build(deps): bump the ci group with 7 updates #470

dependabot · 2023-11-20T21:46:53Z

Bumps the ci group with 7 updates:

Package	From	To
korthout/backport-action	`2.0.0`	`2.1.1`
Azure/login	`1.4.7`	`1.5.0`
google-github-actions/auth	`1.1.1`	`1.2.0`
docker/build-push-action	`5.0.0`	`5.1.0`
sigstore/cosign-installer	`3.1.2`	`3.2.0`
anchore/sbom-action	`0.14.3`	`0.15.0`
github/codeql-action	`2.22.5`	`2.22.7`

Updates korthout/backport-action from 2.0.0 to 2.1.1

Release notes

Sourced from korthout/backport-action's releases.

Backport-action v2.1.1

What's Changed

This release fixes a small bug in the suggested steps to cherry-pick locally if backporting fails.

Skip merge commits in suggestion by @korthout in korthout/backport-action#397

Updated Dependencies

build(deps): bump @types/dedent from 0.7.1 to 0.7.2 by @dependabot in korthout/backport-action#396

Full Changelog: korthout/backport-action@v2.1.0...v2.1.1

Backport-action v2.1.0

What's Changed

Support copying milestone, assignees, and requested reviewers by @jschmid1 in korthout/backport-action#394

use copy_assignees to copy the assignees

use copy_milestone to copy the milestone

use copy_requested_reviewers to copy the requested reviewers

New Contributors

@jschmid1 made their first contribution in korthout/backport-action#394

Full Changelog: korthout/backport-action@v2.0.0...v2.1.0

Commits

08bafb3 dist: release 2.1.1
a13e378 dist: build new artifacts
487faf2 Merge pull request #397 from korthout/395-skip-merge-commits-in-suggestion
19a4042 fix: suggest git switch over checkout
4fed997 fix: instruct to resolve conflicts
3e20570 fix: suggest to cherry-pick specific commits
bf66681 refactor: remove unused error reasons
e45fafa Merge pull request #396 from korthout/dependabot/npm_and_yarn/types/dedent-0.7.2
494548a build(deps): bump @types/dedent from 0.7.1 to 0.7.2
57e8244 dist: release 2.2.0-SNAPSHOT
Additional commits viewable in compare view

Updates Azure/login from 1.4.7 to 1.5.0

Release notes

Sourced from Azure/login's releases.

Azure Login Action v1.5.0

Updated the versions of dependencies.

Supported passwords to start with hyphen(-).

Enabled OIDC for sovereign clouds.

Supported Managed Identity Login.

Commits

4c88f01 prepare release 1.5.0
e3b217c Update README.md (#363)
63a40dd update pr-check workflow (#370)
ed5636a modify warning message (#358)
0431fbf disable output in CI logs (#359)
4e0edd1 Secure workflow strategy for Azure CLI output configuration (#356)
8bf3bde Support Managed Identity (#348)
a00376e remove a invalid check in pr-check workflow for supporting MI PR (#352)
5906929 replace GitHubActionGroup with GitHubAction_CI_RG (#349)
b998d5a Update README.md for replacing --sdk-auth with --json-auth (#342)
Additional commits viewable in compare view

Updates google-github-actions/auth from 1.1.1 to 1.2.0

Release notes

Sourced from google-github-actions/auth's releases.

v1.2.0

⚠️ This version requires Node 20 or later on the runner! If you are using GitHub-managed runners, no action is needed. If you are using self-hosted runners, make sure the system version of Node is version 20 or higher.

What's Changed

Update deps by @sethvargo in google-github-actions/auth#312

dependabot: only do security updates by @sethvargo in google-github-actions/auth#320

update all deps by @sethvargo in google-github-actions/auth#321

Update README.md by @mattseymour in google-github-actions/auth#332

Update deps to Node 20 by @sethvargo in google-github-actions/auth#339

Drop chai and mocha deps by @sethvargo in google-github-actions/auth#342

Switch to more resilient testing by @sethvargo in google-github-actions/auth#343

Build latest versions by @sethvargo in google-github-actions/auth#345

Release: v1.2.0 by @google-github-actions-bot in google-github-actions/auth#346

New Contributors

@mattseymour made their first contribution in google-github-actions/auth#332

Full Changelog: google-github-actions/auth@v1...v1.2.0

Commits

f105ef0 Release: v1.2.0 (#346)
cf96593 Build latest versions (#345)
292d120 Switch to more resilient testing (#343)
04900d1 Drop chai and mocha deps (#342)
43a5988 Update deps (#339)
e607103 Update README.md (#332)
87b651a update all deps (#321)
8738ec4 dependabot: only do security updates (#320)
ee81b78 Update deps (#312)
See full diff in compare view

Updates docker/build-push-action from 5.0.0 to 5.1.0

Release notes

Sourced from docker/build-push-action's releases.

v5.1.0

Add annotations input by @crazy-max in docker/build-push-action#992

Add secret-envs input by @elias-lundgren in docker/build-push-action#980

Bump @babel/traverse from 7.17.3 to 7.23.2 in docker/build-push-action#991

Bump @docker/actions-toolkit from 0.13.0-rc.1 to 0.14.0 in docker/build-push-action#990 docker/build-push-action#1006

Full Changelog: docker/build-push-action@v5.0.0...v5.1.0

Commits

4a13e50 Merge pull request #1006 from docker/dependabot/npm_and_yarn/docker/actions-t...
7416668 chore: update generated content
b4f76a5 chore(deps): Bump @docker/actions-toolkit from 0.13.0 to 0.14.0
b7feb76 Merge pull request #1005 from crazy-max/ci-inspect
fae8018 ci: inspect sbom and provenance
b625868 Merge pull request #1004 from crazy-max/ci-update-buildx
5193ef1 ci: update buildx to latest
d3afd77 Merge pull request #991 from docker/dependabot/npm_and_yarn/babel/traverse-7....
7a786bb Merge pull request #992 from crazy-max/annotations
c66ae3a chore: update generated content
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 3.1.2 to 3.2.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v3.2.0

Note: This release comes with a fix for CVE-2023-46737 described in this Github Security Advisory. Please upgrade to this release ASAP

see https://github.com/sigstore/cosign/releases/tag/v2.2.1

What's Changed

Support the runner context of gitea act by @josedev-union in sigstore/cosign-installer#147

bump cosign to v2.2.1 by @cpanato in sigstore/cosign-installer#148

test with latest go version by @bobcallaway in sigstore/cosign-installer#150

New Contributors

@josedev-union made their first contribution in sigstore/cosign-installer#147

Full Changelog: sigstore/cosign-installer@v3...v3.2.0

Commits

1fc5bd3 test with latest go version (#150)
9ce7d60 bump cosign to v2.2.1 (#148)
4b014e3 Support the runner context of gitea act (#147)
38ab09d Bump actions/checkout from 4.1.0 to 4.1.1 (#145)
9c520b9 Bump actions/checkout from 4.0.0 to 4.1.0 (#144)
ef6a6b3 Bump actions/checkout from 3.6.0 to 4.0.0 (#143)
See full diff in compare view

Updates anchore/sbom-action from 0.14.3 to 0.15.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.15.0

Changes in v0.14.4

Breaking Changes

Previously, running on Windows required WSL. Now, running on Windows expects to be run on native windows (#426) [willmurphyscode].

Other Changes

pin and upgrade actions/checkout (#428) [willmurphyscode]

chore(deps): update Syft to v0.97.1 (#427) [anchore-actions-token-generator]

add oss community board auto-add workflow (#421) [wagoodman]

Commits

fd74a6f pin and upgrade actions/checkout (#428)
c9fb15d chore(deps): update Syft to v0.97.1 (#427)
74207bd chore: test natively on Windows (#426)
ace0b97 add oss community board auto-add workflow (#421)
See full diff in compare view

Updates github/codeql-action from 2.22.5 to 2.22.7

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

2.22.7 - 16 Nov 2023

Add a deprecation warning for customers using CodeQL version 2.11.5 and earlier. These versions of CodeQL were discontinued on 8 November 2023 alongside GitHub Enterprise Server 3.7, and will be unsupported by CodeQL Action v2.23.0 and later. #1993

If you are using one of these versions, please update to CodeQL CLI version 2.11.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.

Alternatively, if you want to continue using a version of the CodeQL CLI between 2.10.5 and 2.11.5, you can replace github/codeql-action/*@v2 by github/codeql-action/*@v2.22.7 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

2.22.6 - 14 Nov 2023

Customers running Python analysis on macOS using version 2.14.6 or earlier of the CodeQL CLI should upgrade to CodeQL CLI version 2.15.0 or later. If you do not wish to upgrade the CodeQL CLI, ensure that you are using Python version 3.11 or earlier, as CodeQL version 2.14.6 and earlier do not support Python 3.12. You can achieve this by adding a setup-python step to your code scanning workflow before the step that invokes github/codeql-action/init.

Update default CodeQL bundle version to 2.15.2. #1978

2.22.5 - 27 Oct 2023

No user facing changes.

2.22.4 - 20 Oct 2023

Update default CodeQL bundle version to 2.15.1. #1953

Users will begin to see warnings on Node.js 16 deprecation in their Actions logs on code scanning runs starting October 23, 2023.

All code scanning workflows should continue to succeed regardless of the warning.

The team at GitHub maintaining the CodeQL Action is aware of the deprecation timeline and actively working on creating another version of the CodeQL Action, v3, that will bump us to Node 20.

For more information, and to communicate with the maintaining team, please use this issue.

2.22.3 - 13 Oct 2023

Provide an authentication token when downloading the CodeQL Bundle from the API of a GitHub Enterprise Server instance. #1945

2.22.2 - 12 Oct 2023

Update default CodeQL bundle version to 2.15.0. #1938

Improve the log output when an error occurs in an invocation of the CodeQL CLI. #1927

2.22.1 - 09 Oct 2023

Add a workaround for Python 3.12, which is not supported in CodeQL CLI version 2.14.6 or earlier. If you are running an analysis on Windows and using Python 3.12 or later, the CodeQL Action will switch to running Python 3.11. In this case, if Python 3.11 is not found, then the workflow will fail. #1928

2.22.0 - 06 Oct 2023

The CodeQL Action now requires CodeQL version 2.10.5 or later. For more information, see the corresponding changelog entry for CodeQL Action version 2.21.8. #1907

The CodeQL Action no longer runs ML-powered queries. For more information, including details on our investment in AI-powered security technology, see "CodeQL code scanning deprecates ML-powered alerts." #1910

Fix a bug which prevented tracing of projects using Go 1.21 and above on Linux. #1909

... (truncated)

Commits

66b90a5 Merge pull request #1995 from github/update-v2.22.7-10f05151c
bc9ddc2 Update changelog for v2.22.7
10f0515 Merge pull request #1981 from github/aeisenberg/delete-analysis-after-upload
4e80a80 Use delay instead of wait
df9b50e Address comments from review
0d0a53c Merge pull request #1993 from github/henrymercer/deprecation-changenote
df6aced Update CHANGELOG.md
0cd63ca Add changelog note for CodeQL v2.10.5 deprecation
b9e85da Merge pull request #1992 from github/henrymercer/ghes-3.7-deprecation
779838b Prepare for CodeQL v2.10.* deprecation
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ci group with 7 updates: | Package | From | To | | --- | --- | --- | | [korthout/backport-action](https://github.com/korthout/backport-action) | `2.0.0` | `2.1.1` | | [Azure/login](https://github.com/azure/login) | `1.4.7` | `1.5.0` | | [google-github-actions/auth](https://github.com/google-github-actions/auth) | `1.1.1` | `1.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `5.0.0` | `5.1.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.1.2` | `3.2.0` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.14.3` | `0.15.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `2.22.5` | `2.22.7` | Updates `korthout/backport-action` from 2.0.0 to 2.1.1 - [Release notes](https://github.com/korthout/backport-action/releases) - [Commits](korthout/backport-action@408fae1...08bafb3) Updates `Azure/login` from 1.4.7 to 1.5.0 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@92a5484...4c88f01) Updates `google-github-actions/auth` from 1.1.1 to 1.2.0 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@35b0e87...f105ef0) Updates `docker/build-push-action` from 5.0.0 to 5.1.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@0565240...4a13e50) Updates `sigstore/cosign-installer` from 3.1.2 to 3.2.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@11086d2...1fc5bd3) Updates `anchore/sbom-action` from 0.14.3 to 0.15.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](anchore/sbom-action@78fc58e...fd74a6f) Updates `github/codeql-action` from 2.22.5 to 2.22.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@74483a3...66b90a5) --- updated-dependencies: - dependency-name: korthout/backport-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: Azure/login dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added area/ci CI related issues and pull requests dependencies Pull requests that update a dependency labels Nov 20, 2023

stefanprodan approved these changes Nov 20, 2023

View reviewed changes

stefanprodan merged commit 35a4be1 into main Nov 20, 2023
8 checks passed

stefanprodan deleted the dependabot/github_actions/ci-5d48239ae6 branch November 20, 2023 21:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the ci group with 7 updates #470

build(deps): bump the ci group with 7 updates #470

dependabot bot commented on behalf of github Nov 20, 2023

build(deps): bump the ci group with 7 updates #470

build(deps): bump the ci group with 7 updates #470

Conversation

dependabot bot commented on behalf of github Nov 20, 2023

Backport-action v2.1.1

What's Changed

Updated Dependencies

Backport-action v2.1.0

What's Changed

New Contributors

Azure Login Action v1.5.0

v1.2.0

What's Changed

New Contributors

v5.1.0

v3.2.0

What's Changed

New Contributors

v0.15.0

Changes in v0.14.4

Breaking Changes

Other Changes

CodeQL Action Changelog

[UNRELEASED]

2.22.7 - 16 Nov 2023

2.22.6 - 14 Nov 2023

2.22.5 - 27 Oct 2023

2.22.4 - 20 Oct 2023

2.22.3 - 13 Oct 2023

2.22.2 - 12 Oct 2023

2.22.1 - 09 Oct 2023

2.22.0 - 06 Oct 2023