From 2cd35e2bb332736754657519ccc6bb0bfa413faa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Oct 2024 22:22:32 +0000 Subject: [PATCH] Bump the action-dependencies group across 1 directory with 4 updates Bumps the action-dependencies group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/upload-artifact](https://github.com/actions/upload-artifact), [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) and [google-github-actions/auth](https://github.com/google-github-actions/auth). Updates `actions/checkout` from 4.1.7 to 4.2.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/692973e3d937129bcbf40652eb9f2f61becf3332...eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871) Updates `actions/upload-artifact` from 4.4.0 to 4.4.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/50769540e7f4bd5e21e526ee35c689e35e0d6874...604373da6381bf24206979c74d06a550515601b9) Updates `pypa/gh-action-pypi-publish` from 1.10.2 to 1.10.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/897895f1e160c830e369f9779632ebc134688e1b...f7600683efdcb7656dec5b29656edb7bc586e597) Updates `google-github-actions/auth` from 2.1.5 to 2.1.6 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/auth/compare/62cf5bd3e4211a0a0b51f2c6d6a37129d828611d...8254fb75a33b976a221574d287e93919e6a36f70) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor dependency-group: action-dependencies - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies - dependency-name: pypa/gh-action-pypi-publish dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/_test.yml | 2 +- .github/workflows/cd.yml | 6 +++--- .github/workflows/check-upstream-ed25519.yml | 2 +- .github/workflows/test-kms-aws.yml | 2 +- .github/workflows/test-kms.yml | 4 ++-- .github/workflows/test-sigstore.yml | 2 +- .github/workflows/test-vault.yaml | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 29750a4c..041f66b9 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout securesystemslib - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 32c204ac..186458b0 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -19,7 +19,7 @@ jobs: needs: test steps: - name: Checkout release tag - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1 with: ref: ${{ github.event.workflow_run.head_branch }} @@ -35,7 +35,7 @@ jobs: run: PIP_CONSTRAINT=requirements-build.txt python3 -m build --sdist --wheel --outdir dist/ . - name: Store build artifacts - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0 + uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1 # NOTE: The GitHub release page contains the release artifacts too, but using # GitHub upload/download actions seems robuster: there is no need to compute # download URLs and tampering with artifacts between jobs is more limited. @@ -101,7 +101,7 @@ jobs: - name: Publish binary wheel and source tarball on PyPI # Only attempt pypi upload in upstream repository if: github.repository == 'secure-systems-lab/securesystemslib' - uses: pypa/gh-action-pypi-publish@897895f1e160c830e369f9779632ebc134688e1b # v1.10.2 + uses: pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3 - name: Finalize GitHub release uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 diff --git a/.github/workflows/check-upstream-ed25519.yml b/.github/workflows/check-upstream-ed25519.yml index 59eebd24..8e0c76c4 100644 --- a/.github/workflows/check-upstream-ed25519.yml +++ b/.github/workflows/check-upstream-ed25519.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Test if ed25519 upstream main HEAD is what we expect id: test_ed25519 run: | diff --git a/.github/workflows/test-kms-aws.yml b/.github/workflows/test-kms-aws.yml index bfe2e996..d5ed7ff0 100644 --- a/.github/workflows/test-kms-aws.yml +++ b/.github/workflows/test-kms-aws.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout securesystemslib - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Set up Python uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 diff --git a/.github/workflows/test-kms.yml b/.github/workflows/test-kms.yml index 86d52e83..0e69edf5 100644 --- a/.github/workflows/test-kms.yml +++ b/.github/workflows/test-kms.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Checkout securesystemslib - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Set up Python uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 @@ -32,7 +32,7 @@ jobs: pip install --upgrade tox - name: Authenticate to Google Cloud - uses: google-github-actions/auth@62cf5bd3e4211a0a0b51f2c6d6a37129d828611d + uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 with: token_format: access_token workload_identity_provider: projects/843741030650/locations/global/workloadIdentityPools/securesystemslib-tests/providers/securesystemslib-tests diff --git a/.github/workflows/test-sigstore.yml b/.github/workflows/test-sigstore.yml index 111a8bb4..2050ac16 100644 --- a/.github/workflows/test-sigstore.yml +++ b/.github/workflows/test-sigstore.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout securesystemslib - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Set up Python uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 diff --git a/.github/workflows/test-vault.yaml b/.github/workflows/test-vault.yaml index 9762e106..4d86595e 100644 --- a/.github/workflows/test-vault.yaml +++ b/.github/workflows/test-vault.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout securesystemslib - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 + uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 - name: Set up Python uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3