From fbd719bf042c0e16fc8ab465298ba007a58fe431 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 23:28:09 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 9 updates Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.3` | `0.6.4` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.1` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.9` | `4.38.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.38.3` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [oras-project/setup-oras](https://github.com/oras-project/setup-oras) | `2.0.1` | `2.0.2` | Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.6.4 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/70fb788f84895a7701f5643d103d587e460b5c99...cc914d7f3750a2d13d75c7f184a1060aa0e9d482) Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `anchore/sbom-action` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `github/codeql-action/upload-sarif` from 4.37.9 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/init` from 4.37.9 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `oras-project/setup-oras` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/oras-project/setup-oras/releases) - [Commits](https://github.com/oras-project/setup-oras/compare/1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d...005458ad77f1c8facd38a094e4af2e69e5607ff4) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: oras-project/setup-oras dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 10 +++++----- .github/workflows/codeql.yml | 4 ++-- .github/workflows/release.yml | 24 ++++++++++++------------ .github/workflows/scap.yml | 2 +- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/update-locks.yml | 2 +- .github/workflows/update-monitor.yml | 2 +- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac5d1f4..e4893e0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,7 +63,7 @@ jobs: python scripts/artifacts.py validate-lock artifacts/locks/arm64.json - name: Audit GitHub Actions security - uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 with: advanced-security: false annotations: true @@ -120,7 +120,7 @@ jobs: persist-credentials: false - name: Set up Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 with: driver: docker @@ -227,7 +227,7 @@ jobs: severity: CRITICAL,HIGH - name: Generate SPDX SBOM with Syft - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: image: ${{ env.TEST_IMAGE }} format: spdx-json @@ -269,7 +269,7 @@ jobs: - name: Retain image security artifacts if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: image-security-${{ github.sha }}-${{ matrix.architecture }} path: | @@ -283,7 +283,7 @@ jobs: - name: Publish Grype findings to code scanning if: ${{ always() && github.event_name != 'pull_request' && hashFiles(env.GRYPE_SARIF) != '' }} - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: ${{ env.GRYPE_SARIF }} category: grype-image-${{ matrix.architecture }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3ba1e4f..37c72b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,13 +35,13 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: actions build-mode: none queries: security-extended - name: Analyze GitHub Actions - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: /language:actions diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b9c2216..f9bc74c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -97,7 +97,7 @@ jobs: persist-credentials: false - name: Set up Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Confirm native runner architecture env: @@ -157,7 +157,7 @@ jobs: test -s "${OCI_ARCHIVE}" - name: Generate downloadable architecture SPDX SBOM - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: image: oci-archive:${{ env.OCI_ARCHIVE }} format: spdx-json @@ -217,7 +217,7 @@ jobs: cp "artifacts/locks/${ARCHITECTURE}.json" "artifact-lock-${ARCHITECTURE}.json" - name: Retain candidate OCI archive for promotion - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-image-${{ github.sha }}-${{ matrix.architecture }} path: ${{ env.OCI_ARCHIVE }} @@ -226,7 +226,7 @@ jobs: - name: Retain complete architecture evidence if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-evidence-${{ github.sha }}-${{ matrix.architecture }} path: | @@ -257,14 +257,14 @@ jobs: arm64_digest: ${{ steps.push.outputs.arm64_digest }} steps: - name: Download exact native OCI candidates - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: release-image-${{ github.sha }}-* path: candidates merge-multiple: true - name: Install ORAS - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1 + uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2 with: version: 1.3.3 @@ -357,7 +357,7 @@ jobs: severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL - name: Generate manifest SPDX SBOM - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 with: image: ${{ env.IMAGE }}@${{ needs.publish.outputs.digest }} format: spdx-json @@ -391,13 +391,13 @@ jobs: grype-version: v0.118.0 - name: Upload code-scanning evidence - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: grype-index.sarif category: grype-release-image - name: Retain manifest evidence - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-evidence-${{ github.sha }}-manifest path: | @@ -420,7 +420,7 @@ jobs: packages: write steps: - name: Download complete evidence - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: release-evidence-${{ github.sha }}-* path: evidence @@ -484,7 +484,7 @@ jobs: --bundle manifest-sbom.sigstore.json "${IMAGE}@${DIGEST}" - name: Retain signature and attestation bundles - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-signatures-${{ github.sha }} path: | @@ -504,7 +504,7 @@ jobs: contents: write steps: - name: Download release signatures - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-signatures-${{ github.sha }} path: release-assets diff --git a/.github/workflows/scap.yml b/.github/workflows/scap.yml index 6296eae..e788db5 100644 --- a/.github/workflows/scap.yml +++ b/.github/workflows/scap.yml @@ -107,7 +107,7 @@ jobs: - name: Retain SCAP discovery evidence if: ${{ always() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: scap-discovery-${{ github.sha }}-${{ matrix.architecture }} path: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 3dec7e0..0b574c4 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,13 +39,13 @@ jobs: file_mode: git - name: Upload SARIF artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: openssf-scorecard-sarif path: results.sarif retention-days: 5 - name: Upload results to code scanning - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/update-locks.yml b/.github/workflows/update-locks.yml index 753df5b..d7ce0c2 100644 --- a/.github/workflows/update-locks.yml +++ b/.github/workflows/update-locks.yml @@ -65,7 +65,7 @@ jobs: python scripts/artifacts.py validate-lock "${ARCHITECTURE}.lock.json" - name: Retain candidate for maintainer review - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: artifact-lock-candidate-${{ matrix.architecture }} path: | diff --git a/.github/workflows/update-monitor.yml b/.github/workflows/update-monitor.yml index 5ec81a0..17facd1 100644 --- a/.github/workflows/update-monitor.yml +++ b/.github/workflows/update-monitor.yml @@ -46,7 +46,7 @@ jobs: fi - name: Retain the monitored result - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: upstream-update-report-${{ github.run_id }} path: update-report.md