Bump docker/setup-buildx-action from 1 to 2 #5551
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 1 to 2. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v1...v2) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
A2-insubstantial
The rationale is that dependabot will start to update the SHAs of the deps' versions if there is SHA already. As we wanted https://github.com/paritytech/ci_cd/issues/79 After this is merged, dependabot should raise a new PR with a new SHA of version `v2`.
|
Using the SHA does not make it very easy for a reader to know what version is used. I see the comment but that means relying on it being correct. Sure you want to do that ? |
|
Yes, there are several security concerns to it. I.e. $someone can tag a malicious version or te-tag one with an approved tag. Many repos of github itself are updating dependencies with dependabot updating them on trusted versions with SHA. The inconvenience is that a human has to update the comment for readability. |
|
Would that not be a better alternative to define an ENV/secret called |
|
An event better alternative would be to fork those actions and you set a |
sergejparity
deleted the
dependabot/github_actions/docker/setup-buildx-action-2
branch
Bumps docker/setup-buildx-action from 1 to 2.
Release notes
Sourced from docker/setup-buildx-action's releases.
... (truncated)
Commits
dc7b971Merge pull request #131 from crazy-max/node16f55bc08Merge pull request #141 from crazy-max/fix-testaa877a9ci: fix standalone test130c56fNode 16 as default runtimeDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)