From be251f6fb7e33a8a67763066147590af4df16a48 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 11 Aug 2024 20:59:34 -0500 Subject: [PATCH] chore: bump the all-gha group across 1 directory with 7 updates (#488) Bumps the all-gha group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.9.0` | `2.9.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.25.15` | `3.26.0` | | [fossas/fossa-action](https://github.com/fossas/fossa-action) | `1.3.3` | `1.4.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `6.0.1` | `6.1.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.5.0` | `3.6.0` | | [testifysec/witness-run-action](https://github.com/testifysec/witness-run-action) | `0.2.0` | `0.2.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.4` | `4.3.6` | Updates `step-security/harden-runner` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/0d381219ddf674d61a7572ddd19d7941e271515c...5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde) Updates `github/codeql-action` from 3.25.15 to 3.26.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/afb54ba388a7dca6ecae48f608c4ff05ff4cc77a...eb055d739abdc2e8de2e5f4ba1a8b246daa779aa) Updates `fossas/fossa-action` from 1.3.3 to 1.4.0 - [Release notes](https://github.com/fossas/fossa-action/releases) - [Commits](https://github.com/fossas/fossa-action/compare/47ef11b1e1e3812e88dae436ccbd2d0cbd1adab0...09bcf127dc0ccb4b5a023f6f906728878e8610ba) Updates `golangci/golangci-lint-action` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/a4f60bb28d35aeee14e6880718e0c85ff1882e64...aaa42aa0628b4ae2578232a66b541047968fac86) Updates `sigstore/cosign-installer` from 3.5.0 to 3.6.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/59acb6260d9c0ba8f4a2f9d9b48431a222b68e20...4959ce089c160fddf62f7b42464195ba1a56d382) Updates `testifysec/witness-run-action` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/testifysec/witness-run-action/releases) - [Commits](https://github.com/testifysec/witness-run-action/compare/85ddab8b46a86b2905a3b547a1806ab264fbb810...79320a907f611f2fb40ced8e13c66af988b2d9db) Updates `actions/upload-artifact` from 4.3.4 to 4.3.6 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/0b2256b8c012f0828dc542b3febcab082c67f72b...834a144ee995460fba8ed112a2fc961b36a5ec5a) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-gha - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-gha - dependency-name: fossas/fossa-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-gha - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-gha - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-gha - dependency-name: testifysec/witness-run-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-gha - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-gha ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dependency-review.yml | 2 +- .github/workflows/fossa.yml | 2 +- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/witness.yml | 6 +++--- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e019d64f..38cbec7a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,7 +45,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: egress-policy: audit @@ -58,7 +58,7 @@ jobs: go-version: 1.21.x # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15 + uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -68,7 +68,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15 + uses: github/codeql-action/autobuild@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -81,6 +81,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15 + uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index f072eaba..bf2dcfba 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: egress-policy: audit diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml index d8e54309..bd7c76f2 100644 --- a/.github/workflows/fossa.yml +++ b/.github/workflows/fossa.yml @@ -23,6 +23,6 @@ jobs: uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - if: ${{ env.FOSSA_API_KEY != '' }} name: "Run FOSSA Scan" - uses: fossas/fossa-action@47ef11b1e1e3812e88dae436ccbd2d0cbd1adab0 # v1.3.3 + uses: fossas/fossa-action@09bcf127dc0ccb4b5a023f6f906728878e8610ba # v1.4.0 with: api-key: ${{ env.FOSSA_API_KEY }} diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 7208ab2c..115d014d 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -22,7 +22,7 @@ jobs: steps: - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 - name: golangci-lint - uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1 + uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0 with: version: latest args: --timeout=3m diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8d725663..c86d02c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -119,7 +119,7 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} - name: Install Cosign - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 + uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0 - name: Install syft uses: anchore/sbom-action/download-syft@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0 @@ -128,7 +128,7 @@ jobs: run: go install github.com/goreleaser/goreleaser@v1.23.0 - name: Run GoReleaser - uses: testifysec/witness-run-action@85ddab8b46a86b2905a3b547a1806ab264fbb810 + uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f7d8e768..136055a1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -67,7 +67,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # tag=v4.3.4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # tag=v4.3.6 with: name: SARIF file path: results.sarif @@ -75,6 +75,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # tag=v3.25.15 + uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # tag=v3.26.0 with: sarif_file: results.sarif diff --git a/.github/workflows/witness.yml b/.github/workflows/witness.yml index 710fa7d3..a9460310 100644 --- a/.github/workflows/witness.yml +++ b/.github/workflows/witness.yml @@ -62,7 +62,7 @@ jobs: path: /tmp - if: ${{ inputs.pre-command != '' && inputs.pull_request == false }} - uses: testifysec/witness-run-action@85ddab8b46a86b2905a3b547a1806ab264fbb810 + uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db with: step: pre-${{ inputs.step }} attestations: ${{ inputs.attestations }} @@ -71,7 +71,7 @@ jobs: run: ${{ inputs.pre-command }} - if: ${{ inputs.pull_request == false }} - uses: testifysec/witness-run-action@85ddab8b46a86b2905a3b547a1806ab264fbb810 + uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db with: step: ${{ inputs.step }} attestations: ${{ inputs.attestations }} @@ -80,7 +80,7 @@ jobs: run: ${{ inputs.command }} - if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}} - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 + uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6 with: name: ${{ inputs.artifact-upload-name }} path: ${{ inputs.artifact-upload-path }}