Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update github-actions (major) #358

Merged
merged 3 commits into from
Oct 21, 2024
Merged

chore(deps): update github-actions (major) #358

merged 3 commits into from
Oct 21, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 20, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
docker/build-push-action action major v5.4.0 -> v6.9.0
google-github-actions/release-please-action action major v3.7.13 -> v4.1.1
gradle/actions action major v3.5.0 -> v4.1.0
lycheeverse/lychee-action action major v1.10.0 -> v2.0.2
oxsecurity/megalinter action major v7.13.0 -> v8.1.0
peter-evans/create-pull-request action major v6.1.0 -> v7.0.5
ubuntu github-runner major 22.04 -> 24.04

Release Notes

docker/build-push-action (docker/build-push-action)

v6.9.0

Compare Source

Full Changelog: docker/build-push-action@v6.8.0...v6.9.0

v6.8.0

Compare Source

Full Changelog: docker/build-push-action@v6.7.0...v6.8.0

v6.7.0

Compare Source

v6.6.1

Compare Source

Full Changelog: docker/build-push-action@v6.6.0...v6.6.1

v6.6.0

Compare Source

v6.5.0

Compare Source

v6.4.1

Compare Source

v6.4.0

Compare Source

Full Changelog: docker/build-push-action@v6.3.0...v6.4.0

v6.3.0

Compare Source

Full Changelog: docker/build-push-action@v6.2.0...v6.3.0

v6.2.0

Compare Source

Full Changelog: docker/build-push-action@v6.1.0...v6.2.0

v6.1.0

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

google-github-actions/release-please-action (google-github-actions/release-please-action)

v4.1.1

Compare Source

Bug Fixes

v4.1.0

Compare Source

Features

v4.0.3

Compare Source

Bug Fixes

v4.0.2

Compare Source

Bug Fixes

v4.0.1

Compare Source

Bug Fixes

v4.0.0

Compare Source

gradle/actions (gradle/actions)

v4.1.0

Compare Source

This release brings some minor improvements:

  • The latest release of Gradle is no longer required to perform cache-cleanup. If Gradle is found to on the PATH and the version meets minimum version requirements, then the version on PATH is used for cache-cleanup and Gradle is not downloaded.
  • Fixes a bug where setting the develocity-token-expiry parameter had no effect (#​381)
  • Numerous NPM dependency updates

Full Changelog: gradle/actions@v4.0.1...v4.1.0

v4.0.1

Compare Source

This patch release updates a number of dependencies, and fixes a bug that caused Gradle version '8.1' to be confused with '8.10'.

What's Changed

Full Changelog: gradle/actions@v4.0.0...v4.0.1

v4.0.0

Compare Source

Final release of v4.0.0 of the setup-gradle, dependency-submission and wrapper-validation actions provided under gradle/actions.
This release is available under the v4 tag.

Major changes from the v3 release
The arguments parameter has been removed

Using the action to execute Gradle via the arguments parameter was deprecated in v3 and this parameter has been removed.
See here for more details.

Cache cleanup enabled by default

After a number of fixes and improvements, this release enables cache-cleanup by default for all Jobs using the setup-gradle and dependency-submission actions.

Improvements and bugfixes related cache cleanup:

  • By default, cache cleanup is not run if any Gradle build fails (#​71)
  • Cache cleanup is not run after configuration-cache reuse (#​19)

This feature should help to minimize the size of entries written to the GitHub Actions cache, speeding up builds and reducing cache usage.

Wrapper validation enabled by default

In v3, the setup-gradle action was enhanced to support Gradle wrapper validation, removing the need to use a separate workflow
file with the gradle/actions/wrapper-validation action.

With this release, wrapper validation has been significantly improved, and is now enabled by default (#​12):

  • The allow-snapshot-wrappers makes it possible to validate snapshot wrapper jars using setup-gradle.
  • Checksums for nightly and snapshot Gradle versions are now validated (#​281).
  • Valid wrapper checksums are cached in Gradle User Home, reducing the need to retrieve checksum values remotely (#​172).
  • Reduce network calls in wrapper-validation for new Gradle versions: By only fetching wrapper checksums for Gradle versions that were not known when this action was released, this release reduces the likelihood that a network failure could cause failure in wrapper validation (#​171)
  • Improved error message when wrapper-validation finds no wrapper jars (#​284)

Wrapper validation is important for supply-chain integrity. Enabling this feature by default will increase the coverage of wrapper
validation on projects using GitHub Actions.

New input parameters for Dependency Graph generation

Some dependency-graph inputs that could previously only be configured via environment variables now have dedicated action inputs:

Other improvements
  • In Job summary, the action now provides an explanation when cache is set to read-only or disabled (#​255)
  • When setup-gradle requests a specific Gradle version, the action will no longer download and install that version if it is already available on the PATH of the runner (#​270)
  • To attempt to speed up builds, the setup-gradle and dependency-submission actions now attempt to use the D: drive for Gradle User Home if it is available (#​290)
Deprecations and breaking changes
Changelog

Full Changelog: gradle/actions@v3.5.0...v4.0.0

lycheeverse/lychee-action (lycheeverse/lychee-action)

v2.0.2: Version 2.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v2...v2.0.2

v2.0.1: Version 2.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v2...v2.0.1

v2.0.0: Version 2.0.0

Compare Source

Breaking Changes

Note: This release improves the action's robustness by changing default behaviors. Changes are only required if you want to opt out of the new failure conditions. Most users won't need to modify their existing configurations.

Fail pipeline on error by default

We've changed the default behavior: pipelines will now fail on broken links automatically. This addresses user feedback that not failing on broken links was unexpected (see issue #​71).

What you need to do:

  • Update to version 2 of this action to apply this change.
  • Users of the lychee-action@master branch don't need to make any changes, as fail: true has been the default there for a while.
  • If you prefer the old behavior, explicitly set fail to false when updating:
- name: Link Checker
  id: lychee
  uses: lycheeverse/lychee-action@v2
  with:
    fail: false  # Don't fail action on broken links
Fail pipeline if no links were found

Similar to the above change, we now fail the pipeline if no links are found during a run. This helps warn users about potential configuration issues.

What you need to do:

  • If you expect links to be found in your pipeline run, you don't need to do anything.
  • If you expect no links in your pipeline run, you can opt out like this:
- name: Link Checker
  id: lychee
  uses: lycheeverse/lychee-action@v2
  with:
    failIfEmpty: false  # Don't fail action if no links were found

For a more detailed description of the technical aspects behind these changes, please see the full changelog below.

What's Changed

New Contributors

Full Changelog: lycheeverse/lychee-action@v1...v1.11.0

oxsecurity/megalinter (oxsecurity/megalinter)

v8.1.0

Compare Source

  • Core

    • Allow to tag PRE_COMMANDS to run them before loading plugins, by @​nvuillam in #​3944
    • Replace usage of setup.py with a pyproject.toml package install, by @​echoix in #​3893
    • Allow to add custom messages at the end of PR / MR MegaLinter Summary using variable JOB_SUMMARY_ADDITIONAL_MARKDOWN

  • New linters

  • Linters enhancements

    • Trivy
      • Embed vulnerability database in Docker Image for running trivy on internet-free network
      • Retry 5 times after 3 seconds in case of TooManyRequests when downloading vulnerability database
      • If the retries did not succeed, call trivy with --skip-db-update --skip-check-update (not ideal but better than nothing)
    • Bash/Perl: Support shell scripts with no extension and only support perl shebangs at the beginning of a file in #​4076

  • Fixes

    • Add debug traces to investigate reporters activation
    • Add more traces for ApiReporter
    • Activate ApiReporter by default

  • Reporters

    • Fix ApiReporter not called in MegaLinter flavors

  • Doc

    • Fix Grafana Home Dashboard to add missing criteria
    • Update PRE_COMMANDS documentation to describe all properties
    • Update Grafana documentation to fix secrets typo

  • CI

    • Free space in release job to avoid no space left on device, by @​nvuillam in #​3914
    • Add pytest-rerunfailures to improve CI control jobs success, by @​AlejandroSuero in #​3993
    • Send GITHUB_TOKEN to trivy-action
    • Workaround to avoid to reach Docker Hub rate limits: Build & push first on ghcr.io, then login to docker hub, then push to docker hub

  • Linter versions upgrades

    • actionlint from 1.7.1 to 1.7.3 on 2024-09-29
    • ansible-lint from 24.7.0 to 24.9.2 on 2024-09-20
    • bandit from 1.7.9 to 1.7.10 on 2024-09-23
    • bicep_linter from 0.29.47 to 0.30.23 on 2024-09-24
    • black from 24.8.0 to 24.10.0 on 2024-10-07
    • cfn-lint from 1.10.3 to 1.16.1 on 2024-10-11
    • checkov from 3.2.232 to 3.2.257 on 2024-10-06
    • checkstyle from 10.17.0 to 10.18.2 on 2024-09-29
    • clippy from 0.1.80 to 0.1.81 on 2024-09-06
    • clj-kondo from 2024.08.01 to 2024.09.27 on 2024-09-26
    • cpplint from 1.6.1 to 2.0.0 on 2024-10-06
    • csharpier from 0.29.0 to 0.29.2 on 2024-09-16
    • cspell from 8.14.1 to 8.15.1 on 2024-10-11
    • detekt from 1.23.6 to 1.23.7 on 2024-09-08
    • djlint from 1.34.1 to 1.35.2 on 2024-08-29
    • dotnet-format from 8.0.108 to 8.0.110 on 2024-10-11
    • eslint from 8.57.0 to 8.57.1 on 2024-09-16
    • gitleaks from 8.18.4 to 8.20.1 on 2024-10-08
    • golangci-lint from 1.60.1 to 1.61.0 on 2024-09-09
    • kics from 2.1.2 to 2.1.3 on 2024-10-04
    • lightning-flow-scanner from 2.33.0 to 2.34.0 on 2024-08-25
    • lychee from 0.15.1 to 0.16.1 on 2024-10-07
    • markdownlint from 0.41.0 to 0.42.0 on 2024-09-24
    • mypy from 1.11.1 to 1.11.2 on 2024-08-25
    • npm-groovy-lint from 14.6.0 to 15.0.2 on 2024-08-29
    • php-cs-fixer from 3.62.0 to 3.64.0 on 2024-08-31
    • phpcs from 3.10.2 to 3.10.3 on 2024-09-20
    • phplint from 9.4.1 to 9.5.3 on 2024-10-11
    • phpstan from 1.11.11 to 1.12.6 on 2024-10-06
    • pmd from 7.4.0 to 7.6.0 on 2024-09-27
    • psalm from Psalm.5.25.0@​ to Psalm.5.26.1@​ on 2024-09-09
    • pylint from 3.2.6 to 3.3.1 on 2024-09-24
    • pyright from 1.1.376 to 1.1.384 on 2024-10-11
    • revive from 1.3.9 to 1.4.0 on 2024-09-23
    • roslynator from 0.8.9.0 to 0.9.1.0 on 2024-10-11
    • rubocop from 1.65.1 to 1.66.1 on 2024-09-06
    • ruff from 0.6.1 to 0.6.9 on 2024-10-04
    • scalafix from 0.12.1 to 0.13.0 on 2024-09-27
    • secretlint from 8.2.4 to 8.4.0 on 2024-10-06
    • sfdx-scanner-apex from 4.4.0 to 4.6.0 on 2024-09-26
    • sfdx-scanner-aura from 4.4.0 to 4.6.0 on 2024-09-26
    • sfdx-scanner-lwc from 4.4.0 to 4.6.0 on 2024-09-26
    • shfmt from 3.8.0 to 3.9.0 on 2024-09-03
    • snakemake from 8.18.1 to 8.21.0 on 2024-10-13
    • spectral from 6.11.1 to 6.13.1 on 2024-09-21
    • sqlfluff from 3.1.0 to 3.2.3 on 2024-10-11
    • standard from 17.1.0 to 17.1.2 on 2024-09-13
    • stylelint from 16.8.2 to 16.10.0 on 2024-10-11
    • swiftlint from 0.56.1 to 0.57.0 on 2024-09-09
    • syft from 1.11.0 to 1.14.0 on 2024-10-07
    • terraform-fmt from 1.9.4 to 1.9.5 on 2024-08-28
    • terragrunt from 0.66.8 to 0.67.5 on 2024-09-16
    • terrascan from 1.18.11 to 1.19.9 on 2024-09-21
    • trivy-sbom from 0.54.1 to 0.56.2 on 2024-10-11
    • trivy from 0.54.1 to 0.56.2 on 2024-10-11
    • trufflehog from 3.81.10 to 3.82.8 on 2024-10-13
    • v8r from 4.0.1 to 4.1.0 on 2024-08-25
    • vale from 3.7.0 to 3.7.1 on 2024-09-26

v8.0.0

Compare Source

Upgrade to v8 Video

peter-evans/create-pull-request (peter-evans/create-pull-request)

v7.0.5: Create Pull Request v7.0.5

Compare Source

⚙️ Fixes an issue with commit signing to allow it to support symlinks

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.4...v7.0.5

v7.0.4: Create Pull Request v7.0.4

Compare Source

⚙️ Fixes an issue with commit signing to allow it to support submodules

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v7.0.3...v7.0.4

v7.0.3: Create Pull Request v7.0.3

Compare Source

⚙️ Fixes an issue with commit signing where commit SHAs have variable lengths when abbreviated.

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.2...v7.0.3

v7.0.2: Create Pull Request v7.0.2

Compare Source

⚙️ Fixes an issue with commit signing when a change was detected as being a rename or copy.

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.1...v7.0.2

v7.0.1: Create Pull Request v7.0.1

Compare Source

⚙️ Fixes an issue affecting one particular use case where the action fails on diff --stat with fatal: ambiguous argument.

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.0...v7.0.1

v7.0.0: Create Pull Request v7.0.0

Compare Source

✨ Now supports commit signing with bot-generated tokens! See "What's new" below. ✍️🤖

Behaviour changes
  • Action input git-token has been renamed branch-token, to be more clear about its purpose. The branch-token is the token that the action will use to create and update the branch.
  • The action now handles requests that have been rate-limited by GitHub. Requests hitting a primary rate limit will retry twice, for a total

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions GitHub Actions
Copy link

github-actions bot commented Oct 20, 2024 •
edited
Loading

🦙 MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Elapsed time
✅ ACTION actionlint 18 0 0.22s
✅ BASH bash-exec 5 0 0.02s
✅ BASH shellcheck 2 0 0.11s
⚠️ BASH shfmt 5 1 0.01s
⚠️ CSHARP csharpier 1 1 1.29s
⚠️ CSHARP dotnet-format yes 1 0.82s
✅ CSHARP roslynator 1 0 20.22s
✅ CSS stylelint 1 0 1.64s
✅ DOCKERFILE hadolint 4 0 0.22s
✅ EDITORCONFIG editorconfig-checker 378 0 4.32s
✅ ENV dotenv-linter 1 0 0.01s
✅ GROOVY npm-groovy-lint 7 0 15.04s
✅ HTML djlint 2 0 1.37s
✅ HTML htmlhint 2 0 0.3s
✅ JAVA checkstyle 59 0 6.88s
✅ JSON jsonlint 31 0 0.33s
⚠️ JSON prettier 31 1 4.51s
✅ JSON v8r 31 0 83.9s
⚠️ MARKDOWN markdownlint 22 190 1.67s
✅ PYTHON bandit 1 0 1.12s
✅ PYTHON black 1 0 0.79s
✅ PYTHON flake8 1 0 0.57s
✅ PYTHON isort 1 0 0.35s
✅ PYTHON mypy 1 0 8.49s
✅ PYTHON ruff 1 0 0.03s
✅ REPOSITORY checkov yes no 21.89s
✅ REPOSITORY gitleaks yes no 2.21s
✅ REPOSITORY git_diff yes no 0.14s
✅ REPOSITORY kics yes no 57.9s
✅ REPOSITORY secretlint yes no 2.03s
✅ REPOSITORY syft yes no 3.53s
❌ REPOSITORY trivy yes 1 21.2s
✅ REPOSITORY trivy-sbom yes no 1.46s
✅ REPOSITORY trufflehog yes no 5.02s
✅ XML xmllint 3 0 0.01s
✅ YAML prettier 111 0 2.83s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

MegaLinter is graciously provided by OX Security

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Oct 21, 2024

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@chgl chgl merged commit bc58e8b into master Oct 21, 2024
9 of 13 checks passed
@miracum-bot miracum-bot mentioned this pull request Oct 21, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@chgl