Skip to content

🌱 Bump actions/cache from 3.2.6 to 3.3.0#2738

Merged
naveensrinivasan merged 1 commit intomainfrom
dependabot/github_actions/actions/cache-3.3.0
Mar 10, 2023
Merged

🌱 Bump actions/cache from 3.2.6 to 3.3.0#2738
naveensrinivasan merged 1 commit intomainfrom
dependabot/github_actions/actions/cache-3.3.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 10, 2023

Bumps actions/cache from 3.2.6 to 3.3.0.

Release notes

Sourced from actions/cache's releases.

v3.3.0

What's Changed

New Contributors

Full Changelog: actions/cache@v3...v3.3.0

Changelog

Sourced from actions/cache's changelog.

Releases

3.0.0

  • Updated minimum runner version support from node 12 -> node 16

3.0.1

  • Added support for caching from GHES 3.5.
  • Fixed download issue for files > 2GB during restore.

3.0.2

  • Added support for dynamic cache size cap on GHES.

3.0.3

  • Fixed avoiding empty cache save when no files are available for caching. (issue)

3.0.4

  • Fixed tar creation error while trying to create tar with path as ~/ home folder on ubuntu-latest. (issue)

3.0.5

  • Removed error handling by consuming actions/cache 3.0 toolkit, Now cache server error handling will be done by toolkit. (PR)

3.0.6

  • Fixed #809 - zstd -d: no such file or directory error
  • Fixed #833 - cache doesn't work with github workspace directory

3.0.7

  • Fixed #810 - download stuck issue. A new timeout is introduced in the download process to abort the download if it gets stuck and doesn't finish within an hour.

3.0.8

  • Fix zstd not working for windows on gnu tar in issues #888 and #891.
  • Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable SEGMENT_DOWNLOAD_TIMEOUT_MINS. Default is 60 minutes.

3.0.9

  • Enhanced the warning message for cache unavailablity in case of GHES.

3.0.10

  • Fix a bug with sorting inputs.
  • Update definition for restore-keys in README.md

3.0.11

  • Update toolkit version to 3.0.5 to include @actions/core@^1.10.0
  • Update @actions/cache to use updated saveState and setOutput functions from @actions/core@^1.10.0

3.1.0-beta.1

  • Update @actions/cache on windows to use gnu tar and zstd by default and fallback to bsdtar and zstd if gnu tar is not available. (issue)

3.1.0-beta.2

  • Added support for fallback to gzip to restore old caches on windows.

3.1.0-beta.3

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
🌱 Bump actions/cache from 3.2.6 to 3.3.0
08f2b41 
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@69d9d44...940f3d7)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 10, 2023
@dependabot dependabot bot requested a review from laurentsimon as a code owner March 10, 2023 08:57
@dependabot dependabot bot added the github_actions Pull requests that update Github_actions code label Mar 10, 2023
@dependabot dependabot bot temporarily deployed to integration-test March 10, 2023 08:58 Inactive
@naveensrinivasan naveensrinivasan merged commit a7e81bb into main Mar 10, 2023
@naveensrinivasan naveensrinivasan deleted the dependabot/github_actions/actions/cache-3.3.0 branch March 10, 2023 14:20
azeemshaikh38 added a commit to azeemshaikh38/scorecard that referenced this pull request Mar 14, 2023
@azeemshaikh38
Squashed commit of the following:
36f35fc 
commit 00da7a8be965c09d044f978d6b9eafee1350bd30
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date:   Tue Mar 14 23:07:19 2023 +0000

    Pr comments

commit 1127dd9
Merge: 274448f 23bd295
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date:   Wed Mar 15 04:23:32 2023 +0530

    Merge branch 'main' into go-git

commit 274448f
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date:   Tue Mar 14 22:52:30 2023 +0000

    Initial implementation of go-git client

    Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>

commit 23bd295
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Mar 14 20:28:41 2023 +0000

    :seedling: Bump github/codeql-action from 2.2.4 to 2.2.6 (ossf#2741)

commit fc026ef
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Mar 14 17:04:31 2023 +0000

    :seedling: Bump github.com/google/ko from 0.12.0 to 0.13.0 in /tools (ossf#2742)

commit 2e04214
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Mar 14 14:02:34 2023 +0000

    :seedling: Bump tj-actions/changed-files from 35.6.2 to 35.7.0

    Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 35.6.2 to 35.7.0.
    - [Release notes](https://github.com/tj-actions/changed-files/releases)
    - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
    - [Commits](tj-actions/changed-files@5ce975c...bd376fb)

    ---
    updated-dependencies:
    - dependency-name: tj-actions/changed-files
      dependency-type: direct:production
      update-type: version-update:semver-minor
    ...

    Signed-off-by: dependabot[bot] <support@github.com>

commit e36b590
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Tue Mar 14 08:59:20 2023 -0500

    :seedling: Bump actions/cache from 3.3.0 to 3.3.1 (ossf#2740)

    Bumps [actions/cache](https://github.com/actions/cache) from 3.3.0 to 3.3.1.
    - [Release notes](https://github.com/actions/cache/releases)
    - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
    - [Commits](actions/cache@940f3d7...88522ab)

    ---
    updated-dependencies:
    - dependency-name: actions/cache
      dependency-type: direct:production
      update-type: version-update:semver-patch
    ...

    Signed-off-by: dependabot[bot] <support@github.com>
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commit 6ff94eb
Author: Gabriela Gutierrez <gabigutierrez@google.com>
Date:   Mon Mar 13 19:42:37 2023 +0000

    :bug: Handle editable pip installs (ossf#2731)

    * fix: Handle editable pip install

    Editable pip installs (-e) should be considered secure if the package is installed from a local source or a remote source (VCS install) but pinned by commit hash. To keep the behaviour we have for normal pip installs, we need to guarantee the package dependencies are pinned by hash too. For normal pip installs, we verify that by using --require-hashes flag. Unfortunately, --require-hashes flag is not compatible with editable installs, so we use --no-deps flag to verify the dependencies are not installed since we can't verify if they are pinned.

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Editable pip install in GHA

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Editable pip install in Dockerfile

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Editable pip install in shell script

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * fix: Code complexity increase

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * fix: Simplify boolean return

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * docs: Add pip editable install references in comments

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * fix: Handle multiple packages in editable pip install

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Multi editable pip install in GHA

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Multi editable pip install in Dockerfile

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    * test: Multi editable pip install in shell script

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

    ---------

    Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
    Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

commit 110e352
Author: raghavkaul <8695110+raghavkaul@users.noreply.github.com>
Date:   Mon Mar 13 11:13:50 2023 -0400

    ✨ Gitlab support: RepoClient (ossf#2655)

    * Add make targets and E2E test target for GitLab only

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>

    * Add GitLab support to RepoClient

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>

    * Build

    * Make target for e2e-gitlab-token
    * Only run Gitlab tests in CI that don't require a token

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>

    * Add tests

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>

    * Remove spurious printf

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>

    * 🐛 Check OSS Fuzz build file for Fuzzing check (ossf#2719)

    * Check OSS-Fuzz using project list

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Use clients.RepoClient interface to perform the new OSS Fuzz check

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * wip: add eager client for better repeated lookup of projects

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Split lazy and eager behavior into different implementations.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Add tests and benchmarks

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Switch to always parsing JSON to determine if a project is present. The other approach of looking for a substring match would lead to false positives.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Add eager constructor to surface status file errors sooner.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Switch existing users to new OSS Fuzz client

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Mark old method as deprecated in the godoc

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * remove unused comment.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Use new OSS Fuzz client in e2e test.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * fix typo.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Fix potential path bug with test server.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Force include the two JSON files which were being ignored by .gitignore

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * trim the status json file

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    ---------

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    ---------

    Signed-off-by: Raghav Kaul <raghavkaul@google.com>
    Signed-off-by: Spencer Schrock <sschrock@google.com>
    Co-authored-by: Spencer Schrock <sschrock@google.com>

commit 5625dda
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Sat Mar 11 17:14:42 2023 +0000

    :seedling: Bump github.com/onsi/ginkgo/v2 from 2.8.3 to 2.9.0 in /tools

    Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.8.3 to 2.9.0.
    - [Release notes](https://github.com/onsi/ginkgo/releases)
    - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
    - [Commits](onsi/ginkgo@v2.8.3...v2.9.0)

    ---
    updated-dependencies:
    - dependency-name: github.com/onsi/ginkgo/v2
      dependency-type: direct:production
      update-type: version-update:semver-minor
    ...

    Signed-off-by: dependabot[bot] <support@github.com>

commit d591e38
Author: Spencer Schrock <sschrock@google.com>
Date:   Fri Mar 10 16:02:05 2023 -0800

    🌱  Add RepoClient re-use E2E tests. (ossf#2625)

    * Add e2e test for re-used repoclient.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Improve diff logging

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Skip scorecard e2e test during unit tests.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    * Fix linter.

    Signed-off-by: Spencer Schrock <sschrock@google.com>

    ---------

    Signed-off-by: Spencer Schrock <sschrock@google.com>

commit a7e81bb
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Fri Mar 10 08:20:28 2023 -0600

    :seedling: Bump actions/cache from 3.2.6 to 3.3.0 (ossf#2738)

    Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.0.
    - [Release notes](https://github.com/actions/cache/releases)
    - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
    - [Commits](actions/cache@69d9d44...940f3d7)

    ---
    updated-dependencies:
    - dependency-name: actions/cache
      dependency-type: direct:production
      update-type: version-update:semver-minor
    ...

    Signed-off-by: dependabot[bot] <support@github.com>
    Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@azeemshaikh38 azeemshaikh38 Awaiting requested review from azeemshaikh38

@justaugustus justaugustus Awaiting requested review from justaugustus

@laurentsimon laurentsimon Awaiting requested review from laurentsimon

@spencerschrock spencerschrock Awaiting requested review from spencerschrock

@raghavkaul raghavkaul Awaiting requested review from raghavkaul

1 more reviewer

@naveensrinivasan naveensrinivasan naveensrinivasan approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@naveensrinivasan