build(deps): Bump the actions group across 1 directory with 5 updates

Open dependabot[bot] opened this issue 3 months ago • 1 comments

Bumps the actions group with 5 updates in the / directory:

Package	From	To
step-security/harden-runner	`2.13.0`	`2.13.1`
chainguard-dev/setup-chainctl	`0.3.2`	`0.4.0`
octo-sts/action	`1.0.0`	`1.0.2`
actions/cache	`4.2.4`	`4.3.0`
chainguard-dev/actions	`1.4.8`	`1.5.2`

Updates step-security/harden-runner from 2.13.0 to 2.13.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.1

What's Changed

Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2.13.0...v2.13.1

Commits

f4a75cf Merge pull request #588 from step-security/rc-26
95503d0 ci: remove code-review workflow
4b250a0 ci: add job to confirm dist is as expected
5b0ab6a update dependencies
d11f2c1 fix bug where status code was not being preserved
b3fc98e improve error handling for policy store sceanrio
92fc5d4 update error message
b61b0a4 policy store improvements
e3d3f2b use GitHub release instead of packages
646ac01 update agent
Additional commits viewable in compare view

Updates chainguard-dev/setup-chainctl from 0.3.2 to 0.4.0

Release notes

Sourced from chainguard-dev/setup-chainctl's releases.

v0.4.0

What's Changed

Bump step-security/harden-runner from 2.12.1 to 2.12.2 in the actions group by @dependabot[bot] in chainguard-dev/setup-chainctl#24

Bump step-security/harden-runner from 2.12.2 to 2.13.0 in the actions group by @dependabot[bot] in chainguard-dev/setup-chainctl#25

Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in chainguard-dev/setup-chainctl#27

Add apk-host variable by @wlynch in chainguard-dev/setup-chainctl#29

Add log grouping + error annotations by @wlynch in chainguard-dev/setup-chainctl#28

New Contributors

@wlynch made their first contribution in chainguard-dev/setup-chainctl#29

Full Changelog: https://github.com/chainguard-dev/setup-chainctl/compare/v0.3.2...v0.4.0

Commits

be0acd2 Add log grouping + error annotations (#28)
bec8dc5 Add apk-host variable (#29)
9a109b0 Bump actions/checkout from 4.2.2 to 5.0.0 (#27)
ece3a20 Bump step-security/harden-runner from 2.12.2 to 2.13.0 in the actions group (...
2b1c3d3 Bump step-security/harden-runner from 2.12.1 to 2.12.2 in the actions group (...
See full diff in compare view

Updates octo-sts/action from 1.0.0 to 1.0.2

Release notes

Sourced from octo-sts/action's releases.

v1.0.2

What's Changed

Don't try to parse response as JSON if it is an error. by @wlynch in octo-sts/action#37

New Contributors

@wlynch made their first contribution in octo-sts/action#37

Full Changelog: https://github.com/octo-sts/action/compare/v1.0.1...v1.0.2

v1.0.1

What's Changed

Add Accept header for github revoke token by @cpanato in octo-sts/action#13

Update trust policy, workflow and README by @mattmoor in octo-sts/action#15

add presubmit test by @imjasonh in octo-sts/action#18

fix presubmit test by @imjasonh in octo-sts/action#19

use PR source for action by @imjasonh in octo-sts/action#20

presubmit: checkout PR ref by @imjasonh in octo-sts/action#21

add backoff and retry to fetches by @imjasonh in octo-sts/action#17

This logs the SHA256 of the issued token. by @mattmoor in octo-sts/action#12

Allow the action to customize the domain. by @mattmoor in octo-sts/action#28

chore: add jitter to retries by @meysam81 in octo-sts/action#23

update job to use git hash in actions by @cpanato in octo-sts/action#35

add scopes parameter by @cpanato in octo-sts/action#34

New Contributors

@cpanato made their first contribution in octo-sts/action#13

@meysam81 made their first contribution in octo-sts/action#23

Full Changelog: https://github.com/octo-sts/action/compare/v1.0.0...v1.0.1

Commits

a26b0c6 Don't try to parse response as JSON if it is an error. (#37)
e480437 add scopes parameter (#34)
bc99912 update job to use git hash in actions (#35)
210248e chore: add jitter to retries (#23)
43a7677 Allow the action to customize the domain. (#28)
3622e4d This logs the SHA256 of the issued token. (#12)
60c0a50 add backoff and retry to fetches (#17)
9e4cb10 presubmit: checkout PR ref (#21)
3a2b265 use PR source for action (#20)
a2f9fdc fix presubmit test (#19)
Additional commits viewable in compare view

Updates actions/cache from 4.2.4 to 4.3.0

Release notes

Sourced from actions/cache's releases.

v4.3.0

What's Changed

Add note on runner versions by @GhadimiR in actions/cache#1642

Prepare v4.3.0 release by @Link- in actions/cache#1655

New Contributors

@GhadimiR made their first contribution in actions/cache#1642

Full Changelog: https://github.com/actions/cache/compare/v4...v4.3.0

Changelog

Sourced from actions/cache's changelog.

Releases

4.3.0

Bump @actions/cache to v4.1.0

4.2.4

Bump @actions/cache to v4.0.5

4.2.3

Bump @actions/cache to v4.0.3 (obfuscates SAS token in debug logs for cache entries)

4.2.2

Bump @actions/cache to v4.0.2

4.2.1

Bump @actions/cache to v4.0.1

4.2.0

TLDR; The cache backend service has been rewritten from the ground up for improved performance and reliability. actions/cache now integrates with the new cache service (v2) APIs.

The new service will gradually roll out as of February 1st, 2025. The legacy service will also be sunset on the same date. Changes in these release are fully backward compatible.

We are deprecating some versions of this action. We recommend upgrading to version v4 or v3 as soon as possible before February 1st, 2025. (Upgrade instructions below).

If you are using pinned SHAs, please use the SHAs of versions v4.2.0 or v3.4.0

If you do not upgrade, all workflow runs using any of the deprecated actions/cache will fail.

Upgrading to the recommended versions will not break your workflows.

4.1.2

Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474

Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

Restore original behavior of cache-hit output - #1467

4.1.0

Ensure cache-hit output is set when a cache is missed - #1404

Deprecate save-always input - #1452

... (truncated)

Commits

0057852 Merge pull request #1655 from actions/Link-/prepare-4.3.0
4f5ea67 Update licensed cache
9fcad95 Upgrade actions/cache to 4.1.0 and prepare 4.3.0 release
638ed79 Merge pull request #1642 from actions/GhadimiR-patch-1
3862dcc Add note on runner versions
See full diff in compare view

Updates chainguard-dev/actions from 1.4.8 to 1.5.2

Release notes

Sourced from chainguard-dev/actions's releases.

v1.5.2

What's Changed

Bump chainguard-dev/actions from 1.4.15 to 1.5.1 by @dependabot[bot] in chainguard-dev/actions#603

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.5.1...v1.5.2

v1.5.1

What's Changed

Ignore testdata in goimports by @mattmoor in chainguard-dev/actions#602

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.5.0...v1.5.1

v1.5.0

What's Changed

Bump chainguard-dev/actions from 1.4.14 to 1.4.15 by @dependabot[bot] in chainguard-dev/actions#600

Ignore testdata in gofmt by @mattmoor in chainguard-dev/actions#601

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.4.15...v1.5.0

v1.4.15

What's Changed

Bump chainguard-dev/actions from 1.4.13 to 1.4.14 by @dependabot[bot] in chainguard-dev/actions#598

Bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in chainguard-dev/actions#599

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.4.14...v1.4.15

v1.4.14

What's Changed

Bump chainguard-dev/actions from 1.4.11 to 1.4.13 by @dependabot[bot] in chainguard-dev/actions#591

Bump octo-sts/action from 1.0.0 to 1.0.1 by @dependabot[bot] in chainguard-dev/actions#592

Bump reviewdog/action-setup from 1.3.2 to 1.4.0 in /donotsubmit by @dependabot[bot] in chainguard-dev/actions#593

Bump reviewdog/action-setup from 1.3.2 to 1.4.0 in /boilerplate by @dependabot[bot] in chainguard-dev/actions#594

Bump reviewdog/action-actionlint from 1.66.1 to 1.67.0 by @dependabot[bot] in chainguard-dev/actions#597

Bump actions/setup-go from 5.5.0 to 6.0.0 in /boilerplate by @dependabot[bot] in chainguard-dev/actions#595

Bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in chainguard-dev/actions#596

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.4.13...v1.4.14

v1.4.13

What's Changed

bump kind to v0.30.0, drop k8s 1.30 and add k8s 1.34 by @cpanato in chainguard-dev/actions#590

Full Changelog: https://github.com/chainguard-dev/actions/compare/v1.4.12...v1.4.13

... (truncated)

Commits

8e97c1f Bump chainguard-dev/actions from 1.4.15 to 1.5.1 (#603)
de56c27 Ignore testdata in goimports (#602)
abca390 Ignore testdata in gofmt (#601)
8fa93a6 Bump chainguard-dev/actions from 1.4.14 to 1.4.15 (#600)
cd899cc Bump step-security/harden-runner from 2.13.0 to 2.13.1 (#599)
95fc84d Bump chainguard-dev/actions from 1.4.13 to 1.4.14 (#598)
f632aec Bump actions/setup-go from 5.5.0 to 6.0.0 (#596)
7acb993 Bump actions/setup-go from 5.5.0 to 6.0.0 in /boilerplate (#595)
07115ee Bump reviewdog/action-actionlint from 1.66.1 to 1.67.0 (#597)
6b2382c Bump reviewdog/action-setup from 1.3.2 to 1.4.0 in /boilerplate (#594)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Sep 29 '25 19:09 dependabot[bot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Nov 17 '25 14:11 dependabot[bot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

Dec 15 '25 14:12 dependabot[bot]