⬆️ gha: Bump the github-actions group with 12 updates #3
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
added
dependencies
|
Here's the code health analysis summary for commits Analysis Summary
|
WalkthroughThe recent updates to the GitHub Actions workflows involve upgrading several actions across multiple YAML files. The primary focus is on enhancing security and performance in the CI/CD pipeline by keeping dependencies current. Key actions like Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant GitHubActions
participant HardenRunner
participant SetupGo
participant CodeQL
User->>GitHubActions: Trigger workflow
GitHubActions->>HardenRunner: Execute hardening steps
GitHubActions->>SetupGo: Set up Go environment
GitHubActions->>CodeQL: Run CodeQL analysis
GitHubActions->>User: Workflow complete
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Files selected for processing (5)
- .github/workflows/codeql.yml (3 hunks)
- .github/workflows/dependency-review.yml (1 hunks)
- .github/workflows/lint.yml (8 hunks)
- .github/workflows/scorecard.yml (3 hunks)
- .github/workflows/test.yml (1 hunks)
Additional comments not posted (27)
.github/workflows/test.yml (2)
19-19: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
23-23: Update toactions/setup-gois correctly applied.The version update from
v5.0.1tov5.0.2aligns with the PR objectives and may include minor improvements or bug fixes..github/workflows/dependency-review.yml (2)
20-20: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
27-27: Update toactions/dependency-review-actionis correctly applied.The version update from
v4.3.3tov4.3.4aligns with the PR objectives and may include improvements or bug fixes related to dependency analysis..github/workflows/codeql.yml (5)
44-44: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
51-51: Update toactions/setup-gois correctly applied.The version update from
v5.0.1tov5.0.2aligns with the PR objectives and may include minor improvements or bug fixes.
57-57: Update togithub/codeql-action/initis correctly applied.The version update from
v3.25.11tov3.26.3is consistent with the PR objectives and may provide new features or optimizations.
67-67: Update togithub/codeql-action/autobuildis correctly applied.The version update from
v3.25.11tov3.26.3aligns with the PR objectives and may improve the build process for compiled languages.
80-80: Update togithub/codeql-action/analyzeis correctly applied.The version update from
v3.25.11tov3.26.3is consistent with the PR objectives and may enhance analysis capabilities..github/workflows/scorecard.yml (4)
36-36: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
46-46: Update toossf/scorecard-actionis correctly applied.The version update from
v2.3.3tov2.4.0aligns with the PR objectives and may include enhancements to analysis capabilities.
68-68: Update toactions/upload-artifactis correctly applied.The version update from
v4.3.4tov4.3.6is consistent with the PR objectives and may address bugs or improve functionality related to artifact handling.
76-76: Update togithub/codeql-action/upload-sarifis correctly applied.The version update from
v3.25.11tov3.26.3aligns with the PR objectives and may include improvements to the SARIF file upload process..github/workflows/lint.yml (14)
20-20: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
26-26: Update toreviewdog/action-tflintis correctly applied.The version update from
v1.23.0tov1.23.2aligns with the PR objectives and may enhance linting capabilities.
41-41: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
47-47: Update toreviewdog/action-trivyis correctly applied.The version update from
v1.10.0tov1.11.0aligns with the PR objectives and may enhance security scanning capabilities.
61-61: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
81-81: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
102-102: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
108-108: Update toreviewdog/action-misspellis correctly applied.The version update from
v1.22.0tov1.23.0aligns with the PR objectives and may enhance spell-checking capabilities.
123-123: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
129-129: Update toreviewdog/action-alexis correctly applied.The version update from
v1.12.0tov1.13.0aligns with the PR objectives and may enhance content analysis capabilities.
143-143: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
149-149: Update toreviewdog/action-markdownlintis correctly applied.The version update from
v0.23.0tov0.24.0aligns with the PR objectives and may enhance markdown linting capabilities.
163-163: Update tostep-security/harden-runneris correctly applied.The version update from
v2.8.1tov2.9.1is consistent with the PR objectives and should enhance security features.
169-169: Update toreviewdog/action-actionlintis correctly applied.The version update from
v1.53.0tov1.54.0aligns with the PR objectives and may enhance action linting capabilities.
|
@dependabot rebase |
Bumps the github-actions group with 12 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.8.1` | `2.9.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.0.1` | `5.0.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.25.11` | `3.26.3` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.3.3` | `4.3.4` | | [reviewdog/action-tflint](https://github.com/reviewdog/action-tflint) | `1.23.0` | `1.23.2` | | [reviewdog/action-trivy](https://github.com/reviewdog/action-trivy) | `1.10.0` | `1.11.0` | | [reviewdog/action-misspell](https://github.com/reviewdog/action-misspell) | `1.22.0` | `1.23.0` | | [reviewdog/action-alex](https://github.com/reviewdog/action-alex) | `1.12.0` | `1.13.0` | | [reviewdog/action-markdownlint](https://github.com/reviewdog/action-markdownlint) | `0.23.0` | `0.24.0` | | [reviewdog/action-actionlint](https://github.com/reviewdog/action-actionlint) | `1.53.0` | `1.54.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.3` | `2.4.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.4` | `4.3.6` | Updates `step-security/harden-runner` from 2.8.1 to 2.9.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@17d0e2b...5c7944e) Updates `actions/setup-go` from 5.0.1 to 5.0.2 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@cdcb360...0a12ed9) Updates `github/codeql-action` from 3.25.11 to 3.26.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b611370...883d858) Updates `actions/dependency-review-action` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@72eb03d...5a2ce3f) Updates `reviewdog/action-tflint` from 1.23.0 to 1.23.2 - [Release notes](https://github.com/reviewdog/action-tflint/releases) - [Commits](reviewdog/action-tflint@ed9fc53...0a8c6a4) Updates `reviewdog/action-trivy` from 1.10.0 to 1.11.0 - [Release notes](https://github.com/reviewdog/action-trivy/releases) - [Commits](reviewdog/action-trivy@82e31f8...14e16b3) Updates `reviewdog/action-misspell` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/reviewdog/action-misspell/releases) - [Commits](reviewdog/action-misspell@278e1b3...ef8b22c) Updates `reviewdog/action-alex` from 1.12.0 to 1.13.0 - [Release notes](https://github.com/reviewdog/action-alex/releases) - [Commits](reviewdog/action-alex@95457e9...f95df9e) Updates `reviewdog/action-markdownlint` from 0.23.0 to 0.24.0 - [Release notes](https://github.com/reviewdog/action-markdownlint/releases) - [Commits](reviewdog/action-markdownlint@af20b94...e9f3ab4) Updates `reviewdog/action-actionlint` from 1.53.0 to 1.54.0 - [Release notes](https://github.com/reviewdog/action-actionlint/releases) - [Commits](reviewdog/action-actionlint@d99f1ce...4f8f996) Updates `ossf/scorecard-action` from 2.3.3 to 2.4.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@dc50aa9...62b2cac) Updates `actions/upload-artifact` from 4.3.4 to 4.3.6 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@0b2256b...834a144) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: reviewdog/action-tflint dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: reviewdog/action-trivy dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-misspell dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-alex dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-markdownlint dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-actionlint dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/github_actions/github-actions-c4f85ccb2e
branch
from
81eefdf to
713f150
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Files selected for processing (5)
- .github/workflows/codeql.yml (3 hunks)
- .github/workflows/dependency-review.yml (1 hunks)
- .github/workflows/lint.yml (8 hunks)
- .github/workflows/scorecard.yml (3 hunks)
- .github/workflows/test.yml (1 hunks)
Additional comments not posted (20)
.github/workflows/dependency-review.yml (2)
20-20: Update toharden-runneraction is correct.The
step-security/harden-runneraction has been updated to versionv2.9.1, aligning with the PR objectives.
27-27: Update todependency-review-actionis correct.The
actions/dependency-review-actionhas been updated to versionv4.3.4, aligning with the PR objectives..github/workflows/test.yml (2)
19-19: Update toharden-runneraction is correct.The
step-security/harden-runneraction has been updated to versionv2.9.1, aligning with the PR objectives.
25-25: Update tosetup-goaction is correct.The
actions/setup-goaction has been updated to versionv5.0.2, aligning with the PR objectives..github/workflows/codeql.yml (5)
44-44: Update toharden-runneraction is correct.The
step-security/harden-runneraction has been updated to versionv2.9.1, aligning with the PR objectives.
51-51: Update tosetup-goaction is correct.The
actions/setup-goaction has been updated to versionv5.0.2, aligning with the PR objectives.
57-57: Update tocodeql-action/initis correct.The
github/codeql-action/initaction has been updated to versionv3.26.3, aligning with the PR objectives.
67-67: Update tocodeql-action/autobuildis correct.The
github/codeql-action/autobuildaction has been updated to versionv3.26.3, aligning with the PR objectives.
80-80: Update tocodeql-action/analyzeis correct.The
github/codeql-action/analyzeaction has been updated to versionv3.26.3, aligning with the PR objectives..github/workflows/scorecard.yml (4)
36-36: Approved: Update tostep-security/harden-runner.The update from
v2.8.1tov2.9.1aligns with the PR objectives and likely includes important security enhancements.
46-46: Approved: Update toossf/scorecard-action.The update from
v2.3.3tov2.4.0aligns with the PR objectives and likely enhances the analysis capabilities.
68-68: Approved: Update toactions/upload-artifact.The update from
v4.3.4tov4.3.6aligns with the PR objectives and likely includes bug fixes or minor enhancements.
76-76: Approved: Update togithub/codeql-action/upload-sarif.The update from
v3.25.11tov3.26.3aligns with the PR objectives and likely improves the SARIF file upload process..github/workflows/lint.yml (7)
20-20: Approved: Update tostep-security/harden-runner.The update from
v2.8.1tov2.9.1aligns with the PR objectives and likely includes important security enhancements.Also applies to: 41-41, 61-61, 81-81, 102-102, 123-123, 143-143, 163-163
26-26: Approved: Update toreviewdog/action-tflint.The update from
v1.23.0tov1.23.2aligns with the PR objectives and likely includes bug fixes and performance improvements.
47-47: Approved: Update toreviewdog/action-trivy.The update from
v1.10.0tov1.11.0aligns with the PR objectives and likely includes security improvements and bug fixes.
108-108: Approved: Update toreviewdog/action-misspell.The update from
v1.22.0tov1.23.0aligns with the PR objectives and likely includes bug fixes and performance improvements.
129-129: Approved: Update toreviewdog/action-alex.The update from
v1.12.0tov1.13.0aligns with the PR objectives and likely includes bug fixes and performance improvements.
149-149: Approved: Update toreviewdog/action-markdownlint.The update from
v0.23.0tov0.24.0aligns with the PR objectives and likely includes bug fixes and performance improvements.
169-169: Approved: Update toreviewdog/action-actionlint.The update from
v1.53.0tov1.54.0aligns with the PR objectives and likely includes bug fixes and performance improvements.
bendoerr
deleted the
dependabot/github_actions/github-actions-c4f85ccb2e
branch
Bumps the github-actions group with 12 updates:
2.8.12.9.15.0.15.0.23.25.113.26.34.3.34.3.41.23.01.23.21.10.01.11.01.22.01.23.01.12.01.13.00.23.00.24.01.53.01.54.02.3.32.4.04.3.44.3.6Updates
step-security/harden-runnerfrom 2.8.1 to 2.9.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
5c7944eMerge pull request #440 from step-security/rc-11c79be45Merge branch 'main' into rc-11deb3383Merge pull request #446 from h0x0er/log-step23c8215update dist727d06alogging stepf0db2aaMerge pull request #441 from step-security/dependabot/github_actions/github/c...1938ffcMerge branch 'main' into dependabot/github_actions/github/codeql-action-3.25.138e7dd2cMerge pull request #442 from step-security/dependabot/github_actions/step-sec...f2823eeBump step-security/publish-unit-test-result-action from 1 to 25f95e05Bump github/codeql-action from 2.13.4 to 3.25.13Updates
actions/setup-gofrom 5.0.1 to 5.0.2Release notes
Sourced from actions/setup-go's releases.
Commits
0a12ed9Bump braces from 3.0.2 to 3.0.3 (#487)4ab57d7Fix versions check failure (#479)Updates
github/codeql-actionfrom 3.25.11 to 3.26.3Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
883d858Merge pull request #2431 from github/update-v3.26.3-b187c86cee100cebUpdate changelog for v3.26.3b187c86Merge pull request #2430 from github/henrymercer/windows-diagnostics-fixe2bb5a2Add changelog notee5a6587Fix writing diagnostics on Windows5c681efMerge pull request #2426 from github/mergeback/v3.26.2-to-main-429e1977676519aUpdate checked-in dependencies25a5b8fUpdate changelog and version after v3.26.2429e197Merge pull request #2425 from github/update-v3.26.2-a93f8c2fd9eec338Update changelog for v3.26.2Updates
actions/dependency-review-actionfrom 4.3.3 to 4.3.4Release notes
Sourced from actions/dependency-review-action's releases.
Commits
5a2ce3fMerge pull request #791 from actions/juxtin/update-versionac6a6adPrepare even more for v4.3.43e2b917Merge pull request #790 from actions/juxtin/update-versiond9ab9c8Update version in package.json8c152c7Merge pull request #769 from actions/dependabot/npm_and_yarn/zod-3.23.80085d30Update dist08b5bf2Bump zod from 3.22.4 to 3.23.8986fce9Merge pull request #784 from actions/dependabot/npm_and_yarn/got-14.4.128743f8Merge pull request #719 from actions/change-spdx-parserd6f34c3Merge pull request #789 from actions/dependabot/npm_and_yarn/braces-3.0.3Updates
reviewdog/action-tflintfrom 1.23.0 to 1.23.2Release notes
Sourced from reviewdog/action-tflint's releases.
Commits
0a8c6a4Replace --module to --call-module-type=all (#96)4adc549Add .tflint.hcl to test case directories and fix the process of getting arch ...Updates
reviewdog/action-trivyfrom 1.10.0 to 1.11.0Release notes
Sourced from reviewdog/action-trivy's releases.
Commits
14e16b3Merge pull request #54 from reviewdog/depup/reviewdog030a047chore(deps): update reviewdog to 0.20.1Updates
reviewdog/action-misspellfrom 1.22.0 to 1.23.0Release notes
Sourced from reviewdog/action-misspell's releases.
Commits
ef8b22cMerge pull request #72 from reviewdog/depup/reviewdog8392e31chore(deps): update reviewdog to 0.20.1Updates
reviewdog/action-alexfrom 1.12.0 to 1.13.0Release notes
Sourced from reviewdog/action-alex's releases.
Commits
f95df9eMerge pull request #31 from reviewdog/depup/reviewdog210bba4chore(deps): update reviewdog to 0.20.1Updates
reviewdog/action-markdownlintfrom 0.23.0 to 0.24.0Release notes
Sourced from reviewdog/action-markdownlint's releases.
Commits
e9f3ab4Merge pull request #63 from reviewdog/depup/reviewdoge9244aechore(deps): update reviewdog to 0.20.1Updates
reviewdog/action-actionlintfrom 1.53.0 to 1.54.0Release notes
Sourced from reviewdog/action-actionlint's releases.
Commits
4f8f996bump v1.54.06ffd884Merge branch 'main' into releases/v1eaf7d6dMerge pull request #138 from reviewdog/depup/reviewdog6c0e341chore(deps): update reviewdog to 0.20.1Updates
ossf/scorecard-actionfrom 2.3.3 to 2.4.0Release notes
Sourced from ossf/scorecard-action's releases.
Commits
62b2cacbump docker tag to v2.4.0 for release (#1414)c09630clower license score alert threshold to 9 (#1411)cf8594c🌱 Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#1413)de5fcb9🌱 Bump the github-actions group with 2 updates (#1412)a46b90bbump scorecard to v5.0.0 release (#1410)9fc518d🌱 Bump golang in the docker-images group (#1407)a8eaa1b🌱 Bump the github-actions group with 2 updates (#1408)873d5fd🌱 Bump the github-actions group across 1 directory with 2 updates (#...54cc1fe🌱 Bump the docker-images group with 2 updates (#1401)82bcb91🌱 Bump golang.org/x/net from 0.26.0 to 0.27.0 (#1400)Updates
actions/upload-artifactfrom 4.3.4 to 4.3.6Release notes
Sourced from actions/upload-artifact's releases.
Commits
834a144Merge pull request #594 from actions/robherley/4.3.6134dcf3v4.3.673a0b9crevert back to@actions/artifact2.1.889ef406Merge pull request #588 from actions/robherley/4.3.523d796dlicense updatese445c64bump@actions/artifactto v2.1.9Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit
New Features
Bug Fixes