From 33da9ec0bb619d4e8fba43e624f5420c9c32c15f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 26 Jan 2025 23:12:23 +0000 Subject: [PATCH] chore(deps): bump the ci group with 4 updates Bumps the ci group with 4 updates: [dcarbone/install-jq-action](https://github.com/dcarbone/install-jq-action), [thollander/actions-comment-pull-request](https://github.com/thollander/actions-comment-pull-request), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `dcarbone/install-jq-action` from 2.1.0 to 3.0.1 - [Release notes](https://github.com/dcarbone/install-jq-action/releases) - [Commits](https://github.com/dcarbone/install-jq-action/compare/v2.1.0...v3.0.1) Updates `thollander/actions-comment-pull-request` from 2.5.0 to 3.0.1 - [Release notes](https://github.com/thollander/actions-comment-pull-request/releases) - [Commits](https://github.com/thollander/actions-comment-pull-request/compare/v2.5.0...v3.0.1) Updates `anchore/sbom-action` from 0.16.0 to 0.18.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e8d2a6937ecead383dfe75190d104edd1f9c5751...f325610c9f50a54015d37c8d16cb3b0e2c8f4de0) Updates `sigstore/cosign-installer` from 3.5.0 to 3.7.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/v3.5.0...v3.7.0) --- updated-dependencies: - dependency-name: dcarbone/install-jq-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: thollander/actions-comment-pull-request dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] --- .github/workflows/mend_scan.yaml | 4 ++-- .github/workflows/release.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/mend_scan.yaml b/.github/workflows/mend_scan.yaml index 6b795a3..74387dc 100644 --- a/.github/workflows/mend_scan.yaml +++ b/.github/workflows/mend_scan.yaml @@ -42,7 +42,7 @@ jobs: go-version-file: '${{ github.workspace }}/go.mod' - name: 'Setup jq' - uses: dcarbone/install-jq-action@v2.1.0 + uses: dcarbone/install-jq-action@v3.0.1 with: version: '1.7' @@ -180,7 +180,7 @@ jobs: - name: Comment Mend Status on PR if: ${{ github.event_name != 'schedule' && steps.pr_exists.outputs.pr_found == 'true' }} - uses: thollander/actions-comment-pull-request@v2.5.0 + uses: thollander/actions-comment-pull-request@v3.0.1 with: message: | ## Mend Scan Summary: :${{ steps.report.outputs.status }}: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6d140a4..003e055 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -98,9 +98,9 @@ jobs: mkdir -p output kustomize build ./config/default > ./output/install.yaml - name: Setup Syft - uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0 + uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0 - name: Setup Cosign - uses: sigstore/cosign-installer@v3.5.0 + uses: sigstore/cosign-installer@v3.7.0 - name: Run goreleaser uses: goreleaser/goreleaser-action@v6 with: