build(deps): bump the ci group with 3 updates

[dependabot]

Bumps the ci group with 3 updates: anchore/sbom-action, sigstore/cosign-installer and peter-evans/create-pull-request.

Updates anchore/sbom-action from 0.15.5 to 0.15.8

Release notes

Sourced from anchore/sbom-action's releases.

v0.15.8

Changes in v0.15.8

• Update Syft to v0.103.1 (#441) [anchore-actions-token-generator]

v0.15.7

Changes in v0.15.7

• chore: migrate action to use node v20.11.0 (Iron) FROM node v16.x.x (#440) [spiffcs]

v0.15.6

Changes in v0.15.6

• chore(deps): update Syft to v0.102.0 (#438) [anchore-actions-token-generator]

Commits

• b6a39da chore(deps): update Syft to v0.103.1 (#441)
• 767b08f chore: migrate action from 16 -> 20 (#440)
• c6aed38 chore(deps): update Syft to v0.102.0 (#438)
• See full diff in compare view

Updates sigstore/cosign-installer from 3.3.0 to 3.4.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v3.4.0

What's Changed

• Use examples that work with multiple tags by @​jkreileder in sigstore/cosign-installer#155
• default cosign install to release v2.2.3 by @​cpanato in sigstore/cosign-installer#156

New Contributors

• @​jkreileder made their first contribution in sigstore/cosign-installer#155

Full Changelog: sigstore/cosign-installer@v3...v3.4.0

Commits

• e1523de default cosign install to release v2.2.3 (#156)
• b18d21a Use examples that work with multiple tags (#155)
• See full diff in compare view

Updates peter-evans/create-pull-request from 5.0.2 to 6.0.0

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v6.0.0

Behaviour changes

• The default values for author and committer have changed. See "What's new" below for details. If you are overriding the default values you will not be affected by this change.
• On completion, the action now removes the temporary git remote configuration it adds when using push-to-fork. This should not affect you unless you were using the temporary configuration for some other purpose after the action completes.

What's new

• Updated runtime to Node.js 20
  • The action now requires a minimum version of v2.308.0 for the Actions runner. Update self-hosted runners to v2.308.0 or later to ensure compatibility.
• The default value for author has been changed to ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com>. The change adds the ${{ github.actor_id }}+ prefix to the email address to align with GitHub's standard format for the author email address.
• The default value for committer has been changed to github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>. This is to align with the default GitHub Actions bot user account.
• Adds input git-token, the Personal Access Token (PAT) that the action will use for git operations. This input defaults to the value of token. Use this input if you would like the action to use a different token for git operations than the one used for the GitHub API.
• push-to-fork now supports pushing to sibling repositories in the same network.
• Previously, when using push-to-fork, the action did not remove temporary git remote configuration it adds during execution. This has been fixed and the configuration is now removed when the action completes.
• If the pull request body is truncated due to exceeding the maximum length, the action will now suffix the body with the message "...[Pull request body truncated]" to indicate that the body has been truncated.
• The action now uses --unshallow only when necessary, rather than as a default argument of git fetch. This should improve performance, particularly for large git repositories with extensive commit history.
• The action can now be executed on one GitHub server and create pull requests on a different GitHub server. Server products include GitHub hosted (github.com), GitHub Enterprise Server (GHES), and GitHub Enterprise Cloud (GHEC). For example, the action can be executed on GitHub hosted and create pull requests on a GHES or GHEC instance.

What's Changed

• Update distribution by @​actions-bot in peter-evans/create-pull-request#2086
• fix crazy-max/ghaction-import-gp parameters by @​fharper in peter-evans/create-pull-request#2177
• Update distribution by @​actions-bot in peter-evans/create-pull-request#2364
• Use checkout v4 by @​okuramasafumi in peter-evans/create-pull-request#2521
• Note about delete-branch by @​dezren39 in peter-evans/create-pull-request#2631
• 98 dependency updates by @​dependabot

New Contributors

• @​fharper made their first contribution in peter-evans/create-pull-request#2177
• @​okuramasafumi made their first contribution in peter-evans/create-pull-request#2521
• @​dezren39 made their first contribution in peter-evans/create-pull-request#2631

Full Changelog: peter-evans/create-pull-request@v5.0.2...v6.0.0

Commits

• b1ddad2 feat: v6 (#2717)
• bb80902 build(deps-dev): bump @​types/node from 18.19.8 to 18.19.10 (#2712)
• e0037d4 build(deps): bump peter-evans/create-or-update-comment from 3 to 4 (#2702)
• 94b1f99 build(deps): bump peter-evans/find-comment from 2 to 3 (#2703)
• 69c27ea build(deps-dev): bump ts-jest from 29.1.1 to 29.1.2 (#2685)
• 7ea722a build(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#2684)
• 5ee839a build(deps-dev): bump @​types/node from 18.19.7 to 18.19.8 (#2683)
• 60fc256 build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#2660)
• 0c67723 build(deps-dev): bump @​types/node from 18.19.5 to 18.19.7 (#2661)
• 4e288e8 build(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#2659)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[fluxcdbot]

Successfully created backport PR for release/v2.2.x:

• [release/v2.2.x] build(deps): bump the ci group with 3 updates #4587