Repository navigation
ci: bump the github-actions group across 1 directory with 7 updates - #9
dependabot[bot] wants to merge 2 commits into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
7a4f2a4 to
2f643ae
Compare
6542a2a to
6bbaa0f
Compare
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) | `3.3.0` | `3.5.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.4.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6.19.2` | `7.4.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.3` | `4.38.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.3` | `4.38.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.3` | `4.38.0` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `hadolint/hadolint-action` from 3.3.0 to 3.5.0 - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](hadolint/hadolint-action@2332a7b...06be81b) Updates `docker/setup-buildx-action` from 3.12.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@8d2750c...f87e599) Updates `docker/build-push-action` from 6.19.2 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...c3c9e26) Updates `github/codeql-action/upload-sarif` from 4.36.3 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...b96794f) Updates `github/codeql-action/init` from 4.36.3 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...b96794f) Updates `github/codeql-action/analyze` from 4.36.3 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...b96794f) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: hadolint/hadolint-action dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
6bbaa0f to
3070faa
Compare
|
Resolved against current main with a signed merge commit, preserving all current CI regression checks, deny-by-default permissions, and the LockBox/generic runtime matrix. The removed cloud-instructions check stays removed. No history was rewritten. Verified upstream commit signatures, tag targets, action metadata, and configured inputs for the exact SHAs: checkout 3d3c42e = v7.0.1 (the cached v4 annotation was wrong); hadolint 06be81b = v3.5.0; Buildx f87e599 = v4.4.1; build-push c3c9e26 = v7.4.0; CodeQL b96794f = v4.38.0. JavaScript actions use Node 24 on the existing ubuntu-24.04 hosted runners. No dependency trust boundary or workflow permission was added. Desktop handoff: full fleet make check (123 Python regressions and nine managed copies/pins), actionlint, Bash syntax, CI-warning-level ShellCheck, and diff whitespace checks passed. Publication: explicit three-path index staging, full staged-content secret audit, and staged whitespace checks passed. CI must validate this new exact head, including both-image builds/booted runtime smoke and CodeQL. Host image doctor/native launcher results remain unavailable. Full-severity ShellCheck only reported pre-existing SC2015 information in unchanged doctor scripts. |
|
Final publication verification for head 86617d8: CI Complete, CodeQL analysis/security check, both-image builds and functional egress smoke tests, all regression checks, secret audits, and linters passed. The exact upstream SHAs and supported workflow inputs have been verified. Conflict resolution retained current main files and did not restore obsolete cloud instructions. Main is governed by active ruleset Protect main (18505263), including Restrict updates with an administrator bypass actor. The user explicitly prohibited protection bypass, so no administrator merge or ruleset relaxation was attempted. Required approvals are currently zero and there is no blocking review. All three live PRs remain BLOCKED even after their checks completed. Host image doctor/native Apple Container launcher results were requested but have not been supplied; this publication container has no runtime. The working tree remains unchanged and hooks remain disabled. |
|
Resolved the Dependabot label warning by creating the configured github-actions repository label and applying it to this PR. The existing github_actions label was preserved. This metadata fix does not change the reported merge blockers. |
|
Closed at the user’s explicit request to keep only main and no open PRs. All changed blobs from verified PR head 86617d8 are preserved exactly in focused signed local-main commits b355f22. Local main is 9c1d4d4; the user will push it separately. This is a closure, not a merge, and remote main has not been updated. Repository protections remain unchanged. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
Bumps the github-actions group with 7 updates in the / directory:
7.0.07.0.13.3.03.5.03.12.04.4.16.19.27.4.04.36.34.38.04.36.34.38.04.36.34.38.0Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
hadolint/hadolint-actionfrom 3.3.0 to 3.5.0Release notes
Sourced from hadolint/hadolint-action's releases.
Commits
06be81bMerge pull request #107 from gizero/bump-hadolint-base-image-to-2.15.1941db07feat: Bump Hadolint to v2.15.1d0e9595Merge pull request #106 from m-ildefons/gh-78df662abProblem Matcher: Capture code and severity32c6895Merge pull request #85 from rjbell4/patch-1146301cMerge pull request #105 from m-ildefons/gh-100df8eaafCI: run integration tests with different runners2a66e89feat: Bump Hadolint to v2.15.075bb911fixup! Update hadolint.sh631cc83Update repository reference in problem-matcher.jsonUpdates
docker/setup-buildx-actionfrom 3.12.0 to 4.4.1Release notes
Sourced from docker/setup-buildx-action's releases.
... (truncated)
Commits
f87e599Merge pull request #624 from crazy-max/skip-pull-with-endpointe700274chore: update generated content3061c91skip BuildKit image pre-pulls for explicit endpoints594f3bfMerge pull request #609 from crazy-max/pull-buildkit-image-before-createbd6e702chore: update generated content6268c9dpull BuildKit image before builder creatione823525Merge pull request #621 from docker/dependabot/github_actions/codeql-actions-...533ed8ebuild(deps): bump the codeql-actions group with 2 updatesbedaf13Merge pull request #620 from crazy-max/shared-error-helpersd5079fbchore: update generated contentUpdates
docker/build-push-actionfrom 6.19.2 to 7.4.0Release notes
Sourced from docker/build-push-action's releases.
... (truncated)
Commits
c3c9e26Merge pull request #1621 from docker/dependabot/npm_and_yarn/docker/actions-t...459b674[dependabot skip] chore: update generated content4dedcb2chore(deps): Bump@docker/actions-toolkitfrom 0.99.0 to 0.100.0379bf63Merge pull request #1620 from crazy-max/buildx-error-message9877975chore: update generated content7ed0556use the shared Buildx error summary helper91670baMerge pull request #1618 from docker/dependabot/npm_and_yarn/docker/actions-t...80dbc86[dependabot skip] chore: update generated content50cac3achore(deps): Bump@docker/actions-toolkitfrom 0.98.0 to 0.99.003b4d6cMerge pull request #1617 from crazy-max/fix-metadata-workflow-commandsUpdates
github/codeql-action/upload-sariffrom 4.36.3 to 4.38.0Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
github/codeql-action/initfrom 4.36.3 to 4.38.0Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
github/codeql-action/analyzefrom 4.36.3 to 4.38.0Release notes
Sourced from github/codeql-action/analyze's releases.