gno icon indicating copy to clipboard operation
gno copied to clipboard
verified publisher icon gnolang

chore(deps): bump the actions group across 1 directory with 5 updates

Open dependabot[bot] opened this issue 6 months ago • 1 comments

Bumps the actions group with 5 updates in the / directory:

Package From To
stefanzweifel/git-auto-commit-action 5 6
coursier/cache-action 6.4.6 6.4.7
golangci/golangci-lint-action 6 8
sigstore/cosign-installer 3.8.1 3.8.2
anchore/sbom-action 0.18.0 0.20.0

Updates stefanzweifel/git-auto-commit-action from 5 to 6

Release notes

Sourced from stefanzweifel/git-auto-commit-action's releases.

v6.0.0

Added

  • Throw error early if repository is in a detached state (#357)

Fixed

Removed

  • Remove support for create_branch, skip_checkout, skip_Fetch (#314)

v5.2.0

Added

Fixed

v5.1.0

Changed

Fixed

Dependency Updates

v5.0.1

Fixed

  • Fail if attempting to execute git commands in a directory that is not a git-repo. (#326) @​ccomendant

Dependency Updates

Misc

... (truncated)

Changelog

Sourced from stefanzweifel/git-auto-commit-action's changelog.

v5.0.0 - 2023-10-06

New major release that bumps the default runtime to Node 20. There are no other breaking changes.

Changed

Fixed

Dependency Updates

v4.16.0 - 2022-12-02

Changed

Fixed

Commits
  • 3cc016c Merge pull request #375 from stefanzweifel/v6-next
  • ddb7ae4 Merge pull request #376 from Dreamsorcerer/patch-1
  • b001e5f Apply suggestions from code review
  • 6494dc6 Fix PAT instructions with Dependabot
  • 7618051 Add deprecated inputs to fix unbound variable issue
  • ae11462 Merge pull request #371 from stefanzweifel/dependabot/npm_and_yarn/bats-1.12.0
  • 3058f91 Bump bats from 1.11.1 to 1.12.0
  • 8ddf02d Add git-auto-commit to warning text
  • e7955f7 Emit warning if deprecated/removed options are used
  • 739fd03 Merge branch 'master' into v6-next
  • Additional commits viewable in compare view

Updates coursier/cache-action from 6.4.6 to 6.4.7

Release notes

Sourced from coursier/cache-action's releases.

v6.4.7

This release upgrades the @​actions/cache from 3.2.4 to 4.0.3. See the deprecation notice for cache v3:

What's Changed

Full Changelog: https://github.com/coursier/cache-action/compare/v6.4.6...6.4.7

Commits

Updates golangci/golangci-lint-action from 6 to 8

Release notes

Sourced from golangci/golangci-lint-action's releases.

v8.0.0

Requires golangci-lint version >= v2.1.0

What's Changed

Changes

Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v7...v8.0.0

v7.0.1

What's Changed

Documentation

Dependencies

New Contributors

Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v7.0.0...v7.0.1

v7.0.0

⚠️ The GitHub Action v7 supports golangci-lint v2 only. ⚠️

What's Changed

Changes

Documentation

Dependencies

New Contributors

... (truncated)

Commits
  • 4afd733 8.0.0
  • 7774f98 feat: use absolute paths by default when using working-directory option (#1231)
  • 9fae48a 7.0.1
  • 16ece5e docs: clarify that ’args: --path-mode=abs’ is needed for working-directory (...
  • a3942e2 build(deps-dev): bump the dev-dependencies group with 2 updates (#1227)
  • 7ecb048 build(deps): bump @​types/node from 22.14.0 to 22.14.1 in the dependencies gro...
  • 63a0d0e build(deps-dev): bump the dev-dependencies group with 3 updates (#1224)
  • c2427fe docs: update problem matchers section
  • 642f8ee build(deps): bump @​types/node from 22.13.14 to 22.14.0 in the dependencies gr...
  • d84be92 build(deps-dev): bump the dev-dependencies group with 4 updates (#1220)
  • Additional commits viewable in compare view

Updates sigstore/cosign-installer from 3.8.1 to 3.8.2

Release notes

Sourced from sigstore/cosign-installer's releases.

v3.8.2

What's Changed

Full Changelog: https://github.com/sigstore/cosign-installer/compare/v3...v3.8.2

Commits

Updates anchore/sbom-action from 0.18.0 to 0.20.0

Release notes

Sourced from anchore/sbom-action's releases.

v0.20.0

Changes in v0.20.0

  • chore(deps): update Syft to v1.24.0 (#522)

v0.19.0

Changes in v0.19.0

  • chore(deps): update Syft to v1.23.0 (#521)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 (#519)
  • chore(deps): bump cross-spawn (#514)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

dependabot[bot] avatar Jun 11 '25 02:06 dependabot[bot]

🛠 PR Checks Summary

🔴 Pending initial approval by a review team member, or review from tech-staff

Manual Checks (for Reviewers):
  • [ ] IGNORE the bot requirements for this PR (force green CI check)
  • [ ] Determine if infra needs to be updated before merging
Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🔴 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:
  1. Fix any issues flagged by automated checks.
  2. Follow the Contributor Checklist to ensure your PR is ready for review.
    • Add new tests, or document why they are unnecessary.
    • Provide clear examples/screenshots, if necessary.
    • Update documentation, if required.
    • Ensure no breaking changes, or include BREAKING CHANGE notes.
    • Link related issues/PRs, where applicable.
☑️ Reviewer Actions:
  1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.
📚 Resources:
Debug
Automated Checks
Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🔴 Requirement not satisfied
└── 🔴 If
    ├── 🟢 Condition
    │   └── 🟢 Or
    │       ├── 🟢 At least 1 user(s) of the organization reviewed the pull request (with state "APPROVED")
    │       ├── 🔴 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🔴 Then
        └── 🔴 And
            ├── 🟢 Not (🔴 This label is applied to pull request: review/triage-pending)
            └── 🔴 At least 1 user(s) of the team tech-staff reviewed pull request
Manual Checks
**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

  • Any user with comment edit permission
Determine if infra needs to be updated before merging

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Or
        ├── 🔴 A changed file matches this pattern: Dockerfile
        ├── 🔴 A changed file matches this pattern: ^misc/deployments
        ├── 🔴 A changed file matches this pattern: ^misc/docker-
        ├── 🟢 A changed file matches this pattern: ^.github/workflows/releaser.*\.yml$ (filename: .github/workflows/releaser-master.yml)
        └── 🔴 A changed file matches this pattern: ^.github/workflows/staging\.yml$

Can be checked by

  • team devops

Gno2D2 avatar Jun 11 '25 02:06 Gno2D2

Codecov Report

:white_check_mark: All modified and coverable lines are covered by tests.

:loudspeaker: Thoughts on this report? Let us know!

codecov[bot] avatar Aug 05 '25 13:08 codecov[bot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot[bot] avatar Aug 06 '25 02:08 dependabot[bot]