Skip to content

Commit 7450b62

Browse files
dependabot[bot]dependabot[bot]
authored
chore(deps): bump the github-actions group with 12 updates
Bumps the github-actions group with 12 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.0` | `2.16.0` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `2.4.0` | `2.5.0` | | [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `6.0.2` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.7.1` | `4.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.2` | `5.5.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5.5.1` | `6.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.3.0` | `4.0.0` | | [docker/bake-action](https://github.com/docker/bake-action) | `6.10.0` | `7.0.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.3` | Updates `step-security/harden-runner` from 2.12.0 to 2.16.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@0634a26...fa2e9d6) Updates `dependabot/fetch-metadata` from 2.4.0 to 2.5.0 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@08eff52...21025c7) Updates `actions/checkout` from 4.2.2 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...de0fac2) Updates `docker/setup-buildx-action` from 3.7.1 to 4.0.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@c47758b...4d04d5d) Updates `actions/upload-artifact` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...bbbca2d) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...3e5f45b) Updates `codecov/codecov-action` from 5.5.2 to 5.5.3 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@671740a...1af5884) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](github/codeql-action@v3...v4) Updates `docker/metadata-action` from 5.5.1 to 6.0.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@8e5442c...030e881) Updates `docker/login-action` from 3.3.0 to 4.0.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@9780b0c...b45d80f) Updates `docker/bake-action` from 6.10.0 to 7.0.0 - [Release notes](https://github.com/docker/bake-action/releases) - [Commits](docker/bake-action@5be5f02...8249049) Updates `ossf/scorecard-action` from 2.4.1 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@f49aabe...4eaacf0) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dependabot/fetch-metadata dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 5.5.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/metadata-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/bake-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
1 parent d5b2a9b commit 7450b62

6 files changed

Lines changed: 36 additions & 36 deletions

File tree

‎.github/workflows/auto-merge-deps.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@ jobs:
2020

2121
steps:
2222
- name: Harden Runner
23-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
23+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
2424
with:
2525
egress-policy: audit
2626

2727
- name: Dependabot metadata
2828
id: metadata
2929
if: github.event.pull_request.user.login == 'dependabot[bot]'
30-
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
30+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
3131
with:
3232
github-token: "${{ secrets.GITHUB_TOKEN }}"
3333

‎.github/workflows/ci.yml‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ jobs:
1616
timeout-minutes: 15
1717
steps:
1818
- name: Checkout
19-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2020

2121
- name: Set up Docker Buildx
22-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
22+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
2323

2424
- name: Pull or build E2E image
2525
run: |
@@ -51,7 +51,7 @@ jobs:
5151
docker compose run --rm app-e2e npm run build
5252
5353
- name: Upload dependencies artifact
54-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
54+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5555
with:
5656
name: dependencies
5757
path: |
@@ -68,16 +68,16 @@ jobs:
6868
needs: setup
6969
steps:
7070
- name: Checkout
71-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
71+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7272

7373
- name: Set up Docker Buildx
74-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
74+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
7575

7676
- name: Pull E2E image
7777
run: docker pull ghcr.io/netresearch/timetracker:e2e || docker buildx bake app-e2e --load
7878

7979
- name: Download dependencies
80-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
80+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
8181
with:
8282
name: dependencies
8383

@@ -142,16 +142,16 @@ jobs:
142142
needs: setup
143143
steps:
144144
- name: Checkout
145-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
145+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
146146

147147
- name: Set up Docker Buildx
148-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
148+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
149149

150150
- name: Pull E2E image
151151
run: docker pull ghcr.io/netresearch/timetracker:e2e || docker buildx bake app-e2e --load
152152

153153
- name: Download dependencies
154-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
154+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
155155
with:
156156
name: dependencies
157157

@@ -175,7 +175,7 @@ jobs:
175175
php -d memory_limit=1G bin/phpunit --testsuite unit --coverage-clover var/coverage/unit.xml
176176
177177
- name: Upload unit coverage to Codecov
178-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
178+
uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
179179
with:
180180
token: ${{ secrets.CODECOV_TOKEN }}
181181
files: var/coverage/unit.xml
@@ -190,16 +190,16 @@ jobs:
190190
needs: setup
191191
steps:
192192
- name: Checkout
193-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
193+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
194194

195195
- name: Set up Docker Buildx
196-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
196+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
197197

198198
- name: Pull E2E image
199199
run: docker pull ghcr.io/netresearch/timetracker:e2e || docker buildx bake app-e2e --load
200200

201201
- name: Download dependencies
202-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
202+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
203203
with:
204204
name: dependencies
205205

@@ -231,7 +231,7 @@ jobs:
231231
php -d memory_limit=2G bin/phpunit --testsuite integration,controller,api-contract,api-functional --coverage-clover var/coverage/integration.xml
232232
233233
- name: Upload integration coverage to Codecov
234-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
234+
uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
235235
with:
236236
token: ${{ secrets.CODECOV_TOKEN }}
237237
files: var/coverage/integration.xml
@@ -254,16 +254,16 @@ jobs:
254254
shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
255255
steps:
256256
- name: Checkout
257-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
257+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
258258

259259
- name: Set up Docker Buildx
260-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
260+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
261261

262262
- name: Pull E2E image
263263
run: docker pull ghcr.io/netresearch/timetracker:e2e || docker buildx bake app-e2e --load
264264

265265
- name: Download dependencies
266-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
266+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
267267
with:
268268
name: dependencies
269269

@@ -340,7 +340,7 @@ jobs:
340340
341341
- name: Upload E2E coverage to Codecov
342342
if: always()
343-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
343+
uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
344344
with:
345345
token: ${{ secrets.CODECOV_TOKEN }}
346346
files: var/coverage/e2e-clover-${{ matrix.shard }}.xml
@@ -350,7 +350,7 @@ jobs:
350350

351351
- name: Upload test artifacts
352352
if: failure()
353-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
353+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
354354
with:
355355
name: e2e-artifacts-shard-${{ matrix.shard }}
356356
path: |

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,18 @@ jobs:
2424
language: [javascript-typescript]
2525
steps:
2626
- name: Checkout
27-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2828

2929
- name: Initialize CodeQL
30-
uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
30+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
3131
with:
3232
languages: ${{ matrix.language }}
3333
config-file: .github/codeql/codeql-config.yml
3434

3535
- name: Autobuild
36-
uses: github/codeql-action/autobuild@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
36+
uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
3737

3838
- name: Perform CodeQL Analysis
39-
uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
39+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4040
with:
4141
category: "/language:${{ matrix.language }}"

‎.github/workflows/docker-publish.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- name: Checkout
24-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525

2626
- name: Docker meta
2727
id: meta
28-
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
28+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
2929
with:
3030
images: ghcr.io/${{ github.repository }}
3131
tags: |
@@ -38,18 +38,18 @@ jobs:
3838
type=sha
3939
4040
- name: Set up Docker Buildx
41-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
41+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
4242

4343
- name: Login to GHCR
4444
if: github.event_name != 'pull_request'
45-
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
45+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
4646
with:
4747
registry: ghcr.io
4848
username: ${{ github.repository_owner }}
4949
password: ${{ secrets.GITHUB_TOKEN }}
5050

5151
- name: Build and push production image
52-
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
52+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
5353
with:
5454
source: .
5555
targets: app
@@ -63,7 +63,7 @@ jobs:
6363
*.cache-to=type=gha,mode=max
6464
6565
- name: Build and push E2E image
66-
uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
66+
uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
6767
with:
6868
source: .
6969
targets: app-e2e

‎.github/workflows/scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,18 @@ jobs:
1818
id-token: write
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
with:
2323
persist-credentials: false
2424

2525
- name: Run analysis
26-
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
26+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
2727
with:
2828
results_file: results.sarif
2929
results_format: sarif
3030
publish_results: true
3131

3232
- name: Upload to code-scanning
33-
uses: github/codeql-action/upload-sarif@v3
33+
uses: github/codeql-action/upload-sarif@v4
3434
with:
3535
sarif_file: results.sarif

‎.github/workflows/slsa-provenance.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616
contents: write
1717
steps:
1818
- name: Harden Runner
19-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
19+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
2020
with:
2121
egress-policy: audit
2222

2323
- name: Checkout code
24-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2525
with:
2626
fetch-depth: 0
2727

0 commit comments

Comments
 (0)