From c9a0251509fc2719ad112a5be916d95ad246e099 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:08:19 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.7.0` | `4.4.0` | | [codefly-dev/core/.github/workflows/go-service-ci.yml](https://github.com/codefly-dev/core) | `0.2.51` | `0.19.6` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.6.0` | `7.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.7.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.4.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.4.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` | | [codefly-dev/core/.github/workflows/go-service-release.yml](https://github.com/codefly-dev/core) | `0.16.0` | `0.19.6` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.4.0` | `7.3.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` | Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `docker/setup-qemu-action` from 3.7.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...99012661954931238ded8c8b007157a8430204e1) Updates `codefly-dev/core/.github/workflows/go-service-ci.yml` from 0.2.51 to 0.19.6 - [Release notes](https://github.com/codefly-dev/core/releases) - [Changelog](https://github.com/codefly-dev/core/blob/main/docs/releaseupdate.md) - [Commits](https://github.com/codefly-dev/core/compare/f16e045805dbd213cdbebf98d5f7cbe802496d7c...3a9e608b7de76b546e7893f105b01a2185cbecc3) Updates `actions/setup-go` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/40f1582b2485089dde7abd97c1529aa768e1baff...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) Updates `docker/login-action` from 3.7.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `docker/setup-buildx-action` from 3.12.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/build-push-action` from 6.19.2 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/10e90e3645eae34f1e60eeb005ba3a3d33f178e8...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `actions/upload-artifact` from 4.6.2 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `codefly-dev/core/.github/workflows/go-service-release.yml` from 0.16.0 to 0.19.6 - [Release notes](https://github.com/codefly-dev/core/releases) - [Changelog](https://github.com/codefly-dev/core/blob/main/docs/releaseupdate.md) - [Commits](https://github.com/codefly-dev/core/compare/e54bc852f3d40cd1aeafc0ced2369a8c13a51bb8...3a9e608b7de76b546e7893f105b01a2185cbecc3) Updates `goreleaser/goreleaser-action` from 6.4.0 to 7.3.0 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/v6.4.0...a4f02ab5355a589de60d917a659ce617ed19b3de) Updates `actions/download-artifact` from 4.3.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codefly-dev/core/.github/workflows/go-service-ci.yml dependency-version: 0.19.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codefly-dev/core/.github/workflows/go-service-release.yml dependency-version: 0.19.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: goreleaser/goreleaser-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .../workflows/bootstrap-lock-freshness.yml | 4 +-- .github/workflows/ci.yml | 16 +++++----- .github/workflows/controlplane.yml | 4 +-- .github/workflows/releaser.yml | 32 +++++++++---------- 4 files changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/bootstrap-lock-freshness.yml b/.github/workflows/bootstrap-lock-freshness.yml index 9a2c747..aba0608 100644 --- a/.github/workflows/bootstrap-lock-freshness.yml +++ b/.github/workflows/bootstrap-lock-freshness.yml @@ -17,9 +17,9 @@ jobs: freshness: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 - name: Check bootstrap image lock against upstream run: .github/scripts/update-bootstrap-lock.sh --check diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 87ecf60..364d9ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: needs: image permissions: contents: read - uses: codefly-dev/core/.github/workflows/go-service-ci.yml@f16e045805dbd213cdbebf98d5f7cbe802496d7c + uses: codefly-dev/core/.github/workflows/go-service-ci.yml@3a9e608b7de76b546e7893f105b01a2185cbecc3 image: permissions: @@ -33,7 +33,7 @@ jobs: # every later merge until GitHub's six-hour default rather than just itself. timeout-minutes: 90 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Resolve runtime image id: runtime @@ -50,7 +50,7 @@ jobs: echo "tag_reference=$name:$tag" >> "$GITHUB_OUTPUT" - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: cache: false go-version-file: go.mod @@ -62,7 +62,7 @@ jobs: # bootstrap image build test verifies linux/arm64, which needs emulation on an # amd64 runner. Without this the arm64 case would skip and a wrong arm64 # archive checksum would pass CI. - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 - name: Run unit tests run: go test ./... -skip '^(TestCreateToRunDocker|TestDirtyMigrationFailsClosed|TestLifecycleContractDocker|TestMigrationLockBudgetExpiresWhilePeerHoldsTheLock|TestMigrationStatementBudgetExpiresAndPreservesTheLedger)$' -timeout 20m @@ -146,21 +146,21 @@ jobs: - name: Log in to GitHub Container Registry if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 with: driver-opts: image=moby/buildkit@sha256:2f5adac4ecd194d9f8c10b7b5d7bceb5186853db1b26e5abd3a657af0b7e26ec - name: Publish runtime image candidate if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository id: candidate - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc with: build-args: SOURCE_DATE_EPOCH=0 context: . @@ -268,7 +268,7 @@ jobs: done - name: Upload image SBOM evidence - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: image-sbom-${{ github.run_id }}-${{ github.run_attempt }} path: /tmp/image-sbom diff --git a/.github/workflows/controlplane.yml b/.github/workflows/controlplane.yml index 2488564..7c84812 100644 --- a/.github/workflows/controlplane.yml +++ b/.github/workflows/controlplane.yml @@ -30,8 +30,8 @@ jobs: env: POSTGRES_TEST_IMAGE: postgres@sha256:fe03a7605299a34ddf5e4f285dff78c3d7190a576b3c6b46f2fcff69f4bffd54 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version-file: go.mod cache: false diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml index 99fbee5..3a059af 100644 --- a/.github/workflows/releaser.yml +++ b/.github/workflows/releaser.yml @@ -27,8 +27,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version-file: libs/go/go.mod cache: false @@ -46,13 +46,13 @@ jobs: # than leave a hung read to GitHub's six-hour default. timeout-minutes: 20 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 with: driver-opts: image=moby/buildkit@sha256:2f5adac4ecd194d9f8c10b7b5d7bceb5186853db1b26e5abd3a657af0b7e26ec - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 with: registry: ghcr.io username: ${{ github.actor }} @@ -75,7 +75,7 @@ jobs: needs: image permissions: contents: read - uses: codefly-dev/core/.github/workflows/go-service-release.yml@e54bc852f3d40cd1aeafc0ced2369a8c13a51bb8 # core v0.16.0 + uses: codefly-dev/core/.github/workflows/go-service-release.yml@3a9e608b7de76b546e7893f105b01a2185cbecc3 # core v0.19.6 with: # The bootstrap-image tests build linux/arm64 and refuse to run without # emulation registered ("CI must register emulation"). ci.yml gets it from @@ -95,7 +95,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 persist-credentials: false @@ -106,11 +106,11 @@ jobs: set -euo pipefail [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-dev\.[0-9a-f]+$ ]] .github/scripts/release-backfill.sh validate-tag . - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version-file: go.mod cache: false - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 - name: Test run: go test -v ./... - name: Install Syft for archive SBOMs @@ -118,12 +118,12 @@ jobs: with: syft-version: v1.44.0 - name: Build dev release - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de with: version: '~> v2' args: release --clean --skip=publish,announce - name: Upload dev release - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: dev-release if-no-files-found: error @@ -144,7 +144,7 @@ jobs: steps: # No source checkout, hooks, or executables from the build job. The token # is repository-scoped and only passed to the upload step, never GH_PAT. - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: dev-release path: dist @@ -177,9 +177,9 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - name: Check out release source - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: fetch-depth: 0 ref: ${{ inputs.tag }} @@ -188,7 +188,7 @@ jobs: env: RELEASE_TAG: ${{ inputs.tag }} run: .github/scripts/release-backfill.sh validate-tag release-source - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version-file: release-source/go.mod cache-dependency-path: release-source/go.sum @@ -207,7 +207,7 @@ jobs: if: hashFiles('release-source/libs/go/go.mod') != '' run: python3 scripts/qualify-runtime-library.py --source-root release-source - name: Run GoReleaser - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de with: version: '~> v2' args: release --clean --skip=publish,announce