Skip to content

Commit 90efbb6

Browse files
chore(deps): bump the actions group with 5 updates (#4)
Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.1.1` | `6.0.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.27.0` | `4.31.9` | | [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` | | [webfactory/ssh-agent](https://github.com/webfactory/ssh-agent) | `0.9.0` | `0.9.1` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.3` | Updates `actions/checkout` from 4.1.1 to 6.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>v6-beta by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li> <li>update readme/changelog for v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p> <h2>v6-beta</h2> <h2>What's Changed</h2> <p>Updated persist-credentials to store the credentials under <code>$RUNNER_TEMP</code> instead of directly in the local git config.</p> <p>This requires a minimum Actions Runner version of <a href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a> to access the persisted credentials for <a href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker container action</a> scenarios.</p> <h2>v5.0.1</h2> <h2>What's Changed</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p> <h2>v5.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> <li>Prepare v5.0.0 release by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li> </ul> <h2>⚠️ Minimum Compatible Runner Version</h2> <p><strong>v2.327.1</strong><br /> <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p> <p>Make sure your runner is updated to this version or newer to use this release.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p> <h2>v4.3.1</h2> <h2>What's Changed</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> <li>Pin actions/checkout's own workflows to a known, good, stable version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li> </ul> <h2>v4.1.6</h2> <ul> <li>Check platform to set archive extension appropriately by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li> </ul> <h2>v4.1.5</h2> <ul> <li>Update NPM dependencies by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li> <li>Bump github/codeql-action from 2 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li> <li>Bump actions/setup-node from 1 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li> <li>Bump actions/upload-artifact from 2 to 4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a> Clarify v6 README (<a href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li> <li><a href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a> Add worktree support for persist-credentials includeIf (<a href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li> <li><a href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a> Update all references from v5 and v4 to v6 (<a href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a> update readme/changelog for v6 (<a href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li> <li><a href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a> v6-beta (<a href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li> <li><a href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a> Persist creds to a separate file (<a href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a> Update README to include Node.js 24 support details and requirements (<a href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li> <li><a href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a> Prepare v5.0.0 release (<a href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li> <li><a href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a> Update actions checkout to use node 24 (<a href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li> <li><a href="https://github.com/actions/checkout/commit/08eba0b27e820071cde6df949e0beb9ba4906955"><code>08eba0b</code></a> Prepare release v4.3.0 (<a href="https://redirect.github.com/actions/checkout/issues/2237">#2237</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/b4ffde65f46336ab88eb53be808477a3936bae11...8e8c483db84b4bee98b60c0593521ed34d9990e8">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action` from 3.27.0 to 4.31.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.31.9</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.9 - 16 Dec 2025</h2> <p>No user facing changes.</p> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.9/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.8</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.8 - 11 Dec 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.8. <a href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.8/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.7</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.7 - 05 Dec 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.7. <a href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li> </ul> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.7/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.6</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.6 - 01 Dec 2025</h2> <p>No user facing changes.</p> <p>See the full <a href="https://github.com/github/codeql-action/blob/v4.31.6/CHANGELOG.md">CHANGELOG.md</a> for more information.</p> <h2>v4.31.5</h2> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>4.31.5 - 24 Nov 2025</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.31.9 - 16 Dec 2025</h2> <p>No user facing changes.</p> <h2>4.31.8 - 11 Dec 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.8. <a href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li> </ul> <h2>4.31.7 - 05 Dec 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.7. <a href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li> </ul> <h2>4.31.6 - 01 Dec 2025</h2> <p>No user facing changes.</p> <h2>4.31.5 - 24 Nov 2025</h2> <ul> <li>Update default CodeQL bundle version to 2.23.6. <a href="https://redirect.github.com/github/codeql-action/pull/3321">#3321</a></li> </ul> <h2>4.31.4 - 18 Nov 2025</h2> <p>No user facing changes.</p> <h2>4.31.3 - 13 Nov 2025</h2> <ul> <li>CodeQL Action v3 will be deprecated in December 2026. The Action now logs a warning for customers who are running v3 but could be running v4. For more information, see <a href="https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/">Upcoming deprecation of CodeQL Action v3</a>.</li> <li>Update default CodeQL bundle version to 2.23.5. <a href="https://redirect.github.com/github/codeql-action/pull/3288">#3288</a></li> </ul> <h2>4.31.2 - 30 Oct 2025</h2> <p>No user facing changes.</p> <h2>4.31.1 - 30 Oct 2025</h2> <ul> <li>The <code>add-snippets</code> input has been removed from the <code>analyze</code> action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.</li> </ul> <h2>4.31.0 - 24 Oct 2025</h2> <ul> <li>Bump minimum CodeQL bundle version to 2.17.6. <a href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li> <li>When SARIF files are uploaded by the <code>analyze</code> or <code>upload-sarif</code> actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the <code>upload-sarif</code> action. For <code>analyze</code>, this may affect Advanced Setup for CodeQL users who specify a value other than <code>always</code> for the <code>upload</code> input. <a href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5d4e8d1aca955e8d8589aabd499c5cae939e33c7"><code>5d4e8d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3371">#3371</a> from github/update-v4.31.9-998798e34</li> <li><a href="https://github.com/github/codeql-action/commit/1dc115f17a8c6966e94a6477313dd3df6319bc83"><code>1dc115f</code></a> Update changelog for v4.31.9</li> <li><a href="https://github.com/github/codeql-action/commit/998798e34d79baddb1566c60bbb8f68a901c04e6"><code>998798e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3352">#3352</a> from github/nickrolfe/jar-min-ff-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/5eb751966fe18977cdefa4e41e0f90e92801ce90"><code>5eb7519</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3358">#3358</a> from github/henrymercer/database-upload-telemetry</li> <li><a href="https://github.com/github/codeql-action/commit/d29eddb39b7c33171bb0250114b1c9e3ff8fe2bc"><code>d29eddb</code></a> Extract version number to constant</li> <li><a href="https://github.com/github/codeql-action/commit/e9626872ef3347a9c18091d60da647084c2451a6"><code>e962687</code></a> Merge branch 'main' into henrymercer/database-upload-telemetry</li> <li><a href="https://github.com/github/codeql-action/commit/19c7f96922a6269458f2cadcc23faf0ebaa1368b"><code>19c7f96</code></a> Rename <code>isOverlayBase</code></li> <li><a href="https://github.com/github/codeql-action/commit/ae5de9a20d0468cc3818a0dc5c99e456f996d9cf"><code>ae5de9a</code></a> Use <code>getErrorMessage</code> in log too</li> <li><a href="https://github.com/github/codeql-action/commit/0cb86337c5111af4ff3dc7e8f9b98c479c9ea954"><code>0cb8633</code></a> Prefer <code>performance.now()</code></li> <li><a href="https://github.com/github/codeql-action/commit/c07cc0d3a95a282fc5a54477464931c776d124ec"><code>c07cc0d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3351">#3351</a> from github/henrymercer/ghec-dr-determine-tools-vers...</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/662472033e021d55d94146f66f6058822b0b39fd...5d4e8d1aca955e8d8589aabd499c5cae939e33c7">compare view</a></li> </ul> </details> <br /> Updates `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` from 2.0.0 to 2.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/slsa-framework/slsa-github-generator/releases">slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml's releases</a>.</em></p> <blockquote> <h2>v2.1.0</h2> <h2>What's Changed</h2> <ul> <li>chore: v2.0.0: update tags to v2.0.0 by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3584">slsa-framework/slsa-github-generator#3584</a></li> <li>fix: use <code>@​sigstore/cli</code> in e2e.sign-attestations.schedule.yml by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3572">slsa-framework/slsa-github-generator#3572</a></li> <li>docs: fix broken links by <a href="https://github.com/suzuki-shunsuke"><code>@​suzuki-shunsuke</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3605">slsa-framework/slsa-github-generator#3605</a></li> <li>chore(setup-go): update actions/setup-go to resolve the warning by <a href="https://github.com/suzuki-shunsuke"><code>@​suzuki-shunsuke</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3604">slsa-framework/slsa-github-generator#3604</a></li> <li>fix: Update release docs by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3589">slsa-framework/slsa-github-generator#3589</a></li> <li>docs: Add Atsign-Foundation NoPorts to the Hall of Fame by <a href="https://github.com/cpswan"><code>@​cpswan</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3616">slsa-framework/slsa-github-generator#3616</a></li> <li>docs: Add v2.0.0 to SECURITY.md by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3630">slsa-framework/slsa-github-generator#3630</a></li> <li>docs: Add links to CHANGELOG by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3631">slsa-framework/slsa-github-generator#3631</a></li> <li>ci: fix PR title checker by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3632">slsa-framework/slsa-github-generator#3632</a></li> <li>ci: Add issue reopener by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3629">slsa-framework/slsa-github-generator#3629</a></li> <li>fix: update softprops/action-gh-release to v2.0.5 by <a href="https://github.com/suzuki-shunsuke"><code>@​suzuki-shunsuke</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3619">slsa-framework/slsa-github-generator#3619</a></li> <li>chore(renovate): use cron syntax for schedule by <a href="https://github.com/rarkins"><code>@​rarkins</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3638">slsa-framework/slsa-github-generator#3638</a></li> <li>chore: Fix Renovate config by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3635">slsa-framework/slsa-github-generator#3635</a></li> <li>feat: workflow to update actions dist by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3653">slsa-framework/slsa-github-generator#3653</a></li> <li>fix(deps): update dependency <code>@​sigstore/rekor-types</code> to v2 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3650">slsa-framework/slsa-github-generator#3650</a></li> <li>chore(deps): update github-actions (major) by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3648">slsa-framework/slsa-github-generator#3648</a></li> <li>fix(deps): update dependency org.json:json to v20231013 [security] by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3641">slsa-framework/slsa-github-generator#3641</a></li> <li>fix(deps): update module github.com/sigstore/cosign/v2 to v2.2.4 [security] by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3640">slsa-framework/slsa-github-generator#3640</a></li> <li>chore(deps): update dependency pathspec to v0.12.1 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3644">slsa-framework/slsa-github-generator#3644</a></li> <li>fix(deps): update dependency <code>@​actions/github</code> to v6 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3649">slsa-framework/slsa-github-generator#3649</a></li> <li>fix(deps): update module golang.org/x/oauth2 to v0.20.0 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3646">slsa-framework/slsa-github-generator#3646</a></li> <li>fix(deps): update npm by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3647">slsa-framework/slsa-github-generator#3647</a></li> <li>chore: formatting by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3655">slsa-framework/slsa-github-generator#3655</a></li> <li>chore(deps): update github-actions by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3642">slsa-framework/slsa-github-generator#3642</a></li> <li>docs: Add openfga as another user of slsa-github-generator via Github Actions by <a href="https://github.com/aaguiarz"><code>@​aaguiarz</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/2950">slsa-framework/slsa-github-generator#2950</a></li> <li>fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.6 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3645">slsa-framework/slsa-github-generator#3645</a></li> <li>chore: allow Renovate to create new config warning issues by <a href="https://github.com/HonkingGoose"><code>@​HonkingGoose</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3662">slsa-framework/slsa-github-generator#3662</a></li> <li>chore: Fix markdown issues by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3658">slsa-framework/slsa-github-generator#3658</a></li> <li>chore(deps): update npm dev by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3643">slsa-framework/slsa-github-generator#3643</a></li> <li>feat: Record vars in SLSA generators by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3633">slsa-framework/slsa-github-generator#3633</a></li> <li>chore(deps): update github-actions by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3679">slsa-framework/slsa-github-generator#3679</a></li> <li>fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.7 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3680">slsa-framework/slsa-github-generator#3680</a></li> <li>docs: Remove expected GA for Node.js builder by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3659">slsa-framework/slsa-github-generator#3659</a></li> <li>ci: Add formatting pre-submit check by <a href="https://github.com/ianlewis"><code>@​ianlewis</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3654">slsa-framework/slsa-github-generator#3654</a></li> <li>fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.8 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3712">slsa-framework/slsa-github-generator#3712</a></li> <li>chore(deps): bump the npm_and_yarn group across 10 directories with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3714">slsa-framework/slsa-github-generator#3714</a></li> <li>chore(deps): update github-actions by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3711">slsa-framework/slsa-github-generator#3711</a></li> <li>chore(deps): bump the go_modules group with 2 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3715">slsa-framework/slsa-github-generator#3715</a></li> <li>chore: slsa-verifier v2.6.0: Update action.yml by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3736">slsa-framework/slsa-github-generator#3736</a></li> <li>fix: Update maven helper plugin build by <a href="https://github.com/loosebazooka"><code>@​loosebazooka</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3746">slsa-framework/slsa-github-generator#3746</a></li> <li>fix: maven e2e: remove verify job by <a href="https://github.com/ramonpetgrave64"><code>@​ramonpetgrave64</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3748">slsa-framework/slsa-github-generator#3748</a></li> <li>chore(deps): update github-actions by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3753">slsa-framework/slsa-github-generator#3753</a></li> <li>chore(deps): bump github.com/docker/docker from 24.0.9+incompatible to 25.0.6+incompatible in the go_modules group by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3760">slsa-framework/slsa-github-generator#3760</a></li> <li>chore(config): migrate renovate config by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3774">slsa-framework/slsa-github-generator#3774</a></li> <li>chore(deps): update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.10.1 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3758">slsa-framework/slsa-github-generator#3758</a></li> <li>chore(deps): update dependency org.apache.maven.plugins:maven-deploy-plugin to v3.1.3 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3820">slsa-framework/slsa-github-generator#3820</a></li> <li>chore(deps): update dependency org.apache.maven.plugins:maven-gpg-plugin to v3.2.5 by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3757">slsa-framework/slsa-github-generator#3757</a></li> <li>fix(deps): update npm by <a href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a> in <a href="https://redirect.github.com/slsa-framework/slsa-github-generator/pull/3754">slsa-framework/slsa-github-generator#3754</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md">slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml's changelog</a>.</em></p> <blockquote> <h1>CHANGELOG</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v210">v2.1.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v210-sigstore-bundles-for-generic-generator-and-go-builder">v2.1.0: Sigstore Bundles for Generic Generator and Go Builder</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v210-vars-context-recorded-in-provenance">v2.1.0: Vars context recorded in provenance</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v200">v2.0.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v200-breaking-change-upload-artifact-and-download-artifact">v2.0.0: Breaking Change: upload-artifact and download-artifact</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v200-breaking-change-attestation-name-workflow-input-and-output">v2.0.0: Breaking Change: attestation-name Workflow Input and Output</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v200-dsse-rekor-type">v2.0.0: DSSE Rekor Type</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v1100">v1.10.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v1100-tuf-fix">v1.10.0: TUF fix</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v1100-gradle-builder">v1.10.0: Gradle Builder</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v1100-go-builder">v1.10.0: Go Builder</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v1100-container-generator">v1.10.0: Container Generator</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v190">v1.9.0</a> <ul> <li><a href="#v190-byob-framework-https://github.com/slsa-framework/slsa-github-generator/blob/main/beta">v1.9.0: BYOB framework (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)</a></li> <li><a href="#v190-maven-builder-https://github.com/slsa-framework/slsa-github-generator/blob/main/beta">v1.9.0: Maven builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)</a></li> <li><a href="#v190-gradle-builder-https://github.com/slsa-framework/slsa-github-generator/blob/main/beta">v1.9.0: Gradle builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)</a></li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v190-jreleaser-builder">v1.9.0: JReleaser builder</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v180">v1.8.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v180-generic-generator">v1.8.0: Generic Generator</a></li> <li><a href="#v180-nodejs-builder-https://github.com/slsa-framework/slsa-github-generator/blob/main/beta">v1.8.0: Node.js Builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v170">v1.7.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v170-go-builder">v1.7.0: Go builder</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v160">v1.6.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#summary-of-changes">Summary of changes</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#go-builder">Go builder</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#new-features">New Features</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#generic-generator">Generic generator</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#new-features-1">New Features</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#container-generator">Container generator</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#changelog-since-v150">Changelog since v1.5.0</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#v150">v1.5.0</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#summary-of-changes-1">Summary of changes</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#go-builder-1">Go builder</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#new-features-2">New Features</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#generic-generator-1">Generic generator</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#new-features-3">New Features</a></li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#container-generator-1">Container generator</a> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#new-features-4">New Features</a></li> </ul> </li> </ul> </li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/blob/main/#changelog-since-v140">Changelog since v1.4.0</a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/f7dd8c54c2067bafc12ca7a55595d5ee9b75204a"><code>f7dd8c5</code></a> update the ref in the pre-submit</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/0a5124b181e38cc2890f186c2990ecec131012bc"><code>0a5124b</code></a> fix jq for the sigstore bundles</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/fbeecf0c1e9cbb70c6828b0d311037a9e6cce717"><code>fbeecf0</code></a> update docs</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/f701310a334f5d712a8869541c8e19ecb4eefc24"><code>f701310</code></a> update workflows</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/361859811395a7dfc81e24fb4dfe843a59715a40"><code>3618598</code></a> v2.1.0-rc.3</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/46f81fc6ad1b81b30ecdcf73ef9968b9787dc2c5"><code>46f81fc</code></a> chore: update refs to v2.1.0-rc.1 (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/4120">#4120</a>)</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/5d20c9315555cc3ea10212f5ab25b0d883f3d428"><code>5d20c93</code></a> chore: use builder tag v2.1.0-rc.0 (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/4118">#4118</a>)</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/e27b237be2003c8ae32f1300b9f5c3cc9c71dce7"><code>e27b237</code></a> chore: braces and ejs vulns (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/4116">#4116</a>)</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/8967e1c98e3dcee60e8651c796b4f5a99300eadc"><code>8967e1c</code></a> chore: Update CODEOWNERS (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/4115">#4115</a>)</li> <li><a href="https://github.com/slsa-framework/slsa-github-generator/commit/47d1954c9e926d98abb20faffbf6352b3f736dce"><code>47d1954</code></a> chore: update octokit deps (<a href="https://redirect.github.com/slsa-framework/slsa-github-generator/issues/4114">#4114</a>)</li> <li>Additional commits viewable in <a href="https://github.com/slsa-framework/slsa-github-generator/compare/5a775b367a56d5bd118a224a811bba288150a563...f7dd8c54c2067bafc12ca7a55595d5ee9b75204a">compare view</a></li> </ul> </details> <br /> Updates `webfactory/ssh-agent` from 0.9.0 to 0.9.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webfactory/ssh-agent/releases">webfactory/ssh-agent's releases</a>.</em></p> <blockquote> <h2>v0.9.1</h2> <h2>What's Changed</h2> <ul> <li>Acknowledge custom command inputs in cleanup.js by <a href="https://github.com/janopae"><code>@​janopae</code></a> in <a href="https://redirect.github.com/webfactory/ssh-agent/pull/235">webfactory/ssh-agent#235</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/janopae"><code>@​janopae</code></a> made their first contribution in <a href="https://redirect.github.com/webfactory/ssh-agent/pull/235">webfactory/ssh-agent#235</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/webfactory/ssh-agent/compare/v0.9.0...v0.9.1">https://github.com/webfactory/ssh-agent/compare/v0.9.0...v0.9.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webfactory/ssh-agent/blob/master/CHANGELOG.md">webfactory/ssh-agent's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <h2>[Unreleased]</h2> <h2>v0.9.1 [2024-03-17]</h2> <h3>Fixed</h3> <ul> <li>Fix path used to execute ssh-agent in cleanup.js to respect custom paths set by input (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/235">#235</a>)</li> </ul> <h2>v0.9.0 [2024-02-06]</h2> <h3>Changed</h3> <ul> <li>Update all versions of <code>actions/checkout</code> to v4 (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/199">#199</a>)</li> <li>Update to Node 20 (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/201">#201</a>)</li> </ul> <h2>v0.8.0 [2023-03-24]</h2> <h3>Changed</h3> <ul> <li>No longer writing GitHub's SSH host keys to <code>known_hosts</code> (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/171">#171</a>)</li> <li>Update to actions/checkout@v3 (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/143">#143</a>)</li> <li>Allow the user to override the commands for git, ssh-agent, and ssh-add (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/154">#154</a>)</li> </ul> <h2>v0.7.0 [2022-10-19]</h2> <h3>Added</h3> <ul> <li>Add the <code>log-public-key</code> input that can be used to turn off logging key identities (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/122">#122</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix path to <code>git</code> binary on Windows, assuming GitHub-hosted runners (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/136">#136</a>, <a href="https://redirect.github.com/webfactory/ssh-agent/issues/137">#137</a>)</li> <li>Fix a nonsensical log message (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/139">#139</a>)</li> </ul> <h2>v0.6.0 [2022-10-19]</h2> <h3>Changed</h3> <ul> <li>Update the version of Node used by the action from 12 to 16 (<a href="https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/">https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/</a>).</li> </ul> <h2>v0.5.4 [2021-11-21]</h2> <h3>Fixed</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webfactory/ssh-agent/commit/a6f90b1f127823b31d4d4a8d96047790581349bd"><code>a6f90b1</code></a> Release v0.9.1</li> <li><a href="https://github.com/webfactory/ssh-agent/commit/72c0bfd31ab22a2e11716951e3f107a9647dc97e"><code>72c0bfd</code></a> Improve documentation on why we use os.userInfo()</li> <li><a href="https://github.com/webfactory/ssh-agent/commit/e3f1a8e046525bfed3725ef54a31ca91aed399f4"><code>e3f1a8e</code></a> Acknowledge custom command inputs in cleanup.js (<a href="https://redirect.github.com/webfactory/ssh-agent/issues/235">#235</a>)</li> <li><a href="https://github.com/webfactory/ssh-agent/commit/b504c19775343714e11b8c754e4fe1f02dc7b8e7"><code>b504c19</code></a> Update CHANGELOG.md</li> <li>See full diff in <a href="https://github.com/webfactory/ssh-agent/compare/dc588b651fe13675774614f8e6a936a468676387...a6f90b1f127823b31d4d4a8d96047790581349bd">compare view</a></li> </ul> </details> <br /> Updates `ossf/scorecard-action` from 2.4.0 to 2.4.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ossf/scorecard-action/releases">ossf/scorecard-action's releases</a>.</em></p> <blockquote> <h2>v2.4.3</h2> <h2>What's Changed</h2> <p>This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the <a href="https://github.com/ossf/scorecard/releases/tag/v5.3.0">Scorecard v5.3.0 release notes</a>.</p> <h2>Documentation</h2> <ul> <li>docs: clarify <code>GITHUB_TOKEN</code> permissions needed for private repos by <a href="https://github.com/pankajtaneja5"><code>@​pankajtaneja5</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1574">ossf/scorecard-action#1574</a></li> <li>:book: Fix recommended command to test the image in development by <a href="https://github.com/deivid-rodriguez"><code>@​deivid-rodriguez</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1583">ossf/scorecard-action#1583</a></li> </ul> <h2>Other</h2> <ul> <li>add missing top-level token permissions to workflows by <a href="https://github.com/timothyklee"><code>@​timothyklee</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1566">ossf/scorecard-action#1566</a></li> <li>setup codeowners for requesting reviews by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1576">ossf/scorecard-action#1576</a></li> <li>:seedling: Improve printing options by <a href="https://github.com/deivid-rodriguez"><code>@​deivid-rodriguez</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1584">ossf/scorecard-action#1584</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/timothyklee"><code>@​timothyklee</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1566">ossf/scorecard-action#1566</a></li> <li><a href="https://github.com/pankajtaneja5"><code>@​pankajtaneja5</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1574">ossf/scorecard-action#1574</a></li> <li><a href="https://github.com/deivid-rodriguez"><code>@​deivid-rodriguez</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1584">ossf/scorecard-action#1584</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3">https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3</a></p> <h2>v2.4.2</h2> <h2>What's Changed</h2> <p>This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard <a href="https://github.com/ossf/scorecard/releases/tag/v5.2.0">v5.2.0</a> and <a href="https://github.com/ossf/scorecard/releases/tag/v5.2.1">v5.2.1</a> release notes.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2">https://github.com/ossf/scorecard-action/compare/v2.4.1...v2.4.2</a></p> <h2>v2.4.1</h2> <h2>What's Changed</h2> <ul> <li>This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the <a href="https://github.com/ossf/scorecard/releases/tag/v5.1.0">v5.1.0</a> and <a href="https://github.com/ossf/scorecard/releases/tag/v5.1.1">v5.1.1</a> release notes.</li> <li>Publishing results now uses half the API quota as before. The exact savings depends on the repository in question. <ul> <li>use Scorecard library entrypoint instead of Cobra hooking by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1423">ossf/scorecard-action#1423</a></li> </ul> </li> <li>Some errors were made into annotations to make them more visible <ul> <li>Make default branch error more prominent by <a href="https://github.com/jsoref"><code>@​jsoref</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1459">ossf/scorecard-action#1459</a></li> </ul> </li> <li>There is now an optional <code>file_mode</code> input which controls how repository files are fetched from GitHub. The default is <code>archive</code>, but <code>git</code> produces the most accurate results for repositories with <code>.gitattributes</code> files at the cost of analysis speed. <ul> <li>add input for specifying <code>--file-mode</code> by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1509">ossf/scorecard-action#1509</a></li> </ul> </li> <li>The underlying container for the action is now <a href="https://github.com/ossf/scorecard-action/pkgs/container/scorecard-action">hosted on GitHub Container Registry</a>. There should be no functional changes. <ul> <li>:seedling: publish docker images to GitHub Container Registry by <a href="https://github.com/spencerschrock"><code>@​spencerschrock</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1453">ossf/scorecard-action#1453</a></li> </ul> </li> </ul> <h3>Docs</h3> <ul> <li>Installation docs update by <a href="https://github.com/JeremiahAHoward"><code>@​JeremiahAHoward</code></a> in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1416">ossf/scorecard-action#1416</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/JeremiahAHoward"><code>@​JeremiahAHoward</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1416">ossf/scorecard-action#1416</a></li> <li><a href="https://github.com/jsoref"><code>@​jsoref</code></a> made their first contribution in <a href="https://redirect.github.com/ossf/scorecard-action/pull/1459">ossf/scorecard-action#1459</a> <strong>Full Changelog</strong>: <a href="https://github.com/ossf/scorecard-action/compare/v2.4.0...v2.4.1">https://github.com/ossf/scorecard-action/compare/v2.4.0...v2.4.1</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ossf/scorecard-action/commit/4eaacf0543bb3f2c246792bd56e8cdeffafb205a"><code>4eaacf0</code></a> bump docker to ghcr v2.4.3 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1587">#1587</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/42e3a017b9617c5bbc5f1c692cdbc2cd041bd97a"><code>42e3a01</code></a> :seedling: Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1585">#1585</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/88c07acb7bc818897f9ea58eba9d81c53b322f15"><code>88c07ac</code></a> :seedling: Bump github.com/sigstore/cosign/v2 from 2.5.2 to 2.6.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1579">#1579</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/6c690f2f38ab31402da4e3f8d698c15405764128"><code>6c690f2</code></a> Bump github.com/ossf/scorecard/v5 from v5.2.1 to v5.3.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1586">#1586</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/92083b52695004080225eb9301fde390183707cd"><code>92083b5</code></a> :book: Fix recommended command to test the image in development (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1583">#1583</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/7975ea6064717f16f09a57ad5f8e24017ad4dbd9"><code>7975ea6</code></a> :seedling: Bump the docker-images group across 1 directory with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1">#1</a>...</li> <li><a href="https://github.com/ossf/scorecard-action/commit/0d1a74394f208e63c946c1b5377d3ad15f0265bf"><code>0d1a743</code></a> :seedling: Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1575">#1575</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/46e6e0c0ac415287a696b2be6d98071134fd27a7"><code>46e6e0c</code></a> :seedling: Bump the github-actions group with 2 updates (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1580">#1580</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/c3f13501596645d3bd6fee6b843bd36b66df4f5d"><code>c3f1350</code></a> :seedling: Improve printing options (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1584">#1584</a>)</li> <li><a href="https://github.com/ossf/scorecard-action/commit/43e475b79a8bd5217334edc08879005b2229d79a"><code>43e475b</code></a> :seedling: Bump golang.org/x/net from 0.42.0 to 0.44.0 (<a href="https://redirect.github.com/ossf/scorecard-action/issues/1578">#1578</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ossf/scorecard-action/compare/62b2cac7ed8198b15735ed49ab1e5cf35480ba46...4eaacf0543bb3f2c246792bd56e8cdeffafb205a">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent ae4b9ac commit 90efbb6

12 files changed

Lines changed: 34 additions & 34 deletions

.github/workflows/ada.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717

1818
steps:
1919
- name: Checkout
20-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
20+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2121

2222
- name: Set up GNAT toolchain
2323
run: >

.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,10 @@ jobs:
3535

3636
steps:
3737
- name: Checkout repository
38-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
38+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3939

4040
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
41+
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
4242
with:
4343
languages: ${{ matrix.language }}
4444
build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
4848
echo 'Build step for compiled languages'
4949
5050
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
51+
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
5252
with:
5353
category: "/language:${{matrix.language}}"

.github/workflows/codeql.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,19 +23,19 @@ jobs:
2323
- language: actions
2424
build-mode: none
2525
steps:
26-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
26+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2727

2828
- name: Initialize CodeQL
29-
uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
29+
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
3030
with:
3131
languages: ${{ matrix.language }}
3232
queries: +security-and-quality
3333
continue-on-error: true
3434

3535
- name: Autobuild
36-
uses: github/codeql-action/autobuild@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
36+
uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
3737
continue-on-error: true
3838

3939
- name: Perform Analysis
40-
uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
40+
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
4141
continue-on-error: true

.github/workflows/comprehensive-quality.yml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
permissions:
1717
contents: read
1818
steps:
19-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
19+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2020
- name: Check test coverage
2121
run: |
2222
echo "Checking for test files..."
@@ -37,7 +37,7 @@ jobs:
3737
permissions:
3838
contents: read
3939
steps:
40-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
40+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4141
- name: Secret scanning
4242
uses: trufflesecurity/trufflehog@8a8ef8526528d8a4ff3e2c90be08e25ef8efbd9b # v3.88.3
4343
continue-on-error: true
@@ -59,7 +59,7 @@ jobs:
5959
permissions:
6060
contents: read
6161
steps:
62-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
62+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
6363
- name: Check API specs
6464
run: |
6565
if [ -f "openapi.yaml" ] || [ -f "openapi.json" ]; then
@@ -78,7 +78,7 @@ jobs:
7878
permissions:
7979
contents: read
8080
steps:
81-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
81+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
8282
- name: Check for validation patterns
8383
run: |
8484
VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0")
@@ -92,7 +92,7 @@ jobs:
9292
contents: read
9393
attestations: write
9494
steps:
95-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
95+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
9696
- name: Generate SBOM
9797
run: |
9898
echo "SBOM generation would run here"
@@ -110,7 +110,7 @@ jobs:
110110
permissions:
111111
contents: read
112112
steps:
113-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
113+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
114114
- name: Check SPARK proofs
115115
run: |
116116
if find . -name "*.ads" | grep -q .; then
@@ -128,7 +128,7 @@ jobs:
128128
permissions:
129129
contents: read
130130
steps:
131-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
131+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
132132
- name: Check TODOs and FIXMEs
133133
run: |
134134
echo "=== Incomplete items ==="
@@ -143,7 +143,7 @@ jobs:
143143
permissions:
144144
contents: read
145145
steps:
146-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
146+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
147147
- name: Check for benchmarks
148148
run: |
149149
BENCHES=$(find . -name "*bench*" -o -name "*perf*" | wc -l)
@@ -162,7 +162,7 @@ jobs:
162162
permissions:
163163
contents: read
164164
steps:
165-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
165+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
166166
- name: HTML accessibility check
167167
run: |
168168
echo "Checking for a11y attributes..."
@@ -178,7 +178,7 @@ jobs:
178178
permissions:
179179
contents: read
180180
steps:
181-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
181+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
182182
- name: Check license files
183183
run: |
184184
if [ -f "LICENSE" ] || [ -f "LICENSE.txt" ] || [ -f "LICENSE.md" ]; then
@@ -198,7 +198,7 @@ jobs:
198198
permissions:
199199
contents: read
200200
steps:
201-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
201+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
202202
- name: Check docs completeness
203203
run: |
204204
DOCS=""

.github/workflows/generator-generic-ossf-slsa3-publish.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
digests: ${{ steps.hash.outputs.digests }}
2929

3030
steps:
31-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
31+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3232

3333
# ========================================================
3434
#
@@ -65,7 +65,7 @@ jobs:
6565
actions: read # To read the workflow path.
6666
id-token: write # To sign the provenance.
6767
contents: write # To add assets to a release.
68-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.1.0
68+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
6969
with:
7070
base64-subjects: "${{ needs.build.outputs.digests }}"
7171
upload-assets: true # Optional: Upload to a new release

.github/workflows/guix-nix-policy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
permissions:
1111
contents: read
1212
steps:
13-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1414
- name: Enforce Guix primary / Nix fallback
1515
run: |
1616
# Check for package manager files

.github/workflows/mirror.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ jobs:
1919

2020
steps:
2121
- name: Checkout
22-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
22+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2323
with:
2424
fetch-depth: 0
2525

2626
- name: Setup SSH
27-
uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
27+
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
2828
with:
2929
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
3030

@@ -49,12 +49,12 @@ jobs:
4949

5050
steps:
5151
- name: Checkout
52-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
52+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
5353
with:
5454
fetch-depth: 0
5555

5656
- name: Setup SSH
57-
uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
57+
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
5858
with:
5959
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
6060

.github/workflows/npm-bun-blocker.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
permissions:
1111
contents: read
1212
steps:
13-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1414
- name: Block npm/bun
1515
run: |
1616
if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then

.github/workflows/quality.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
permissions:
1111
contents: read
1212
steps:
13-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
13+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
1414

1515
- name: Check file permissions
1616
run: |
@@ -42,7 +42,7 @@ jobs:
4242
permissions:
4343
contents: read
4444
steps:
45-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
45+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
4646
- name: Check documentation
4747
run: |
4848
MISSING=""

.github/workflows/scorecard.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,17 @@ jobs:
1616
id-token: write
1717
contents: read
1818
steps:
19-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
19+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
2020
with:
2121
persist-credentials: false
2222

2323
- name: Run Scorecard
24-
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
24+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
2525
with:
2626
results_file: results.sarif
2727
results_format: sarif
2828

2929
- name: Upload results
30-
uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
30+
uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.28.1
3131
with:
3232
sarif_file: results.sarif

0 commit comments

Comments
 (0)