Skip to content

Bump the actions group with 13 updates #277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the actions group with 13 updates #277

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 24, 2025

Bumps the actions group with 13 updates:

Package From To
step-security/harden-runner 2.12.2 2.13.1
actions/checkout 4.2.2 5.0.0
ruby/setup-ruby 1.245.0 1.265.0
codecov/codecov-action 5.3.1 5.5.1
sigstore/sigstore-conformance 0.0.16 0.0.21
github/codeql-action 3.28.5 4.30.9
actions/dependency-review-action 4.5.0 4.8.1
actions/upload-artifact 4.6.0 4.6.2
slsa-framework/slsa-github-generator 2.0.0 2.1.0
actions/download-artifact 4.1.8 5.0.0
rubygems/configure-rubygems-credentials f456a002d58f0de60b44383d10ae82316b18a166 23d6a54ecc9cbcdfeab01a03a15a7deabe34efc0
softprops/action-gh-release 2.2.1 2.4.1
ossf/scorecard-action 2.4.0 2.4.3

Updates step-security/harden-runner from 2.12.2 to 2.13.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.1

What's Changed

  • Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

  • Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

  • Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

What's Changed

  • Improved job markdown summary
  • Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

Commits
  • f4a75cf Merge pull request #588 from step-security/rc-26
  • 95503d0 ci: remove code-review workflow
  • 4b250a0 ci: add job to confirm dist is as expected
  • 5b0ab6a update dependencies
  • d11f2c1 fix bug where status code was not being preserved
  • b3fc98e improve error handling for policy store sceanrio
  • 92fc5d4 update error message
  • b61b0a4 policy store improvements
  • e3d3f2b use GitHub release instead of packages
  • 646ac01 update agent
  • Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates ruby/setup-ruby from 1.245.0 to 1.265.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.265.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.264.0...v1.265.0

v1.264.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.263.0...v1.264.0

v1.263.0

What's Changed

New Contributors

Full Changelog: ruby/setup-ruby@v1.262.0...v1.263.0

v1.262.0

Full Changelog: ruby/setup-ruby@v1.261.0...v1.262.0

v1.261.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.260.0...v1.261.0

v1.260.0

What's Changed

New Contributors

Full Changelog: ruby/setup-ruby@v1.259.0...v1.260.0

v1.259.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.258.0...v1.259.0

... (truncated)

Commits
  • ab177d4 Update CRuby releases on Windows
  • 6797dcb Add ruby-3.4.7
  • a16e0e6 Test on macos-15-intel too
  • 0481980 Print lockfile contents earlier
  • cf7216d Use new releases of ruby-builder per engine-version
  • 1c58d16 Update CRuby releases on Windows
  • 1dc7956 Test on JRuby 9.4 as well as 10.0
  • b8714f7 Revert "Skip test failing on JRuby on Windows"
  • d3e13b3 Revert "feat: upgrade to node 24"
  • 4df093a Revert "chore: add setup-node for lint job"
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 5.3.1 to 5.5.1

Release notes

Sourced from codecov/codecov-action's releases.

v5.5.1

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.5.0...v5.5.1

v5.5.0

What's Changed

New Contributors

Full Changelog: codecov/codecov-action@v5.4.3...v5.5.0

v5.4.3

What's Changed

Full Changelog: codecov/codecov-action@v5.4.2...v5.4.3

v5.4.2

What's Changed

Full Changelog: codecov/codecov-action@v5.4.1...v5.4.2

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.1..v5.4.2

v5.4.1

... (truncated)

Commits

Updates sigstore/sigstore-conformance from 0.0.16 to 0.0.21

Release notes

Sourced from sigstore/sigstore-conformance's releases.

v0.0.21

Fixed

  • Fix rekor2 signing test by updating the signingconfig used there: The signing config is currently hard coded and the previous shard was just closed for write traffic: sigstore/sigstore-conformance#252

v0.0.20

What's Changed

the sign command of the CLI protocol now contains optional --signing-config and --trusted-root arguments: This feature is used in the new signing test, users should update their client-under-test CLI implementations (or alternatively mark the test as XFAILed if the underlying client is incompatible). See CLI protocol for more details.

Added tests

  • Multiple new verification tests for rekor2 entries
  • Signing test for rekor2 entries

Full Changelog: sigstore/sigstore-conformance@v0.0.19...v0.0.20

v0.0.19

What's Changed

  • Test names have changed: Expected failures ("xfail") lists must be updated
  • xfails can now be expressed with wildcards, see README for details and examples
  • Tests now include rekor v2 tests: this means bundles with
    • Log entries with kindversion hashedrekord 0.0.2 or dsse 0.0.2
    • TSA timestamps that clients must verify correctly
    • No integrated time in the entry

New Contributors

Full Changelog: sigstore/sigstore-conformance@v0.0.18...v0.0.19

v0.0.18

This is a small bug fix release.

What's Changed

Full Changelog: sigstore/sigstore-conformance@v0.0.17...v0.0.18

v0.0.17

What's Changed

... (truncated)

Commits
  • 244638a Update signing config and trusted root to latest versions (#252)
  • 797961f Bump version in README example (#251)
  • 1d8b0cd Add checkpoint signature mismatch test for Rekor v2 (#250)
  • 25184a0 Bump h2 from 4.1.0 to 4.3.0 (#249)
  • c698a2b setup: Install selftest client as well (#248)
  • 8b616fe Change order of arguments for sign bundle test (#246)
  • d11e48d makefile: Remove pip-tools workaround (#244)
  • b8035e7 Support --signing-config in CLI, test for rekor2 signing (#239)
  • 2436121 Add tests for verifying a C2SP-compliant checkpoint (#241)
  • 5926a17 selftest: Complete the fake signingconfig (#238)
  • Additional commits viewable in compare view

Updates github/codeql-action from 3.28.5 to 4.30.9

Release notes

Sourced from github/codeql-action's releases.

v4.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

v4.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v4.30.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

See the full CHANGELOG.md for more information.

v3.30.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

See the full CHANGELOG.md for more information.

v3.30.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • Bump minimum CodeQL bundle version to 2.17.6. #3223

4.30.9 - 17 Oct 2025

  • Update default CodeQL bundle version to 2.23.3. #3205
  • Experimental: A new setup-codeql action has been added which is similar to init, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. #3204

4.30.8 - 10 Oct 2025

No user facing changes.

4.30.7 - 06 Oct 2025

  • [v4+ only] The CodeQL Action now runs on Node.js v24. #3169

3.30.6 - 02 Oct 2025

  • Update default CodeQL bundle version to 2.23.2. #3168

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #3160

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #3099 and #3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #3130
  • Update default CodeQL bundle version to 2.23.1. #3118

3.30.3 - 10 Sep 2025

No user facing changes.

3.30.2 - 09 Sep 2025

  • Fixed a bug which could cause language autodetection to fail. #3084
  • Experimental: The quality-queries input that was added in 3.29.2 as part of an internal experiment is now deprecated and will be removed in an upcoming version of the CodeQL Action. It has been superseded by a new analysis-kinds input, which is part of the same internal experiment. Do not use this in production as it is subject to change at any time. #3064

3.30.1 - 05 Sep 2025

  • Update default CodeQL bundle version to 2.23.0. #3077

3.30.0 - 01 Sep 2025

... (truncated)

Commits
  • 16140ae Merge pull request #3213 from github/update-v4.30.9-70205d3d1
  • 30db5fe Update changelog for v4.30.9
  • 70205d3 Merge pull request #3211 from github/mbg/init/starting-partial-config
  • 697c209 Merge remote-tracking branch 'origin/main' into mbg/init/starting-partial-config
  • 1bd53ba Merge pull request #3205 from github/update-bundle/codeql-bundle-v2.23.3
  • cac4df0 Rebuild
  • 77e5c0d Merge branch 'main' into update-bundle/codeql-bundle-v2.23.3
  • 97a4f75 Merge pull request #3204 from github/mbg/setup-codeql
  • 2d5512b Merge remote-tracking branch 'origin/main' into mbg/init/starting-partial-config
  • fa7bdf0 Call getAnalysisKinds a second time, and ignore exceptions thrown during th...
  • Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.5.0 to 4.8.1

Release notes

Sourced from actions/dependency-review-action's releases.

Dependency Review Action v4.8.1

What's Changed

Full Changelog: actions/dependency-review-action@v4...v4.8.1

v4.8.0

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.8.0

4.7.3

What's Changed

Full Changelog: actions/dependency-review-action@v4...v4.7.3

4.7.2

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4...v4.7.2

v4.7.1

  • Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
  • License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

v4.7.0

  • Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)
  • Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

... (truncated)

Commits
  • 40c09b7 Merge pull request #1001 from actions/ahpook/v4.8.1-release
  • 4552948 Bump version for 4.8.1 release
  • e63da9a Merge pull request #1000 from actions/ahpook/deprecation-redux
  • 71365c7 (bug) Fix spamming link test in deprecation warning (again)
  • 56339e5 Merge pull request #988 from actions/brrygrdn/rc-4.8.0
  • 1688b74 Bump to a 4.8.0
  • 31c9f17 Merge pull request #987 from actions/rc-4.7.4
  • eacde78 Update version
  • 8151009 Merge pull request #986 from actions/brrygrdn/rc-4.7.4
  • b472ec9 Add a quick regression test for the artefact summary
  • Additional commits viewable in compare view

Updates actions/upload-artifact from 4.6.0 to 4.6.2

Release notes

Sourced from actions/upload-artifact's releases.

v4.6.2

What's Changed

  • Update to use ...

    Description has been truncated

@dependabot
Bump the actions group with 13 updates
e24831d 
Bumps the actions group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.12.2` | `2.13.1` |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.245.0` | `1.265.0` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.3.1` | `5.5.1` |
| [sigstore/sigstore-conformance](https://github.com/sigstore/sigstore-conformance) | `0.0.16` | `0.0.21` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.5` | `4.30.9` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.5.0` | `4.8.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.0` | `4.6.2` |
| [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | `2.0.0` | `2.1.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.8` | `5.0.0` |
| [rubygems/configure-rubygems-credentials](https://github.com/rubygems/configure-rubygems-credentials) | `f456a002d58f0de60b44383d10ae82316b18a166` | `23d6a54ecc9cbcdfeab01a03a15a7deabe34efc0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.2.1` | `2.4.1` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.3` |


Updates `step-security/harden-runner` from 2.12.2 to 2.13.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@6c439dc...f4a75cf)

Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

Updates `ruby/setup-ruby` from 1.245.0 to 1.265.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@a4effe4...ab177d4)

Updates `codecov/codecov-action` from 5.3.1 to 5.5.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@13ce06b...5a10915)

Updates `sigstore/sigstore-conformance` from 0.0.16 to 0.0.21
- [Release notes](https://github.com/sigstore/sigstore-conformance/releases)
- [Commits](sigstore/sigstore-conformance@d658ea7...244638a)

Updates `github/codeql-action` from 3.28.5 to 4.30.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3.28.5...16140ae)

Updates `actions/dependency-review-action` from 4.5.0 to 4.8.1
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@3b139cf...40c09b7)

Updates `actions/upload-artifact` from 4.6.0 to 4.6.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@65c4c4a...ea165f8)

Updates `slsa-framework/slsa-github-generator` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases)
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md)
- [Commits](slsa-framework/slsa-github-generator@v2.0.0...v2.1.0)

Updates `actions/download-artifact` from 4.1.8 to 5.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@fa0a91b...634f93c)

Updates `rubygems/configure-rubygems-credentials` from f456a002d58f0de60b44383d10ae82316b18a166 to 23d6a54ecc9cbcdfeab01a03a15a7deabe34efc0
- [Release notes](https://github.com/rubygems/configure-rubygems-credentials/releases)
- [Commits](rubygems/configure-rubygems-credentials@f456a00...23d6a54)

Updates `softprops/action-gh-release` from 2.2.1 to 2.4.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@c95fe14...6da8fa9)

Updates `ossf/scorecard-action` from 2.4.0 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@62b2cac...4eaacf0)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: ruby/setup-ruby
  dependency-version: 1.265.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: sigstore/sigstore-conformance
  dependency-version: 0.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: 4.30.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/dependency-review-action
  dependency-version: 4.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: slsa-framework/slsa-github-generator
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: rubygems/configure-rubygems-credentials
  dependency-version: 23d6a54ecc9cbcdfeab01a03a15a7deabe34efc0
  dependency-type: direct:production
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants