From d40a1b3ac2275921e9cff29f57a34004f918f4ee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 07:25:21 +0000 Subject: [PATCH] build(deps): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [codefly-dev/core/.github/workflows/agent-ci.yml](https://github.com/codefly-dev/core) | `0.19.4` | `0.19.8` | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.6.0` | `7.0.0` | | [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.7.0` | `4.4.0` | | [codefly-dev/core/.github/actions/publish-service-image](https://github.com/codefly-dev/core) | `0.19.4` | `0.19.8` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.4.1` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.7.0` | | [codefly-dev/core/.github/workflows/go-service-release.yml](https://github.com/codefly-dev/core) | `0.19.4` | `0.19.8` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | Updates `codefly-dev/core/.github/workflows/agent-ci.yml` from 0.19.4 to 0.19.8 - [Release notes](https://github.com/codefly-dev/core/releases) - [Changelog](https://github.com/codefly-dev/core/blob/main/docs/releaseupdate.md) - [Commits](https://github.com/codefly-dev/core/compare/5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3...a06da5fccc7bc3fbf0e399d80eb41be00f2340fb) Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/11d5960a326750d5838078e36cf38b85af677262...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-go` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/40f1582b2485089dde7abd97c1529aa768e1baff...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) Updates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `docker/setup-qemu-action` from 3.7.0 to 4.4.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...99012661954931238ded8c8b007157a8430204e1) Updates `codefly-dev/core/.github/actions/publish-service-image` from 0.19.4 to 0.19.8 - [Release notes](https://github.com/codefly-dev/core/releases) - [Changelog](https://github.com/codefly-dev/core/blob/main/docs/releaseupdate.md) - [Commits](https://github.com/codefly-dev/core/compare/5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3...a06da5fccc7bc3fbf0e399d80eb41be00f2340fb) Updates `docker/setup-buildx-action` from 3.12.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/login-action` from 3.7.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) Updates `codefly-dev/core/.github/workflows/go-service-release.yml` from 0.19.4 to 0.19.8 - [Release notes](https://github.com/codefly-dev/core/releases) - [Changelog](https://github.com/codefly-dev/core/blob/main/docs/releaseupdate.md) - [Commits](https://github.com/codefly-dev/core/compare/5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3...a06da5fccc7bc3fbf0e399d80eb41be00f2340fb) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codefly-dev/core/.github/actions/publish-service-image dependency-version: 0.19.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codefly-dev/core/.github/workflows/agent-ci.yml dependency-version: 0.19.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codefly-dev/core/.github/workflows/go-service-release.yml dependency-version: 0.19.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/agent-ci.yml | 2 +- .github/workflows/ci.yml | 16 ++++++++-------- .github/workflows/publish-gateway-image.yml | 6 +++--- .github/workflows/release.yml | 20 ++++++++++---------- 4 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml index d8b7151..67330b8 100644 --- a/.github/workflows/agent-ci.yml +++ b/.github/workflows/agent-ci.yml @@ -17,7 +17,7 @@ jobs: # Pinned to an immutable core commit SHA, not @main (see release.yml): core's # v0.19.4, the release go.mod requires. Bump the two together, which # TestCorePinsAreOneImmutableCommitMatchingGoMod holds. - uses: codefly-dev/core/.github/workflows/agent-ci.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + uses: codefly-dev/core/.github/workflows/agent-ci.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 with: # The CLI release the gate runs with. agent.codefly.yaml selects the # source-packager version (0.0.69); go.mod selects Go 1.27.3. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f8a2b60..d1dc3b9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,10 +9,10 @@ jobs: build-test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -27,10 +27,10 @@ jobs: agent-runtime-e2e: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -47,10 +47,10 @@ jobs: image-sbom: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -58,7 +58,7 @@ jobs: run: docker build -t service-warehouse:e2e . # The daemon holds this image and no registry serves it, so the scan needs # syft on PATH: the managed containerized scanner has no Docker access. - - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: assert the image contract against a real image env: SWH_GATEWAY_IMAGE: service-warehouse:e2e @@ -85,7 +85,7 @@ jobs: exit 0 fi go run ./cmd/image-sbom -image "$(jq -er '.name + "@" + .digest' gateway-image.json)" -out sbom-published - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gateway-image-sbom path: | diff --git a/.github/workflows/publish-gateway-image.yml b/.github/workflows/publish-gateway-image.yml index 03bbff9..524a1db 100644 --- a/.github/workflows/publish-gateway-image.yml +++ b/.github/workflows/publish-gateway-image.yml @@ -33,7 +33,7 @@ jobs: # Full history and the triggering commit, with no `ref`: the action proves # that commit is reachable from the remote's own default branch, and a # shallow clone or a caller-selected ref would decide that question for it. - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -44,9 +44,9 @@ jobs: # before the action, it runs no code from this repository and writes # nothing into the checkout, so the action's guard — a dirty tree, stored # Git credentials, an unmerged commit — still runs before login and build. - - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 + - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - - uses: codefly-dev/core/.github/actions/publish-service-image@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + - uses: codefly-dev/core/.github/actions/publish-service-image@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 id: publish with: version: ${{ inputs.version }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7cca182..c64ad94 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,8 +34,8 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true @@ -48,9 +48,9 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -107,11 +107,11 @@ jobs: exit 1 fi echo "digest=$digest" >> "$GITHUB_OUTPUT" - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod cache: true - - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 # Evidence for every platform the image ships, generated by the same code # path the agent's Builder.SBOM uses, so each document is bound to the child # manifest digest inside the document itself. It scans the recorded digest @@ -121,7 +121,7 @@ jobs: env: DIGEST: ${{ steps.locked.outputs.digest }} run: go run ./cmd/image-sbom -image "$IMAGE@$DIGEST" -out sbom - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gateway-image-sbom-${{ steps.version.outputs.version }} path: sbom/ @@ -157,7 +157,7 @@ jobs: # requires; bump the two together. This version of the workflow keeps the # release PAT out of jobs that run unreviewed code and refuses a tag not # reachable from the default branch. - uses: codefly-dev/core/.github/workflows/go-service-release.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 + uses: codefly-dev/core/.github/workflows/go-service-release.yml@a06da5fccc7bc3fbf0e399d80eb41be00f2340fb # v0.19.8 secrets: inherit # Workflow artifacts expire. Copy the digest-bound documents and index onto @@ -168,7 +168,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: gateway-image-sbom-* merge-multiple: true