From 682e7ba94fe47a5ec43dcc36d4fa8dad0e31a125 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 16:09:04 +0000 Subject: [PATCH] Bump the ci group across 1 directory with 8 updates Bumps the ci group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/setup-docker-action](https://github.com/docker/setup-docker-action) | `5.4.0` | `5.6.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [docker/scout-action](https://github.com/docker/scout-action) | `1.24.0` | `1.27.0` | | [docker/github-builder/.github/workflows/build.yml](https://github.com/docker/github-builder) | `1.16.0` | `1.18.1` | | [score-spec/setup-score](https://github.com/score-spec/setup-score) | `3.2.4` | `3.2.6` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.7` | `4.39.1` | Updates `docker/setup-docker-action` from 5.4.0 to 5.6.0 - [Release notes](https://github.com/docker/setup-docker-action/releases) - [Commits](https://github.com/docker/setup-docker-action/compare/77e84dbf09b47d1e29270283c22f16145aa85ca1...7ec28a010822b4626af4874f9448a4b05ac6f3e5) Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `docker/scout-action` from 1.24.0 to 1.27.0 - [Release notes](https://github.com/docker/scout-action/releases) - [Commits](https://github.com/docker/scout-action/compare/7c6b6c3f7844478ace1ffd4e7aef649053d1f87d...a4119c5a8c5076236a54e4ce99531f7e4dd2ef84) Updates `docker/github-builder/.github/workflows/build.yml` from 1.16.0 to 1.18.1 - [Release notes](https://github.com/docker/github-builder/releases) - [Commits](https://github.com/docker/github-builder/compare/a492c6d04fd3315f67230809b44d60cc0acd50b3...cbc9d42f8c89a55623392aadd03600965b80e963) Updates `score-spec/setup-score` from 3.2.4 to 3.2.6 - [Release notes](https://github.com/score-spec/setup-score/releases) - [Commits](https://github.com/score-spec/setup-score/compare/888a7deafd396c3f3f05e00d2d9b0ab225799ac0...f6b76398989a8783858e790e8597947a3a8a615d) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: docker/setup-docker-action dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/scout-action dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/github-builder/.github/workflows/build.yml dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: score-spec/setup-score dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] --- .github/workflows/open-pr.yml | 24 ++++++++++++------------ .github/workflows/push-tag.yml | 10 +++++----- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/open-pr.yml b/.github/workflows/open-pr.yml index d3671fe..3824c3e 100644 --- a/.github/workflows/open-pr.yml +++ b/.github/workflows/open-pr.yml @@ -17,7 +17,7 @@ jobs: - name: checkout code in PR branch uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker - uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0 + uses: docker/setup-docker-action@7ec28a010822b4626af4874f9448a4b05ac6f3e5 # v5.6.0 with: daemon-config: | { @@ -27,22 +27,22 @@ jobs: } } - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: version: latest - name: docker login docker.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: username: ${{ secrets.DOCKER_USER }} password: ${{ secrets.DOCKER_PAT }} - name: docker login dhi.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: dhi.io username: ${{ secrets.DOCKER_USER }} password: ${{ secrets.DOCKER_PAT }} - name: Build container image on PR branch - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: app/ push: false @@ -57,7 +57,7 @@ jobs: with: ref: main - name: Build container image from main branch - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: app/ push: false @@ -72,7 +72,7 @@ jobs: docker images - name: Docker Scout id: docker-scout - uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0 + uses: docker/scout-action@a4119c5a8c5076236a54e4ce99531f7e4dd2ef84 # v1.27.0 with: command: compare image: local://${{ env.WORKLOAD_NAME }}:pr-${{ github.event.number }} @@ -80,7 +80,7 @@ jobs: write-comment: true github-token: ${{ secrets.GITHUB_TOKEN }} multi-arch-build: - uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 + uses: docker/github-builder/.github/workflows/build.yml@cbc9d42f8c89a55623392aadd03600965b80e963 # v1.18.1 with: output: image push: false @@ -105,13 +105,13 @@ jobs: - name: checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: install score-compose - uses: score-spec/setup-score@888a7deafd396c3f3f05e00d2d9b0ab225799ac0 # v3.2.4 + uses: score-spec/setup-score@f6b76398989a8783858e790e8597947a3a8a615d # v3.2.6 with: file: score-compose token: ${{ secrets.GITHUB_TOKEN }} version: ${{ env.SCORE_COMPOSE_VERSION }} - name: docker login dhi.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: dhi.io username: ${{ secrets.DOCKER_USER }} @@ -129,7 +129,7 @@ jobs: - name: checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: docker login dhi.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: dhi.io username: ${{ secrets.DOCKER_USER }} @@ -144,7 +144,7 @@ jobs: run: | make kind-load-image - name: install score-k8s - uses: score-spec/setup-score@888a7deafd396c3f3f05e00d2d9b0ab225799ac0 # v3.2.4 + uses: score-spec/setup-score@f6b76398989a8783858e790e8597947a3a8a615d # v3.2.6 with: file: score-k8s token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/push-tag.yml b/.github/workflows/push-tag.yml index b9a6585..b92388c 100644 --- a/.github/workflows/push-tag.yml +++ b/.github/workflows/push-tag.yml @@ -7,7 +7,7 @@ permissions: contents: read # to fetch the repository content jobs: build-push: - uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 + uses: docker/github-builder/.github/workflows/build.yml@cbc9d42f8c89a55623392aadd03600965b80e963 # v1.18.1 permissions: id-token: write # to sign attestation(s) with GitHub OIDC Token packages: write # to push container image to ghcr @@ -41,26 +41,26 @@ jobs: - build-push steps: - name: docker login docker.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: username: ${{ secrets.DOCKER_USER }} password: ${{ secrets.DOCKER_PAT }} - name: Login to dhi.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: dhi.io username: ${{ secrets.DOCKER_USER }} password: ${{ secrets.DOCKER_PAT }} - name: Docker Scout id: docker-scout - uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0 + uses: docker/scout-action@a4119c5a8c5076236a54e4ce99531f7e4dd2ef84 # v1.27.0 with: command: cves sarif-file: sarif.output.json summary: true image: registry://ghcr.io/${{ github.repository_owner }}/my-sample-workload:${{ github.ref_name }} - name: Upload SARIF report - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: sarif_file: sarif.output.json