Update github-actions deps #9420

renovate · 2024-01-30T00:37:11Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	`v3.1.0` -> `v3.6.0`
actions/upload-artifact	action	patch	`v3.1.0` -> `v3.1.3`
github/codeql-action	action	minor	`v2.2.4` -> `v2.23.2`
github/codeql-action	action	patch	`v3.23.1` -> `v3.23.2`
ossf/scorecard-action	action	minor	`v2.1.2` -> `v2.3.1`

Release Notes

actions/checkout (actions/checkout)

actions/upload-artifact (actions/upload-artifact)

`v3.1.3`

Compare Source

What's Changed

chore(github): remove trailing whitespaces by @ljmf00 in https://github.com/actions/upload-artifact/pull/313
Bump @actions/artifact version to v1.1.2 by @bethanyj28 in https://github.com/actions/upload-artifact/pull/436

Full Changelog: actions/upload-artifact@v3...v3.1.3

`v3.1.2`

Compare Source

Update all @actions/* NPM packages to their latest versions- #374
Update all dev dependencies to their most recent versions - #375

`v3.1.1`

Compare Source

Update actions/core package to latest version to remove set-output deprecation warning #351

github/codeql-action (github/codeql-action)

`v2.23.2`

Compare Source

`v2.23.1`

Compare Source

`v2.23.0`

Compare Source

`v2.22.12`

Compare Source

`v2.22.11`

Compare Source

`v2.22.10`

Compare Source

`v2.22.9`

Compare Source

`v2.22.8`

Compare Source

`v2.22.7`

Compare Source

`v2.22.6`

Compare Source

`v2.22.5`

Compare Source

`v2.22.4`

Compare Source

`v2.22.3`

Compare Source

`v2.22.2`

Compare Source

`v2.22.1`

Compare Source

`v2.22.0`

Compare Source

`v2.21.9`

Compare Source

`v2.21.8`

Compare Source

`v2.21.7`

Compare Source

`v2.21.6`

Compare Source

`v2.21.5`

Compare Source

`v2.21.4`

Compare Source

`v2.21.3`

Compare Source

`v2.21.2`

Compare Source

`v2.21.1`

Compare Source

`v2.21.0`

Compare Source

`v2.20.4`

Compare Source

`v2.20.3`

Compare Source

`v2.20.2`

Compare Source

`v2.20.1`

Compare Source

`v2.20.0`

Compare Source

`v2.3.6`

Compare Source

`v2.3.5`

Compare Source

`v2.3.4`

Compare Source

`v2.3.3`

Compare Source

`v2.3.2`

Compare Source

`v2.3.1`

Compare Source

`v2.3.0`

Compare Source

`v2.2.12`

Compare Source

`v2.2.11`

Compare Source

`v2.2.10`

Compare Source

`v2.2.9`

Compare Source

`v2.2.8`

Compare Source

`v2.2.7`

Compare Source

`v2.2.6`

Compare Source

`v2.2.5`

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

`v2.3.1`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
- Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

`v2.3.0`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1270
- For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
✨ Send rekor tlog index to webapp when publishing results by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1169
🐛 Prevent url clipping for GHES instances by @rajbos in https://github.com/ossf/scorecard-action/pull/1225

Documentation

📖 Update access rights needed to see the results in code scanning by @rajbos in https://github.com/ossf/scorecard-action/pull/1229
📖 Add package comments. by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1221
📖 Add SECURITY.md file by @david-a-wheeler in https://github.com/ossf/scorecard-action/pull/1250
📖 Fix typo in token input docs by @aabouzaid in https://github.com/ossf/scorecard-action/pull/1258

New Contributors

@david-a-wheeler made their first contribution in https://github.com/ossf/scorecard-action/pull/1250
@aabouzaid made their first contribution in https://github.com/ossf/scorecard-action/pull/1258

Full Changelog: ossf/scorecard-action@v2.2.0...v2.3.0

`v2.2.0`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from v4.10.5 to v4.11.0 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1192

Scorecard Result Viewer

Thanks to contributions from @cynthia-sg and @tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.

As an example, you can see our own score visualized here
Checkout our README to learn how to link your README badge to the new visualization page.

Publishing Results

This release contains two fixes which will improve the user experience when publish_results is true

Runs that fail our workflow restrictions will fail with a 400 response indicating the problem, instead of a vague 500 status. (https://github.com/ossf/scorecard-action/pull/1156, resolved https://github.com/ossf/scorecard-action/issues/1150)
Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (https://github.com/ossf/scorecard-action/pull/1191)

Docs

📖 Update README to accept fine-grained tokens by @pnacht in https://github.com/ossf/scorecard-action/pull/1175
📖 Update installation instructions to match current GitHub UI by @joycebrum in https://github.com/ossf/scorecard-action/pull/1153
📖 Document the GitHub action workflow restrictions when publishing results. by @spencerschrock in

New Contributors

@bobcallaway made their first contribution in https://github.com/ossf/scorecard-action/pull/1140
@pnacht made their first contribution in https://github.com/ossf/scorecard-action/pull/1175

Full Changelog: ossf/scorecard-action@v2.1.3...v2.2.0

`v2.1.3`

Compare Source

What's Changed

🌱 Bump github.com/ossf/scorecard/v4 from 4.10.2 to 4.10.5 by @spencerschrock in https://github.com/ossf/scorecard-action/pull/1111

Bug Fixes

Invalid SARIF files from a bug in scorecard
- #1076, #1094
Vulnerabilities check crashes if a vulnerable dependency is found via OSVScanner
- #1092
Scorecard action not reporting binary artifacts in the repo
- #1116

Full Scorecard Changelog: ossf/scorecard@v4.10.2...v4.10.5

Full Changelog: ossf/scorecard-action@v2.1.2...v2.1.3

Configuration

📅 Schedule: Branch creation - "on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Update github-actions deps

7804505

renovate bot requested a review from a team January 30, 2024 00:37

renovate bot added dependencies Pull requests that update a dependency file renovatebot labels Jan 30, 2024

renovate bot requested a review from jpkrohling January 30, 2024 00:37

codeboten approved these changes Jan 30, 2024

View reviewed changes

Merge branch 'main' into renovate/github-actions-deps

8edb97a

codeboten merged commit 7a43345 into main Jan 30, 2024

codeboten deleted the renovate/github-actions-deps branch January 30, 2024 17:37

github-actions bot added this to the next release milestone Jan 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update github-actions deps #9420

Update github-actions deps #9420

Uh oh!

renovate bot commented Jan 30, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update github-actions deps #9420

Update github-actions deps #9420

Uh oh!

Conversation

renovate bot commented Jan 30, 2024

Release Notes

What's Changed

What's Changed

What's Changed

Documentation

New Contributors

What's Changed

Scorecard Result Viewer

Publishing Results

Docs

New Contributors

What's Changed

Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant