (#317)0e9e191Bump ruff from 0.13.3 to 0.14.0 in the python-dependencies group (#316)78f59abBump ruff from 0.13.2 to 0.13.3 in the python-dependencies group (#315)f678c10Bump the python-dependencies group with 2 updates (#314)f01395dBump the python-dependencies group with 2 updates (#312)Updates
actions/dependency-review-actionfrom 4.5.0 to 4.8.2Release notes
Sourced from actions/dependency-review-action's releases.
... (truncated)
Commits
3c4e3dcMerge pull request #1016 from actions/dra-release02930b2Update CONTRIBUTING to reflect new guidelines49ffd9fUpdate CONTRIBUTING to reflect the need to build70cb25e4.8.2 releaseebabd31Merge pull request #1008 from danielhardej/danielhardej-patch-2025102319f9360Update package-lock.json5fd2f98Bump@types/jestto version 29.5.1428647f4Fix PURL parsing by removing encodeURIf620fd1Merge pull request #1013 from actions/dangoor/token-fix9b42b7eRemove bad token referenceUpdates
actions/upload-artifactfrom 4.6.0 to 6.0.0Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
b7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild dist7d27270chore: add missing license cache files for@actions/core,@actions/io, and mi...5f643d3chore: update license files for@actions/artifact@5.0.1 dependencies1df1684chore: update package-lock.json with@actions/artifact@5.0.1b5b1a91fix: update@actions/artifactto ^5.0.0 for Node.js 24 punycode fixUpdates
slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.ymlfrom 2.0.0 to 2.1.0Release notes
Sourced from slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml's releases.