opencilk-project icon indicating copy to clipboard operation
opencilk-project copied to clipboard

Published 20 hours ago • verified publisher icon OpenCilk

Bump the github-actions group with 9 updates

Open dependabot[bot] opened this issue 8 months ago • 0 comments
trafficstars

Bumps the github-actions group with 9 updates:

Package From To
actions/checkout 3.1.0 4.2.2
actions/upload-artifact 3 4
actions/download-artifact 3 4
tj-actions/changed-files 39 45
actions/github-script 3 7
actions/labeler 4 5
actions/attest-build-provenance 1.0.0 2.2.2
ossf/scorecard-action 2.3.1 2.4.1
github/codeql-action 2.2.4 3.28.10

Updates actions/checkout from 3.1.0 to 4.2.2

Release notes

Sourced from actions/checkout's releases.

v4.2.2

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v4.2.1...v4.2.2

v4.2.1

What's Changed

New Contributors

Full Changelog: https://github.com/actions/checkout/compare/v4.2.0...v4.2.1

v4.2.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/checkout/compare/v4.1.7...v4.2.0

v4.1.7

What's Changed

New Contributors

Full Changelog: https://github.com/actions/checkout/compare/v4.1.6...v4.1.7

v4.1.6

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v4.1.5...v4.1.6

v4.1.5

What's Changed

... (truncated)

Commits

Updates actions/upload-artifact from 3 to 4

Release notes

Sourced from actions/upload-artifact's releases.

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

  1. The changelog post.
  2. The README.
  3. The migration documentation.
  4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

Full Changelog: https://github.com/actions/upload-artifact/compare/v3...v4.0.0

v3.2.1

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0

Full Changelog: https://github.com/actions/upload-artifact/compare/v3.2.0...v3.2.1

v3.2.1-node20

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0-node20

Full Changelog: https://github.com/actions/upload-artifact/compare/v3.2.0-node20...v3.2.1-node20

v3.2.0

Notice: Breaking Changes :warning:

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

... (truncated)

Commits
  • 4cec3d8 Merge pull request #673 from actions/yacaovsnc/artifact_2.2.2
  • e9fad96 license cache update for artifact
  • b26fd06 Update to use artifact 2.2.2 package
  • 65c4c4a Merge pull request #662 from actions/yacaovsnc/add_variable_for_concurrency_a...
  • 0207619 move files back to satisfy licensed ci
  • 1ecca81 licensed cache updates
  • 9742269 Expose env vars to controll concurrency and timeout
  • 6f51ac0 Merge pull request #656 from bdehamer/bdehamer/artifact-digest
  • c40c16d add new artifact-digest output
  • 735efb4 bump @​actions/artifact from 2.1.11 to 2.2.0
  • Additional commits viewable in compare view

Updates actions/download-artifact from 3 to 4

Release notes

Sourced from actions/download-artifact's releases.

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

  1. The changelog post.
  2. The README.
  3. The migration documentation.
  4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

Full Changelog: https://github.com/actions/download-artifact/compare/v3...v4.0.0

v3.0.2

  • Bump @actions/artifact to v1.1.1 - actions/download-artifact#195
  • Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet actions/toolkit#1278

v3.0.1

Commits
  • cc20338 Merge pull request #380 from actions/yacaovsnc/release_4_1_9
  • 1fc0fee Update artifact package to 2.2.2
  • 7fba951 Merge pull request #372 from andyfeller/patch-1
  • f9ceb77 Update MIGRATION.md
  • 533298b Merge pull request #370 from froblesmartin/patch-1
  • d06289e docs: small migration fix
  • d0ce8fd Merge pull request #354 from actions/Jcambass-patch-1
  • 1ce0d91 Add workflow file for publishing releases to immutable action package
  • fa0a91b Merge pull request #341 from actions/robherley/bump-pkgs
  • b54d088 Update @​actions/artifact version, bump dependencies
  • Additional commits viewable in compare view

Updates tj-actions/changed-files from 39 to 45

Release notes

Sourced from tj-actions/changed-files's releases.

v45

Changes in v45.0.7

What's Changed

Full Changelog: https://github.com/tj-actions/changed-files/compare/v45...v45.0.7

Changes in v45.0.6

What's Changed

... (truncated)

Changelog

Sourced from tj-actions/changed-files's changelog.

Changelog

45.0.7 - (2025-02-04)

🐛 Bug Fixes

  • deps: Update dependency @​octokit/rest to v21.1.0 (#2394) (7b72c97) - (renovate[bot])

⚙️ Miscellaneous Tasks

  • deps: Update dependency eslint-plugin-github to v5.1.8 (#2424) (dcc7a0c) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.13.1 (#2422) (364748a) - (renovate[bot])
  • deps: Lock file maintenance (#2420) (301bed6) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.13.0 (#2419) (be1c470) - (renovate[bot])
  • deps: Update dependency eslint-plugin-github to v5.1.7 (#2417) (81785a6) - (renovate[bot])
  • deps: Update dependency @​types/lodash to v4.17.15 (#2415) (065e671) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.12.0 (#2414) (45cd7f3) - (renovate[bot])
  • deps: Update dependency eslint-plugin-github to v5.1.6 (#2413) (47f21ba) - (renovate[bot])
  • deps: Update actions/setup-node action to v4.2.0 (#2411) (3b30412) - (renovate[bot])
  • deps: Lock file maintenance (#2410) (eec6665) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.10.10 (#2409) (cefd9aa) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.10.9 (#2408) (6296564) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.10.8 (#2407) (203f0af) - (renovate[bot])
  • deps: Lock file maintenance (#2406) (8b82442) - (renovate[bot])
  • deps: Update dependency eslint-plugin-prettier to v5.2.3 (#2405) (2b7a1ec) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.10.7 (#2403) (a2600ce) - (renovate[bot])
  • deps: Update dependency eslint-plugin-jest to v28.11.0 (#2400) (5dc51d3) - (renovate[bot])
  • deps: Update dependency eslint-plugin-prettier to v5.2.2 (#2399) (18de9f3) - (renovate[bot])
  • deps: Update dependency @​types/node to v22.10.6 (#2397) (467e548) - (renovate[bot])
  • deps: Update dependency eslint-config-prettier to v10 (#2396) (556e62a) - (renovate[bot])
  • deps: Lock file maintenance (#2395) (4f1e6b0) - (renovate[bot])
  • deps: Update dependency typescript to v5.7.3 (#2393) (82deec7) - (renovate[bot])
  • deps: Update dependency eslint-plugin-github to v5.1.5 (#2392) (ef7202d) - (renovate[bot])
  • deps: Lock file maintenance (#2390) (01c978c) - (renovate[bot])

⬆️ Upgrades

  • Upgraded to v45.0.6 (#2389)

Co-authored-by: jackton1 [email protected] (ed8e9f6) - (tj-actions[bot])

45.0.6 - (2025-01-03)

🐛 Bug Fixes

  • deps: Update dependency yaml to v2.7.0 (#2383) (5f974c2) - (renovate[bot])

⚙️ Miscellaneous Tasks

  • deps: Update dependency @​types/lodash to v4.17.14 (#2388) (d6e91a2) - (renovate[bot])

... (truncated)

Commits
  • dcc7a0c chore(deps): update dependency eslint-plugin-github to v5.1.8 (#2424)
  • 364748a chore(deps): update dependency @​types/node to v22.13.1 (#2422)
  • 301bed6 chore(deps): lock file maintenance (#2420)
  • be1c470 chore(deps): update dependency @​types/node to v22.13.0 (#2419)
  • 81785a6 chore(deps): update dependency eslint-plugin-github to v5.1.7 (#2417)
  • 065e671 chore(deps): update dependency @​types/lodash to v4.17.15 (#2415)
  • 45cd7f3 chore(deps): update dependency @​types/node to v22.12.0 (#2414)
  • 47f21ba chore(deps): update dependency eslint-plugin-github to v5.1.6 (#2413)
  • 3b30412 chore(deps): update actions/setup-node action to v4.2.0 (#2411)
  • eec6665 chore(deps): lock file maintenance (#2410)
  • Additional commits viewable in compare view

Updates actions/github-script from 3 to 7

Release notes

Sourced from actions/github-script's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v6.4.1...v7.0.0

v6.4.1

What's Changed

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v6.4.0...v6.4.1

v6.4.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v6.3.3...v6.4.0

v6.3.3

What's Changed

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v6.3.2...v6.3.3

v6.3.2

What's Changed

... (truncated)

Commits
  • 60a0d83 Merge pull request #440 from actions/joshmgross/v7.0.1
  • b7fb200 Update version to 7.0.1
  • 12e22ed Merge pull request #439 from actions/joshmgross/avoid-setting-base-url
  • d319f8f Avoid setting baseUrl to undefined when input is not provided
  • e69ef54 Merge pull request #425 from actions/joshmgross/node-20
  • ee0914b Update licenses
  • d6fc56f Use @types/node for Node 20
  • 384d6cf Fix quotations in tests
  • 8472492 Only validate GraphQL previews
  • 84903f5 Remove node-fetch from type
  • Additional commits viewable in compare view

Updates actions/labeler from 4 to 5

Release notes

Sourced from actions/labeler's releases.

v5.0.0

What's Changed

This release contains the following breaking changes:

  1. The ability to apply labels based on the names of base and/or head branches was added (#186 and #54). The match object for changed files was expanded with new combinations in order to make it more intuitive and flexible (#423 and #101). As a result, the configuration file structure was significantly redesigned and is not compatible with the structure of the previous version. Please read the action documentation to find out how to adapt your configuration files for use with the new action version.

  2. The bug related to the sync-labels input was fixed (#112). Now the input value is read correctly.

  3. By default, dot input is set to true. Now, paths starting with a dot (e.g. .github) are matched by default.

  4. Version 5 of this action updated the runtime to Node.js 20. All scripts are now run with Node.js 20 instead of Node.js 16 and are affected by any breaking changes between Node.js 16 and 20.

For more information, please read the action documentation.

New Contributors

Full Changelog: https://github.com/actions/labeler/compare/v4...v5.0.0

v5.0.0-beta.1

What's Changed

In scope of this beta release, the structure of the configuration file (.github/labeler.yml) was changed from

LabelName:
- any:
  - changed-files: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']
- all:
  - changed-files: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']

to

LabelName:
- any:
  - changed-files: 
    - AnyGlobToAnyFile: ['list', 'of', 'globs']
    - AnyGlobToAllFiles: ['list', 'of', 'globs']
    - AllGlobsToAnyFile: ['list', 'of', 'globs']
    - AllGlobsToAllFiles: ['list', 'of', 'globs']
  - base-branch: ['list', 'of', 'regexps']
  - head-branch: ['list', 'of', 'regexps']
- all:
  - changed-files:
    - AnyGlobToAnyFile: ['list', 'of', 'globs']
    - AnyGlobToAllFiles: ['list', 'of', 'globs']
    - AllGlobsToAnyFile: ['list', 'of', 'globs']
</tr></table>

... (truncated)

Commits
  • 8558fd7 Merge pull request #709 from actions/v5.0.0-beta
  • 000ca75 Merge pull request #700 from MaksimZhukov/apply-suggestions-and-update-docume...
  • cb66c2f Update dist
  • 9181355 Apply suggestions for the beta vesrion and update the documentation
  • efe4c1c Merge pull request #699 from MaksimZhukov/update-node-runtime-and-dependencies
  • c0957ad Run Prettier
  • 8dc8d18 Update Node.js version in reusable workflows
  • d0d0bbe Update documentation
  • 1375c42 5.0.0
  • ab7411e Change version of Node.js runtime to node20
  • Additional commits viewable in compare view

Updates actions/attest-build-provenance from 1.0.0 to 2.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.2.2

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2

v2.2.1

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1

v2.2.0

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0

v2.1.0

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0

v2.0.1

What's Changed

Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.0.0...v2.0.1

v2.0.0

The attest-build-provenance action now supports attesting multiple subjects simultaneously. When identifying multiple subjects with the subject-path input a single attestation is created with references to each of the supplied subjects, rather than generating separate attestations for each artifact. This reduces the number of attestations that you need to create and manage.

What's Changed

... (truncated)

Commits

dependabot[bot] avatar Mar 01 '25 22:03 dependabot[bot]