From 8c7e06d1562b5142114d233e812708ee7cff77de Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Nov 2026 20:34:38 +0000 Subject: [PATCH] ci: Bump the actions group across 1 directory with 9 updates Bumps the actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [docker/login-action](https://github.com/docker/login-action) | `4.4.0` | `4.8.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.2` | `4.1.3` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.2.2` | | [azure/setup-helm](https://github.com/azure/setup-helm) | `5.0.1` | `5.1.0` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `2c7215f132e9ebf062739d9130488b56d53c060c` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `e18b497796c12c097a38f9edb9d0641fb99eee32` | `c8037a86dde8214a8310e9f54a8fc61ab362aa31` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | Updates `docker/login-action` from 4.4.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...8aa5831fb8d48d8f76594c7ddde61ae58019f550) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `docker/build-push-action` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc) Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/6f9f17788090df1f26f669e9d70d6ae9567deba6...756fe2d284c7292c4e9b62c8a28f1e5629c59532) Updates `actions/attest-build-provenance` from 2.4.0 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/e8998f949152b193b063cb0ec769d69d929409be...4d101475d8b20a2381f78447822ac1eab6504dd8) Updates `azure/setup-helm` from 5.0.1 to 5.1.0 - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](https://github.com/azure/setup-helm/compare/9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310...2f5e7bc67f1f9972ab16657bb795f36d8f04de0e) Updates `dtolnay/rust-toolchain` from 2c7215f132e9ebf062739d9130488b56d53c060c to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/2c7215f132e9ebf062739d9130488b56d53c060c...683b588c487a69d01f6c6ddf40f036ff682cc2c8) Updates `Swatinem/rust-cache` from e18b497796c12c097a38f9edb9d0641fb99eee32 to c8037a86dde8214a8310e9f54a8fc61ab362aa31 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](https://github.com/swatinem/rust-cache/compare/e18b497796c12c097a38f9edb9d0641fb99eee32...c8037a86dde8214a8310e9f54a8fc61ab362aa31) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: azure/setup-helm dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dtolnay/rust-toolchain dependency-version: 683b588c487a69d01f6c6ddf40f036ff682cc2c8 dependency-type: direct:production dependency-group: actions - dependency-name: Swatinem/rust-cache dependency-version: c8037a86dde8214a8310e9f54a8fc61ab362aa31 dependency-type: direct:production dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/agent.yml | 10 +++++----- .github/workflows/chart.yml | 2 +- .github/workflows/rust.yml | 22 +++++++++++----------- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/agent.yml b/.github/workflows/agent.yml index 5fd2dcc..05ff498 100644 --- a/.github/workflows/agent.yml +++ b/.github/workflows/agent.yml @@ -63,7 +63,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Log into registry if: github.event_name != 'pull_request' - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -79,7 +79,7 @@ jobs: type=semver,pattern={{version}} type=raw,value=latest,enable={{is_default_branch}} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 with: driver: remote endpoint: tcp://buildkit.dev.svc.cluster.local:1234 @@ -106,7 +106,7 @@ jobs: # build — a no-op observer — exists only for toolchain-free local dev/test. - name: Build and push agent image id: build-and-push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: # Repo root: the agent's userspace crate path-depends on ../../behavior (the # shared wire crate outside agent/), so the Dockerfile copies agent/ + behavior/. @@ -143,7 +143,7 @@ jobs: sbom: true - name: Install cosign if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') }} - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 - name: Sign the published image if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') }} env: @@ -158,7 +158,7 @@ jobs: # `provenance: true` above is the unsigned variant the observer never reads. - name: Attest build provenance (Sigstore-signed SLSA) if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/v') }} - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build-and-push.outputs.digest }} diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml index 8ecb64a..77ad2ea 100644 --- a/.github/workflows/chart.yml +++ b/.github/workflows/chart.yml @@ -21,7 +21,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # First-party (Microsoft) Helm installer, pinned by commit SHA. - - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 + - uses: azure/setup-helm@2f5e7bc67f1f9972ab16657bb795f36d8f04de0e # v5.1.0 with: version: v3.18.4 - name: Helm lint diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 11e5376..ffb1731 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -53,11 +53,11 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # stable with: toolchain: stable components: clippy, rustfmt - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2 with: # A stable shared-key (replacing the per-job default) keeps target/ warm across # runs AND shared with the `test` job, so cargo fingerprint-skips unchanged deps @@ -84,7 +84,7 @@ jobs: # ("sccache: Timed out waiting for server startup") instead of just costing # a cold-cache build. run: bash .github/scripts/start-sccache.sh - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" - name: Build dashboard bundle @@ -139,10 +139,10 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable + - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # stable with: toolchain: stable - - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + - uses: Swatinem/rust-cache@c8037a86dde8214a8310e9f54a8fc61ab362aa31 # v2 with: # Same shared-key as `lint` so both jobs restore the one warm target/. shared-key: protector @@ -154,7 +154,7 @@ jobs: # Same rationale as the lint job's step: probe R2 before the first cargo # invocation below, degrade to a local disk cache rather than hard-failing. run: bash .github/scripts/start-sccache.sh - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "22" - name: Build dashboard bundle @@ -216,7 +216,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Log into registry if: github.event_name != 'pull_request' - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 + uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -233,7 +233,7 @@ jobs: type=semver,pattern={{version}} type=raw,value=latest,enable={{is_default_branch}} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 with: driver: remote endpoint: tcp://buildkit.dev.svc.cluster.local:1234 @@ -254,7 +254,7 @@ jobs: - key=/home/runner/buildkit-certs/tls.key - name: Build and push Docker image id: build-and-push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7 with: context: . # Multi-arch: buildx builds each arch on its native builder (amd64 on buildkit, @@ -288,7 +288,7 @@ jobs: # a bare curl|chmod of a release asset. - name: Install cosign if: ${{ github.event_name != 'pull_request' }} - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} env: @@ -306,7 +306,7 @@ jobs: # the observer (which reads signed signature/referrer layers) never sees. - name: Attest build provenance (Sigstore-signed SLSA) if: ${{ github.event_name != 'pull_request' }} - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build-and-push.outputs.digest }}