Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the github-actions group with 5 updates #2219

Merged
merged 1 commit into from
Jan 26, 2025
Merged

Bump the github-actions group with 5 updates #2219

merged 1 commit into from
Jan 26, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 25, 2025

Bumps the github-actions group with 5 updates:

Package From To
actions/setup-python 4 5
codecov/codecov-action 3 5
pypa/gh-action-pypi-publish@release/v1.5 1.5 1.12
peter-evans/dockerhub-description 3 4
actions/cache 3 4

Updates actions/setup-python from 4 to 5

Release notes

Sourced from actions/setup-python's releases.

v5.0.0

What's Changed

In scope of this release, we update node version runtime from node16 to node20 (actions/setup-python#772). Besides, we update dependencies to the latest versions.

Full Changelog: actions/setup-python@v4.8.0...v5.0.0

v4.8.0

What's Changed

In scope of this release we added support for GraalPy (actions/setup-python#694). You can use this snippet to set up GraalPy:

steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v4 
  with:
    python-version: 'graalpy-22.3' 
- run: python my_script.py

Besides, the release contains such changes as:

New Contributors

Full Changelog: actions/setup-python@v4...v4.8.0

v4.7.1

What's Changed

Full Changelog: actions/setup-python@v4...v4.7.1

v4.7.0

In scope of this release, the support for reading python version from pyproject.toml was added (actions/setup-python#669).

      - name: Setup Python
        uses: actions/setup-python@v4
</tr></table>

... (truncated)

Commits
  • 0b93645 Enhance workflows: Add macOS 13 support, upgrade publish-action, and update d...
  • 9c76e71 Bump pillow from 7.2 to 10.2.0 in /tests/data (#956)
  • f4c5a11 Revise isGhes logic (#963)
  • 19dfb7b Bump default versions to latest (#905)
  • e9675cc Merge pull request #943 from actions/Jcambass-patch-1
  • 3226af6 Upgrade IA publish
  • 70dcb22 Merge pull request #941 from actions/Jcambass-patch-1
  • 65b48c7 Create publish-immutable-actions.yml
  • 29a37be initial commit (#938)
  • f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 3 to 5

Release notes

Sourced from codecov/codecov-action's releases.

v5.0.0

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING]
The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING] The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Commits

Updates pypa/gh-action-pypi-publish@release/v1.5 from 1.5 to 1.12

Release notes

Sourced from pypa/gh-action-pypi-publish@release/v1.5's releases.

v1.12.0

⚡️ Why Should You Update?

This is a minor version bump, but it does not add any new user-facing interfaces. Still, I felt like it should not be a patch-release: this update brings significant changes to the action invocation and internal release process.

Previously, each invocation of pypi-publish required building a container image in the invoking CI job. This was inefficient and added about 30 seconds to the publishing jobs at their startup just to build the container.

I wanted to improve this for over three years (#58) and a little over half a year ago @​br3ndonland💰 stepped up and offered a very comprehensive solution to the limitation I was hoping to overcome: #230.

Going forward, I'm going to pre-build per-version containers prior to cutting each release. And the action invocations will just pull the image from GitHub Container registry.

[!CAUTION] Known quirks:

  • This seems to not work on self-hosted runners without a python executable: #289. The workaround could be installing it prior to running the action.
  • Pinning to commit hashes does not work: #290. Workaround: postpone updating until it's fixed or switch to Git tags for now. Subscribe to that issue to follow the progress. UPD: This was an issue during the first 12 hours post release and it has been addressed upstream by publishing a commit SHA-tagged image for the release on Nov 12, 2024 at 10:27 UTC+1.
  • Calling pypi-publish from another nested repo-local composite action might be breaking file paths: #291. Workaround: postpone updating until it's fixed. Subscribe to that issue to follow the progress.
  • Running within GitHub Enterprise fails on the action repo clone: #292. Workaround: postpone updating until it's fixed. Subscribe to that issue to follow the progress.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.11.0...v1.12.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

v1.11.0

🔏 Helping you become a trusted supply chain link 🔗

Two months ago, in v1.10.0, @​woodruffw💰 integrated support for generating and uploading PEP 740 digital attestations that can be used as provenance objects when analyzing dependency chains for the integrity.

To make sure it works well, it was implemented as an opt-in, so a relatively small subset of projects was able to try it out, and a few issues have been determined and fixed during this time.

That changes today! This version changes the feature toggle to “on by default”. This means that from now on, every project making use of Trusted Publishing will start producing and publishing digital attestations without having to do any modifications to how they use this action.

@​woodruffw💰 flipped the respective toggle in #277 with the possibility to opt-out.

🛠️ Internal Dependencies

@​woodruffw💰 bumped sigstore to v3.5.1 and pypi-attestations to v0.0.13 in lock files via #276.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.10.3...v1.11.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to William for working on improving the supply chain provenance in the ecosystem! The overall effort is tracked @ pypi/warehouse#15871.

... (truncated)

Commits
  • 76f52bc Merge pull request #329 from webknjaz/maintenance/runtime-lockfile-24-02-2025
  • 72de13b 📌 Mass-upgrade transitive dependency pins
  • 1995f2e Merge pull request #327 from webknjaz/maintenance/twine-6.1-pep639
  • 29f40bd 📦 Enable metadata 2.4 support in Twine
  • 10df67d 📦 Enable support for PEP 639 metadata
  • e0449d2 🧪 Integrate a unified alls-green GHA status
  • cebc64f 🧪 Bump setuptools in smoke test to v75.8.0
  • da900af 🧪 Run smoke tests against Ubuntu 24 and 22
  • 8cafb5c 💰 Sync the funding config
  • 916e576 Merge pull request #315 from webknjaz/refactoring/attestations-exist-bundle
  • Additional commits viewable in compare view

Updates peter-evans/dockerhub-description from 3 to 4

Release notes

Sourced from peter-evans/dockerhub-description's releases.

Docker Hub Description v4.0.0

⚙️ Updated runtime to Node.js 20

  • The action now requires a minimum version of v2.308.0 for the Actions runner. Update self-hosted runners to v2.308.0 or later to ensure compatibility.

What's Changed

... (truncated)

Commits
  • e98e4d1 feat: update runtime to node 20 (#246)
  • 487b453 build(deps-dev): bump @​types/node from 16.18.70 to 16.18.73 (#245)
  • f4367f9 build(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#244)
  • 48ae68f build(deps-dev): bump @​types/node from 16.18.69 to 16.18.70 (#241)
  • dfc61b8 build(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#243)
  • 74967fb build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#242)
  • 7ea9d27 build(deps-dev): bump @​types/node from 16.18.68 to 16.18.69 (#240)
  • 7bc76ab build(deps-dev): bump eslint-plugin-prettier from 5.0.1 to 5.1.2 (#239)
  • 5a219e7 build(deps): bump actions/download-artifact from 3 to 4 (#236)
  • fb37f44 build(deps-dev): bump eslint from 8.55.0 to 8.56.0 (#238)
  • Additional commits viewable in compare view

Updates actions/cache from 3 to 4

Release notes

Sourced from actions/cache's releases.

v4.0.0

What's Changed

New Contributors

Full Changelog: actions/cache@v3...v4.0.0

v3.4.0

⚠️ Important Changes

The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

Read more about the change & access the migration guide: reference to the announcement.

Minor changes

Minor and patch version updates for these dependencies:

  • @​actions/core: 1.11.1
  • @​actions/io: 1.1.3
  • @​vercel/ncc: 0.38.3

Full Changelog: actions/cache@v3...v3.4.0

v3.3.3

What's Changed

New Contributors

Full Changelog: actions/cache@v3...v3.3.3

v3.3.2

What's Changed

... (truncated)

Changelog

Sourced from actions/cache's changelog.

Releases

4.2.0

TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

4.1.2

  • Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474
  • Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

  • Restore original behavior of cache-hit output - #1467

4.1.0

  • Ensure cache-hit output is set when a cache is missed - #1404
  • Deprecate save-always input - #1452

4.0.2

  • Fixed restore fail-on-cache-miss not working.

4.0.1

  • Updated isGhes check

4.0.0

  • Updated minimum runner version support from node 12 -> node 20

3.4.0

  • Integrated with the new cache service (v2) APIs

3.3.3

  • Updates @​actions/cache to v3.2.3 to fix accidental mutated path arguments to getCacheVersion actions/toolkit#1378
  • Additional audit fixes of npm package(s)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the github-actions group with 5 updates
edd8413 
Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-python](https://github.com/actions/setup-python) | `4` | `5` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `3` | `5` |
| [pypa/gh-action-pypi-publish@release/v1.5](https://github.com/pypa/gh-action-pypi-publish) | `1.5` | `1.12` |
| [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `3` | `4` |
| [actions/cache](https://github.com/actions/cache) | `3` | `4` |


Updates `actions/setup-python` from 4 to 5
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v4...v5)

Updates `codecov/codecov-action` from 3 to 5
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v3...v5)

Updates `pypa/gh-action-pypi-publish@release/v1.5` from 1.5 to 1.12
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@release/v1.5...release/v1.12)

Updates `peter-evans/dockerhub-description` from 3 to 4
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](peter-evans/dockerhub-description@v3...v4)

Updates `actions/cache` from 3 to 4
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish@release/v1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: peter-evans/dockerhub-description
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 25, 2025
@TheTechromancer TheTechromancer merged commit 5aa58ef into dev Jan 26, 2025
14 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/dev/github-actions-7edd2c44f6 branch January 26, 2025 00:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@TheTechromancer TheTechromancer TheTechromancer approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@TheTechromancer