Skip to content

Commit 17e3154

Browse files
dependabot[bot]dependabot[bot]
authored
Bump the actions group across 1 directory with 10 updates
Bumps the actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.2` | `2.13.2` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.3.1` | `5.5.1` | | [theupdateframework/tuf-conformance](https://github.com/theupdateframework/tuf-conformance) | `2.3.0` | `2.4.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.5.0` | `4.8.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.0` | `5.0.0` | | [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `6.0.0` | | [rubygems/configure-rubygems-credentials](https://github.com/rubygems/configure-rubygems-credentials) | `f456a002d58f0de60b44383d10ae82316b18a166` | `84f9e705f303e1311e5263a61ce58bcb03804fcc` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.2.1` | `2.4.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.3` | Updates `step-security/harden-runner` from 2.12.2 to 2.13.2 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@6c439dc...95d9a5d) Updates `codecov/codecov-action` from 5.3.1 to 5.5.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@13ce06b...5a10915) Updates `theupdateframework/tuf-conformance` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/theupdateframework/tuf-conformance/releases) - [Commits](theupdateframework/tuf-conformance@9bfc222...500c525) Updates `actions/dependency-review-action` from 4.5.0 to 4.8.2 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@3b139cf...3c4e3dc) Updates `actions/upload-artifact` from 4.6.0 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@65c4c4a...330a01c) Updates `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` from 2.0.0 to 2.1.0 - [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases) - [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) - [Commits](slsa-framework/slsa-github-generator@v2.0.0...v2.1.0) Updates `actions/download-artifact` from 4.1.8 to 6.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@fa0a91b...018cc2c) Updates `rubygems/configure-rubygems-credentials` from f456a002d58f0de60b44383d10ae82316b18a166 to 84f9e705f303e1311e5263a61ce58bcb03804fcc - [Release notes](https://github.com/rubygems/configure-rubygems-credentials/releases) - [Commits](rubygems/configure-rubygems-credentials@f456a00...84f9e70) Updates `softprops/action-gh-release` from 2.2.1 to 2.4.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@c95fe14...5be0e66) Updates `ossf/scorecard-action` from 2.4.0 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@62b2cac...4eaacf0) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.13.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 5.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: theupdateframework/tuf-conformance dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/dependency-review-action dependency-version: 4.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: rubygems/configure-rubygems-credentials dependency-version: 84f9e705f303e1311e5263a61ce58bcb03804fcc dependency-type: direct:production dependency-group: actions - dependency-name: softprops/action-gh-release dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <[email protected]>
1 parent a8e5cc8 commit 17e3154

File tree

5 files changed

+21
-21
lines changed

5 files changed

+21
-21
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
# - { os: windows-latest, ruby: mswin }
3434
steps:
3535
- name: Harden Runner
36-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
36+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
3737
with:
3838
egress-policy: audit
3939

@@ -50,7 +50,7 @@ jobs:
5050
run: bin/rake test
5151

5252
- name: Upload coverage reports to Codecov
53-
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
53+
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
5454
if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always()
5555
with:
5656
token: ${{ secrets.CODECOV_TOKEN }}
@@ -72,7 +72,7 @@ jobs:
7272
# - { os: windows-latest, ruby: mswin }
7373
steps:
7474
- name: Harden Runner
75-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
75+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
7676
with:
7777
egress-policy: audit
7878

@@ -115,7 +115,7 @@ jobs:
115115
# - { os: windows-latest, ruby: mswin }
116116
steps:
117117
- name: Harden Runner
118-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
118+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
119119
with:
120120
egress-policy: audit
121121

@@ -135,7 +135,7 @@ jobs:
135135
run: bin/rake bin/tuf-conformance-entrypoint.xfails
136136

137137
- name: Run the TUF conformance tests
138-
uses: theupdateframework/tuf-conformance@9bfc222a371e30ad5511eb17449f68f855fb9d8f # v2.3.0
138+
uses: theupdateframework/tuf-conformance@500c525c9ce287a472fd334fe8d885cace667d32 # v2.4.0
139139
with:
140140
entrypoint: ${{ github.workspace }}/bin/tuf-conformance-entrypoint
141141
artifact-name: "test repositories ${{ matrix.ruby }} ${{ matrix.os }}"
@@ -154,7 +154,7 @@ jobs:
154154
os: [ubuntu-latest]
155155
steps:
156156
- name: Harden Runner
157-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
157+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
158158
with:
159159
egress-policy: audit
160160

@@ -194,7 +194,7 @@ jobs:
194194

195195
steps:
196196
- name: Harden Runner
197-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
197+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
198198
with:
199199
egress-policy: audit
200200

@@ -209,7 +209,7 @@ jobs:
209209
name: Lint
210210
steps:
211211
- name: Harden Runner
212-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
212+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
213213
with:
214214
egress-policy: audit
215215

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141

4242
steps:
4343
- name: Harden Runner
44-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
44+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
4545
with:
4646
egress-policy: audit
4747

‎.github/workflows/dependency-review.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Harden Runner
20-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
20+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
2121
with:
2222
egress-policy: audit
2323

@@ -26,4 +26,4 @@ jobs:
2626
with:
2727
persist-credentials: false
2828
- name: "Dependency Review"
29-
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
29+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,14 @@ jobs:
8282
HASHES: ${{ steps.hash.outputs.hashes }}
8383

8484
- name: Upload built packages
85-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
85+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
8686
with:
8787
name: built-packages
8888
path: ./pkg/
8989
if-no-files-found: warn
9090

9191
- name: Upload smoketest-artifacts
92-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
92+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
9393
with:
9494
name: smoketest-artifacts
9595
path: smoketest-artifacts/
@@ -104,7 +104,7 @@ jobs:
104104
contents: write # To add assets to a release.
105105
# Currently this action needs to be referred by tag. More details at:
106106
# https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance
107-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
107+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
108108
with:
109109
provenance-name: provenance-sigstore-${{ github.event.release.tag_name }}.intoto.jsonl
110110
base64-subjects: "${{ needs.build.outputs.hashes }}"
@@ -124,7 +124,7 @@ jobs:
124124
name: Publish ${{ matrix.built-gem }} to RubyGems
125125
steps:
126126
- name: Download artifacts directories # goes to current working directory
127-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
127+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
128128

129129
- name: Set up Ruby
130130
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
@@ -146,7 +146,7 @@ jobs:
146146
working-directory: rubygems
147147

148148
- name: Configure RubyGems credentials
149-
uses: rubygems/configure-rubygems-credentials@f456a002d58f0de60b44383d10ae82316b18a166 # main
149+
uses: rubygems/configure-rubygems-credentials@84f9e705f303e1311e5263a61ce58bcb03804fcc # main
150150
with:
151151
trusted-publisher: true
152152

@@ -164,13 +164,13 @@ jobs:
164164
contents: write
165165
steps:
166166
- name: Download artifacts directories # goes to current working directory
167-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
167+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
168168

169169
- name: Upload artifacts to github
170170
# Confusingly, this action also supports updating releases, not
171171
# just creating them. This is what we want here, since we've manually
172172
# created the release that triggered the action.
173-
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
173+
uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2.4.2
174174
with:
175175
# smoketest-artifacts/ contains the signatures and certificates.
176176
files: |

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535

3636
steps:
3737
- name: Harden Runner
38-
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
38+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
3939
with:
4040
egress-policy: audit
4141

@@ -45,7 +45,7 @@ jobs:
4545
persist-credentials: false
4646

4747
- name: "Run analysis"
48-
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
48+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
4949
with:
5050
results_file: results.sarif
5151
results_format: sarif
@@ -67,7 +67,7 @@ jobs:
6767
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6868
# format to the repository Actions tab.
6969
- name: "Upload artifact"
70-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
70+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
7171
with:
7272
name: SARIF file
7373
path: results.sarif

0 commit comments

Comments
 (0)