Bump actions/checkout from 3 to 4 #31413
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
requested review from
klizhentas,
russjones,
r0mant and
zmb3
as code owners
dependabot
bot
added
dependencies
dependabot
bot
requested review from
camscale,
fheinecke,
jentfoo and
wadells
jentfoo
approved these changes
Sep 5, 2023
dependabot
bot
force-pushed
the
dependabot/github_actions/actions/checkout-4
branch
2 times, most recently
from
13cbd7b to
5153055
Compare
|
We're seeing some build failures (in e) that are addressed by this: For instance: https://github.com/gravitational/teleport.e/actions/runs/6082504079/job/16500434371 We should take it here too. |
wadells
approved these changes
Sep 6, 2023
reedloden
approved these changes
Sep 7, 2023
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/github_actions/actions/checkout-4
branch
from
5153055 to
d3433a1
Compare
r0mant
approved these changes
Sep 7, 2023
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
|
There is an issue with this update in our OS compatibility build due to not having the needed libc version: https://github.com/gravitational/teleport/actions/runs/6114247739/job/16595427514 |
wadells
reviewed
Sep 15, 2023
This also impacts I put a time into researching this today, and didn't come up with any good solutions. I'd love to be able to ignore only this one instance of checkout with a comment or something similar, but it doesn't look like that is supported. Some ideas I explored:
My current plan is to punt. I'll keep |
wadells
reviewed
Sep 15, 2023
wadells
pushed a commit
that referenced
this pull request
Nov 16, 2023
* Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Update .github/workflows/os-compatibility-test.yaml * Do not upgrade checkouts that run in centos:7 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit a84ed24)
wadells
pushed a commit
that referenced
this pull request
Nov 16, 2023
* Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Update .github/workflows/os-compatibility-test.yaml * Do not upgrade checkouts that run in centos:7 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit a84ed24)
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 21, 2023
* Upgrade GitHub actions to node 20 (#32098) * Bump docker/metadata-action from 4 to 5 Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 4 to 5. - [Release notes](https://github.com/docker/metadata-action/releases) - [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md) - [Commits](docker/metadata-action@v4...v5) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/build-push-action from 2 to 5 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2 to 5. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v2...v5) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/setup-buildx-action from 2 to 3 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v2...v3) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/login-action from 2 to 3 Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v2...v3) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump aws-actions/configure-aws-credentials from 3.0.1 to 4.0.1 Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 3.0.1 to 4.0.1. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@04b98b3...010d0da) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump actions/setup-node from 3 to 4 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 3 to 4. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v3...v4) --- updated-dependencies: - dependency-name: actions/setup-node dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> --------- (cherry picked from commit 0c88caf) * Swap actions/create-github-app-token for tibdex/github-app-token (#32106) tibdex is some random developer. We prefer 2nd party actions from GitHub, as we have a contractual relationship with them. As part of this change, I'm also comfortable dropping the SHA pinning -- since the `actions` org can be held to a higher level of trust for both security and backwards compatibility concerns. (cherry picked from commit 80279b5) * Bump aws-actions/amazon-ecr-login from 1 to 2 (#33152) Bumps [aws-actions/amazon-ecr-login](https://github.com/aws-actions/amazon-ecr-login) from 1 to 2. - [Release notes](https://github.com/aws-actions/amazon-ecr-login/releases) - [Changelog](https://github.com/aws-actions/amazon-ecr-login/blob/main/CHANGELOG.md) - [Commits](aws-actions/amazon-ecr-login@v1...v2) --- updated-dependencies: - dependency-name: aws-actions/amazon-ecr-login dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit ccadcdf) * Bump actions/checkout from 3 to 4 (#31413) * Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Update .github/workflows/os-compatibility-test.yaml * Do not upgrade checkouts that run in centos:7 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit a84ed24) * ci: update inputs for create-github-app-token step (#33929) As per https://github.com/actions/create-github-app-token#inputs, we should be using `app-id` and `private-key`. This has been showing up in warnings in our runs for some time now: Warning: Input 'app_id' has been deprecated with message 'app_id' is deprecated and will be removed in a future version. Use 'app-id' instead. Warning: Input 'private_key' has been deprecated with message: 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead. (cherry picked from commit 68d8647) * Pin additional 3rd party GitHub actions (#34678) We favor determinism and security in our CI and CD automation. As part of this, we want to ensure we can review, changes, roll them out at an expected time, and roll them back if something breaks. All of this is enabled by using pinned versions of GitHub actions instead of floating tags. This PR pins all actions in this repo, except for: * First party actions (from a `gravitational/` repo). We control the code review and deploy process for these. * 2nd party actions (from the `actions/` or `github/` repos). We trust that if these were compromised, we'd not be the most valuable target. Furthermore, these are by far the most common actions, and we save a deal of sustaining work by not manually approving upgrades. Contributes to https://github.com/gravitational/security-findings/issues/50 (cherry picked from commit cf0277a) * Remove dependabot batcher workflow (#30771) The renovate config and workflow and the batching workflow have been removed. They both served as a means to bundle updates but now that the functionality is built into dependabot we no longer need them. (cherry picked from commit 942edbd) --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Zac Bergquist <[email protected]> Co-authored-by: rosstimothy <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 21, 2023
* Bump helm/kind-action from 1.5.0 to 1.8.0 (#31993) Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.5.0 to 1.8.0. - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](helm/kind-action@v1.5.0...v1.8.0) --- updated-dependencies: - dependency-name: helm/kind-action dependency-type: direct:production update-type: version-update:semver-minor ... (cherry picked from commit 4a657b5) * Upgrade GitHub actions to node 20 (#32098) * Bump docker/metadata-action from 4 to 5 Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 4 to 5. - [Release notes](https://github.com/docker/metadata-action/releases) - [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md) - [Commits](docker/metadata-action@v4...v5) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/build-push-action from 2 to 5 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2 to 5. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v2...v5) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/setup-buildx-action from 2 to 3 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v2...v3) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/login-action from 2 to 3 Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v2...v3) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump aws-actions/configure-aws-credentials from 3.0.1 to 4.0.1 Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 3.0.1 to 4.0.1. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@04b98b3...010d0da) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump actions/setup-node from 3 to 4 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 3 to 4. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v3...v4) --- updated-dependencies: - dependency-name: actions/setup-node dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> --------- (cherry picked from commit 0c88caf) * Swap actions/create-github-app-token for tibdex/github-app-token (#32106) tibdex is some random developer. We prefer 2nd party actions from GitHub, as we have a contractual relationship with them. As part of this change, I'm also comfortable dropping the SHA pinning -- since the `actions` org can be held to a higher level of trust for both security and backwards compatibility concerns. (cherry picked from commit 80279b5) * Bump aws-actions/amazon-ecr-login from 1 to 2 (#33152) Bumps [aws-actions/amazon-ecr-login](https://github.com/aws-actions/amazon-ecr-login) from 1 to 2. - [Release notes](https://github.com/aws-actions/amazon-ecr-login/releases) - [Changelog](https://github.com/aws-actions/amazon-ecr-login/blob/main/CHANGELOG.md) - [Commits](aws-actions/amazon-ecr-login@v1...v2) --- updated-dependencies: - dependency-name: aws-actions/amazon-ecr-login dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit ccadcdf) * Bump actions/checkout from 3 to 4 (#31413) * Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Update .github/workflows/os-compatibility-test.yaml * Do not upgrade checkouts that run in centos:7 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit a84ed24) * ci: update inputs for create-github-app-token step (#33929) As per https://github.com/actions/create-github-app-token#inputs, we should be using `app-id` and `private-key`. This has been showing up in warnings in our runs for some time now: Warning: Input 'app_id' has been deprecated with message 'app_id' is deprecated and will be removed in a future version. Use 'app-id' instead. Warning: Input 'private_key' has been deprecated with message: 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead. (cherry picked from commit 68d8647) (cherry picked from commit 3b4b5a2) * Pin additional 3rd party GitHub actions (#34678) We favor determinism and security in our CI and CD automation. As part of this, we want to ensure we can review, changes, roll them out at an expected time, and roll them back if something breaks. All of this is enabled by using pinned versions of GitHub actions instead of floating tags. This PR pins all actions in this repo, except for: * First party actions (from a `gravitational/` repo). We control the code review and deploy process for these. * 2nd party actions (from the `actions/` or `github/` repos). We trust that if these were compromised, we'd not be the most valuable target. Furthermore, these are by far the most common actions, and we save a deal of sustaining work by not manually approving upgrades. Contributes to https://github.com/gravitational/security-findings/issues/50 (cherry picked from commit cf0277a) * Remove dependabot batcher workflow (#30771) The renovate config and workflow and the batching workflow have been removed. They both served as a means to bundle updates but now that the functionality is built into dependabot we no longer need them. (cherry picked from commit 942edbd) --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Zac Bergquist <[email protected]> Co-authored-by: rosstimothy <[email protected]>
github-merge-queue bot
pushed a commit
that referenced
this pull request
Nov 21, 2023
* Bump helm/kind-action from 1.5.0 to 1.8.0 (#31993) Bumps [helm/kind-action](https://github.com/helm/kind-action) from 1.5.0 to 1.8.0. - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](helm/kind-action@v1.5.0...v1.8.0) --- updated-dependencies: - dependency-name: helm/kind-action dependency-type: direct:production update-type: version-update:semver-minor ... (cherry picked from commit 4a657b5) * Upgrade GitHub actions to node 20 (#32098) * Bump docker/metadata-action from 4 to 5 Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 4 to 5. - [Release notes](https://github.com/docker/metadata-action/releases) - [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md) - [Commits](docker/metadata-action@v4...v5) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/build-push-action from 2 to 5 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2 to 5. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v2...v5) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/setup-buildx-action from 2 to 3 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@v2...v3) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump docker/login-action from 2 to 3 Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v2...v3) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump aws-actions/configure-aws-credentials from 3.0.1 to 4.0.1 Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 3.0.1 to 4.0.1. - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@04b98b3...010d0da) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Bump actions/setup-node from 3 to 4 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 3 to 4. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v3...v4) --- updated-dependencies: - dependency-name: actions/setup-node dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> --------- (cherry picked from commit 0c88caf) * Swap actions/create-github-app-token for tibdex/github-app-token (#32106) tibdex is some random developer. We prefer 2nd party actions from GitHub, as we have a contractual relationship with them. As part of this change, I'm also comfortable dropping the SHA pinning -- since the `actions` org can be held to a higher level of trust for both security and backwards compatibility concerns. (cherry picked from commit 80279b5) * Bump aws-actions/amazon-ecr-login from 1 to 2 (#33152) Bumps [aws-actions/amazon-ecr-login](https://github.com/aws-actions/amazon-ecr-login) from 1 to 2. - [Release notes](https://github.com/aws-actions/amazon-ecr-login/releases) - [Changelog](https://github.com/aws-actions/amazon-ecr-login/blob/main/CHANGELOG.md) - [Commits](aws-actions/amazon-ecr-login@v1...v2) --- updated-dependencies: - dependency-name: aws-actions/amazon-ecr-login dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit ccadcdf) * Bump jetpack-io/devbox-install-action from 0.6.0 to 0.6.1 (#31720) Bumps [jetpack-io/devbox-install-action](https://github.com/jetpack-io/devbox-install-action) from 0.6.0 to 0.6.1. - [Release notes](https://github.com/jetpack-io/devbox-install-action/releases) - [Commits](jetify-com/devbox-install-action@v0.6.0...v0.6.1) --- updated-dependencies: - dependency-name: jetpack-io/devbox-install-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (cherry picked from commit 4e1e35f) * Bump actions/checkout from 3 to 4 (#31413) * Bump actions/checkout from 3 to 4 Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Update .github/workflows/os-compatibility-test.yaml * Do not upgrade checkouts that run in centos:7 --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Walt <[email protected]> (cherry picked from commit a84ed24) * ci: update inputs for create-github-app-token step (#33929) As per https://github.com/actions/create-github-app-token#inputs, we should be using `app-id` and `private-key`. This has been showing up in warnings in our runs for some time now: Warning: Input 'app_id' has been deprecated with message 'app_id' is deprecated and will be removed in a future version. Use 'app-id' instead. Warning: Input 'private_key' has been deprecated with message: 'private_key' is deprecated and will be removed in a future version. Use 'private-key' instead. (cherry picked from commit 68d8647) (cherry picked from commit 3b4b5a2) * Pin additional 3rd party GitHub actions (#34678) We favor determinism and security in our CI and CD automation. As part of this, we want to ensure we can review, changes, roll them out at an expected time, and roll them back if something breaks. All of this is enabled by using pinned versions of GitHub actions instead of floating tags. This PR pins all actions in this repo, except for: * First party actions (from a `gravitational/` repo). We control the code review and deploy process for these. * 2nd party actions (from the `actions/` or `github/` repos). We trust that if these were compromised, we'd not be the most valuable target. Furthermore, these are by far the most common actions, and we save a deal of sustaining work by not manually approving upgrades. Contributes to https://github.com/gravitational/security-findings/issues/50 (cherry picked from commit cf0277a) --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Zac Bergquist <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 3 to 4.
Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3df4ab1Release 4.0.0 (#1447)8b5e8b7Support fetching without the --progress option (#1067)97a652bUpdate default runtime to node20 (#1436)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)