From 0271f4041f744272b1e5e71b2e41307bfbe5c053 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 03:36:59 +0000 Subject: [PATCH] Bump the actions group with 5 updates Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [helm/kind-action](https://github.com/helm/kind-action) | `1.15.0` | `1.15.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | Updates `helm/kind-action` from 1.15.0 to 1.15.1 - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](https://github.com/helm/kind-action/compare/06c1ae10762d3b9c1644e7fe69596ae519e015a2...1544676c07bb3570fcb70166beaa07c4528fd4aa) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `anchore/sbom-action` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: helm/kind-action dependency-version: 1.15.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/container-image.yml | 8 ++--- .github/workflows/gates.yml | 48 +++++++++++++-------------- .github/workflows/release.yml | 22 ++++++------ .github/workflows/scorecard.yml | 2 +- 5 files changed, 41 insertions(+), 41 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a239852..09034a7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -120,7 +120,7 @@ jobs: # built from this commit -- a chart that disagrees with the server it # ships with fails here, not after the release. - name: Install the chart on a kind cluster - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0 + uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1 with: cluster_name: chart-check diff --git a/.github/workflows/container-image.yml b/.github/workflows/container-image.yml index 9e1e4bd..10fd26d 100644 --- a/.github/workflows/container-image.yml +++ b/.github/workflows/container-image.yml @@ -145,7 +145,7 @@ jobs: mkdir -p "${RUNNER_TEMP}/digests" touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: digest-${{ inputs.slug }}-${{ matrix.architecture }} path: ${{ runner.temp }}/digests/* @@ -174,7 +174,7 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: ${{ runner.temp }}/digests pattern: digest-${{ inputs.slug }}-* @@ -313,7 +313,7 @@ jobs: echo "path=${RUNNER_TEMP}/sbom/${name}" >> "$GITHUB_OUTPUT" - name: Generate SPDX SBOM - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: image: ${{ inputs.image }}@${{ steps.platform.outputs.digest }} registry-username: ${{ github.actor }} @@ -337,7 +337,7 @@ jobs: subject-digest: ${{ steps.platform.outputs.digest }} sbom-path: ${{ steps.asset.outputs.path }} - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: sbom-${{ inputs.slug }}-${{ matrix.architecture }} path: ${{ steps.asset.outputs.path }} diff --git a/.github/workflows/gates.yml b/.github/workflows/gates.yml index 6c8c49b..a186ce9 100644 --- a/.github/workflows/gates.yml +++ b/.github/workflows/gates.yml @@ -109,7 +109,7 @@ jobs: toolchain: 1.97.1 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 if: inputs.candidate-artifact == '' - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 if: inputs.candidate-artifact != '' with: name: ${{ inputs.candidate-artifact }} @@ -128,7 +128,7 @@ jobs: tests/gates/build-candidate.sh out/candidate fi tar -czf candidate.tar.gz -C out candidate - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.PREFIX }}-candidate path: candidate.tar.gz @@ -167,7 +167,7 @@ jobs: - run: cp previous-src/record-store.example.toml previous/ - run: previous/bin/record-store --version - run: tar -czf previous.tar.gz previous - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ env.PREFIX }}-previous path: previous.tar.gz @@ -184,7 +184,7 @@ jobs: components: clippy,rustfmt - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - uses: taiki-e/install-action@de5687a3b26eb438afcf64719052c77a7f728817 # cargo-audit - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - name: Standalone gates @@ -210,7 +210,7 @@ jobs: || echo "::notice::internal cluster gates are not all passing; see the internal cluster report" # Deliberately not failing the job: cluster readiness is decided by the # internal cluster report and must never block a standalone release. - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-rust @@ -231,7 +231,7 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { pattern: "${{ env.PREFIX }}-{candidate,previous}", merge-multiple: true } - run: | mkdir -p out && tar -xzf candidate.tar.gz -C out @@ -247,7 +247,7 @@ jobs: done [[ ${#selected[@]} -eq 0 ]] || PREVIOUS_BIN_DIR="$PWD/previous/bin" GATE_EVALUATE=0 \ tests/gates/run-stage.sh "$STAGE" out "${selected[@]}" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-binary @@ -265,11 +265,11 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - run: GATE_EVALUATE=0 tests/gates/run-stage.sh "$STAGE" out REC-CRASH - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-crash @@ -287,11 +287,11 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - run: GATE_EVALUATE=0 tests/gates/run-stage.sh "$STAGE" out RES-MEMORY - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-memory @@ -307,7 +307,7 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 @@ -320,11 +320,11 @@ jobs: java-version: "21" cache: maven cache-dependency-path: tests/compatibility/java/pom.xml - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - run: GATE_EVALUATE=0 tests/gates/run-stage.sh "$STAGE" out CMP-S3-SDK - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-sdk @@ -340,12 +340,12 @@ jobs: with: toolchain: 1.97.1 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: npm cache-dependency-path: console/package-lock.json - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - name: Console gates @@ -364,7 +364,7 @@ jobs: mkdir -p out-cluster && cp -R out/candidate out-cluster/ GATE_EVALUATE=0 GATE_MATRIX=internal/cluster/gates.toml tests/gates/run-stage.sh "$STAGE" out-cluster CL-CONSOLE-E2E \ || echo "::notice::internal cluster console E2E is not passing; see the internal cluster report" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-console @@ -387,11 +387,11 @@ jobs: with: python-version: "3.13" - run: pip install --requirement requirements-docs.txt - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - run: GATE_EVALUATE=0 tests/gates/run-stage.sh "$STAGE" out DOC-BOUNDARY SEC-SECRETS - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-repository @@ -413,13 +413,13 @@ jobs: . fuzz - run: cargo install cargo-fuzz --locked - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: { name: "${{ env.PREFIX }}-candidate" } - run: mkdir -p out && tar -xzf candidate.tar.gz -C out - run: | if [[ "$STAGE" == scheduled ]]; then export FUZZ_SECONDS=300; fi GATE_EVALUATE=0 tests/gates/run-stage.sh "$STAGE" out SEC-FUZZ - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-fuzz @@ -441,7 +441,7 @@ jobs: with: python-version: "3.13" - run: python3 tests/gates/record.py --gate CMP-UPGRADE-CONTAINER --stage "$STAGE" --results out/results - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-results-container @@ -461,7 +461,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: ${{ env.PREFIX }}-* path: collected @@ -492,7 +492,7 @@ jobs: --candidate collected/candidate-x/candidate "${results[@]}" --out cluster-report || true fi exit "$status" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: ${{ env.PREFIX }}-report diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13b3bf7..1c377f4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -225,7 +225,7 @@ jobs: cp "$BUNDLE" "dist/record-store-${VERSION}-provenance.intoto.jsonl" ls -l dist - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: binaries path: dist/* @@ -582,7 +582,7 @@ jobs: echo "the package reports ${reported}" >&2; exit 1; } ' - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: linux-packages-${{ matrix.architecture }} path: dist/* @@ -635,7 +635,7 @@ jobs: helm push "dist/record-store-${VERSION}.tgz" "oci://ghcr.io/${owner}/charts" echo "Published \`oci://ghcr.io/${owner}/charts/record-store:${VERSION}\`" >> "$GITHUB_STEP_SUMMARY" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: chart path: dist/*.tgz @@ -655,7 +655,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: binaries @@ -707,7 +707,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "{prepublish,candidate}-*" path: collected @@ -736,7 +736,7 @@ jobs: cp report/report.json "dist/record-store-${VERSION}-release-gates.json" cp report/report.md "dist/record-store-${VERSION}-release-gates.md" exit "$status" - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: release-gates-report @@ -753,32 +753,32 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: binaries merge-multiple: true - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: sbom-* merge-multiple: true - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: linux-packages-* merge-multiple: true - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: chart merge-multiple: true # The decision that allowed this release, attached so it is kept with it. - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist name: release-gates-report diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ad1358c..dc2e592 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -64,7 +64,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif