Skip to content

build(deps): Bump the actions group across 1 directory with 12 updates #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+25 −25
Open

build(deps): Bump the actions group across 1 directory with 12 updates #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ jobs:
key: platform-coverage

- name: Install pinned coverage tool
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }}

Expand Down Expand Up @@ -298,7 +298,7 @@ jobs:
key: platform-fuzz-${{ matrix.target }}

- name: Install pinned cargo-fuzz
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -315,7 +315,7 @@ jobs:

- name: Upload fuzz failures
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: platform-fuzz-${{ matrix.target }}
path: products/platform/fuzz/artifacts/${{ matrix.target }}/
Expand All @@ -339,7 +339,7 @@ jobs:
cache-targets: false

- name: Install cargo-deny and just
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-deny@0.19.8,just@1.51.0

Expand Down Expand Up @@ -583,7 +583,7 @@ jobs:
[[ "$(uname -m)" == "x86_64" ]]

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.12.0
cache: npm
Expand All @@ -602,7 +602,7 @@ jobs:
run: npm run check:tutorial:dry-run

- name: Cache source-under-test Cargo build
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
with:
path: |
target/registryctl-tutorial-cargo-home
Expand All @@ -628,7 +628,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.12.0
cache: npm
Expand Down Expand Up @@ -659,7 +659,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.12.0
cache: npm
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,16 +35,16 @@ jobs:
build-mode: none
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

- name: Initialize CodeQL
uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
queries: security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v3
with:
category: "/language:${{ matrix.language }}"
2 changes: 1 addition & 1 deletion .github/workflows/docs-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
submodules: false

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.12.0
cache: npm
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/nightly-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
submodules: false

- name: Restore last successful nightly state
uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .nightly-security-state
key: nightly-security-state-${{ github.run_id }}-${{ github.run_attempt }}
Expand Down Expand Up @@ -183,7 +183,7 @@ jobs:
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

- name: Install cargo-fuzz
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -206,7 +206,7 @@ jobs:

- name: Upload notary fuzz artifacts
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: nightly-notary-fuzz-artifacts
path: products/notary/fuzz/artifacts
Expand Down Expand Up @@ -234,7 +234,7 @@ jobs:
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

- name: Install cargo-fuzz
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -258,7 +258,7 @@ jobs:

- name: Upload platform fuzz artifacts
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: nightly-platform-fuzz-artifacts
path: products/platform/fuzz/artifacts
Expand Down Expand Up @@ -286,7 +286,7 @@ jobs:
uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

- name: Install cargo-fuzz
uses: taiki-e/install-action@25435dc8dd3baed7417e0c96d3fe89013a5b2e09 # v2.81.3
uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b # v2.83.4
with:
tool: cargo-fuzz@${{ env.CARGO_FUZZ_VERSION }}

Expand All @@ -308,7 +308,7 @@ jobs:

- name: Upload manifest fuzz artifacts
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: nightly-manifest-fuzz-artifacts
path: products/manifest/fuzz/artifacts
Expand All @@ -331,7 +331,7 @@ jobs:
printf '%s\n' "${{ needs.changes.outputs.head_sha }}" > .nightly-security-state/last-success-sha

- name: Save last successful nightly state
uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .nightly-security-state
key: nightly-security-state-${{ github.run_id }}-${{ github.run_attempt }}
10 changes: 5 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ jobs:
} >> "${GITHUB_OUTPUT}"

- name: Set up evidence checker runtime
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
with:
node-version: 22.12.0

Expand Down Expand Up @@ -168,7 +168,7 @@ jobs:
printf 'fingerprint=%s\n' "${fingerprint}" >> "${GITHUB_OUTPUT}"

- name: Restore Cargo release cache
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
with:
path: |
.cargo-home/registry
Expand Down Expand Up @@ -333,10 +333,10 @@ jobs:
path: dist/image-bin

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c

- name: Log in to GHCR
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
Expand Down Expand Up @@ -605,7 +605,7 @@ jobs:
echo "base64_subjects=$(base64 -w0 "${subjects}")" >> "${GITHUB_OUTPUT}"

- name: Install cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin cosign v2 or switch release signing to bundles

With the v4 installer, cosign-release now defaults to v3.0.6 (action.yml), and cosign v3's sign-blob flow expects a --bundle output (v3.0.6 docs); however the later Sign release artifacts step still calls cosign sign-blob --output-signature ... --output-certificate ... with no --bundle. On any tag release, the v3 signing-config path tries to write the required bundle to an empty path before the .sig/.pem files are created, so release publishing fails; either pin cosign-release: v2.5.2 or update the asset/signature flow to use .sigstore.json bundles.

Useful? React with 👍 / 👎.


- name: Sign release artifacts (keyless)
shell: bash
Expand Down
Loading