Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[]: sync from openssf #507

Closed
wants to merge 89 commits into from
Closed

[]: sync from openssf #507

wants to merge 89 commits into from

Conversation

karankohli-cf
Copy link

No description provided.

dependabot bot and others added 30 commits September 21, 2023 09:42
@dependabot
Bump ossf/scorecard-action from 2.1.3 to 2.2.0
f758788 
Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.3 to 2.2.0.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@v2.1.3...v2.2.0)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
Bump sigstore/cosign-installer from 3.0.5 to 3.1.2
3dcbfcd 
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.0.5 to 3.1.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@dd6b2e2...11086d2)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
Bump gocloud.dev from 0.29.0 to 0.34.0
4f23879 
Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.29.0 to 0.34.0.
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](google/go-cloud@v0.29.0...v0.34.0)

---
updated-dependencies:
- dependency-name: gocloud.dev
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@roryscarson
add codeowners and sast
8701b22
@roryscarson
add codeowners
11607e8
@roryscarson
add vault-secrets
e10700d
@roryscarson
Merge pull request #11 from contentful/init
859e2fa 
[]add codeowners and sast
@roryscarson
Merge pull request #1 from contentful/dependabot/github_actions/ossf/…
6c157d8 
…scorecard-action-2.2.0

Bump ossf/scorecard-action from 2.1.3 to 2.2.0
@dependabot
Bump actions/checkout from 3 to 4
541dde2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@roryscarson
Merge pull request #10 from contentful/dependabot/go_modules/gocloud.…
3bbfa80 
…dev-0.34.0

Bump gocloud.dev from 0.29.0 to 0.34.0
@roryscarson
Merge pull request #2 from contentful/dependabot/github_actions/actio…
4bf923b 
…ns/checkout-4

Bump actions/checkout from 3 to 4
@roryscarson
Merge pull request #3 from contentful/dependabot/github_actions/sigst…
d268fc7 
…ore/cosign-installer-3.1.2

Bump sigstore/cosign-installer from 3.0.5 to 3.1.2
@karankohli-cf
[]: Update CODEOWNERS
f44c8c5 
testing if this strategy works

Signed-off-by: karankohli-cf <[email protected]>
@karankohli-cf
Update CODEOWNERS
5324e82 
Signed-off-by: karankohli-cf <[email protected]>
@karankohli-cf
Update CODEOWNERS
bbe3e1c 
Signed-off-by: karankohli-cf <[email protected]>
@karankohli-cf
Merge pull request #12 from contentful/karankohli-cf-patch-1
6b9d094 
[]: Update CODEOWNERS
@roryscarson
remove unneeded docs
6a0d364
@roryscarson
Merge pull request #13 from contentful/cleanup
55fd894 
remove unneeded docs
@karankohli-cf
dockerfile
69b1092
@karankohli-cf
gha
0a82d2f
@karankohli-cf
Merge pull request #16 from contentful/docker
495e56d 
[]: Add dockerfile
@dependabot
Bump docker/metadata-action from 3.3.0 to 5.0.0
5482a6f 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 3.3.0 to 5.0.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md)
- [Commits](docker/metadata-action@98669ae...96383f4)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
Bump actions/checkout from 3 to 4
441c361 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
Bump docker/login-action from 1.10.0 to 3.0.0
143c1a6 
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.10.0 to 3.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@f054a8b...343f7c4)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
Bump docker/build-push-action from 2.5.0 to 5.0.0 (#17)
303d55f 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.5.0 to 5.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@ad44023...0565240)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@roryscarson
[SEC-3230]Update Allstar Documentation
9de5e3d
@dependabot
Bump github.com/rs/zerolog from 1.29.1 to 1.31.0 (#22)
7233d6a 
Bumps [github.com/rs/zerolog](https://github.com/rs/zerolog) from 1.29.1 to 1.31.0.
- [Release notes](https://github.com/rs/zerolog/releases)
- [Commits](rs/zerolog@v1.29.1...v1.31.0)

---
updated-dependencies:
- dependency-name: github.com/rs/zerolog
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@roryscarson
add opt out strategy
d738600
@roryscarson
Merge pull request #21 from contentful/sec-3230
9f45f82 
[SEC-3230]Update Allstar Documentation
@roryscarson
[SEC-3232]Add template and remove old deployment stuff
134d501
karankohli-cf and others added 28 commits November 2, 2023 16:53
@karankohli-cf
fix tests finally
5e8418b
@karankohli-cf
fix tests finally
42729cd
@karankohli-cf
Update catalog.go
813cab1 
Signed-off-by: karankohli-cf <[email protected]>
@hkhrais
Merge pull request #31 from contentful/sec-3237
0dcea0d 
[SEC-3237]Add catalog test
@dependabot
Bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (#50)
b1aad08 
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.3 to 1.3.7.
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.3...v1.3.7)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github/codeql-action from 2 to 3 (#52)
f69072c 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v2...v3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/upload-artifact from 3 to 4 (#53)
266a6f5 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3 to 4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v3...v4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/evanphx/json-patch (#54)
8c2488b 
Bumps [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) from 5.6.0+incompatible to 5.8.0+incompatible.
- [Release notes](https://github.com/evanphx/json-patch/releases)
- [Commits](evanphx/json-patch@v5.6.0...v5.8.0)

---
updated-dependencies:
- dependency-name: github.com/evanphx/json-patch
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/evanphx/json-patch (#55)
2d260e8 
Bumps [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) from 5.8.0+incompatible to 5.8.1+incompatible.
- [Release notes](https://github.com/evanphx/json-patch/releases)
- [Commits](evanphx/json-patch@v5.8.0...v5.8.1)

---
updated-dependencies:
- dependency-name: github.com/evanphx/json-patch
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump actions/dependency-review-action from 3 to 4 (#56)
41660ce 
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3 to 4.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@v3...v4)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@karankohli-cf
chore: add docker in package-ecosystem
bfed946 
Signed-off-by: karankohli-cf <[email protected]>
@karankohli-cf
Merge pull request #57 from contentful/chore/docker-dependabot
207645f 
chore: add docker in package-ecosystem []
@dependabot
Bump github.com/evanphx/json-patch (#59)
567539b 
Bumps [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) from 5.8.1+incompatible to 5.9.0+incompatible.
- [Release notes](https://github.com/evanphx/json-patch/releases)
- [Commits](evanphx/json-patch@v5.8.1...v5.9.0)

---
updated-dependencies:
- dependency-name: github.com/evanphx/json-patch
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump docker/metadata-action from 5.0.0 to 5.5.1 (#60)
8feb635 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.0.0 to 5.5.1.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@96383f4...8e5442c)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump github.com/rs/zerolog from 1.31.0 to 1.32.0 (#61)
a05002f 
Bumps [github.com/rs/zerolog](https://github.com/rs/zerolog) from 1.31.0 to 1.32.0.
- [Release notes](https://github.com/rs/zerolog/releases)
- [Commits](rs/zerolog@v1.31.0...v1.32.0)

---
updated-dependencies:
- dependency-name: github.com/rs/zerolog
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @roryscarson
build(deps): bump golang from 1.20 to 1.21 (#58)
b3cdbd3 
Bumps golang from 1.20 to 1.21.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rory Carson <[email protected]>
@dependabot
build(deps): bump golangci/golangci-lint-action from 3 to 4 (#63)
5ae0d60 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3 to 4.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@v3...v4)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/rhysd/actionlint from 1.6.24 to 1.6.27 (#64
58ff794 
)

Bumps [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) from 1.6.24 to 1.6.27.
- [Release notes](https://github.com/rhysd/actionlint/releases)
- [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md)
- [Commits](rhysd/actionlint@v1.6.24...v1.6.27)

---
updated-dependencies:
- dependency-name: github.com/rhysd/actionlint
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@roryscarson
Create catalog-info.yaml
619fc04 
Signed-off-by: Rory Carson <[email protected]>
@roryscarson
Merge pull request #65 from contentful/catalog-info
4521f4a 
Create catalog-info.yaml
@dependabot
build(deps): bump docker/build-push-action from 5.0.0 to 5.2.0 (#66)
a7c7822 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.0.0 to 5.2.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@0565240...af5a7ed)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump gocloud.dev from 0.34.0 to 0.37.0 (#67)
c8e37e4 
Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.37.0.
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](google/go-cloud@v0.34.0...v0.37.0)

---
updated-dependencies:
- dependency-name: gocloud.dev
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/login-action from 3.0.0 to 3.1.0 (#68)
27af21a 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@343f7c4...e92390c)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/build-push-action from 5.2.0 to 5.3.0 (#69)
c94fec5 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.2.0 to 5.3.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@af5a7ed...2cdde99)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/bradleyfalzon/ghinstallation/v2 (#70)
633fb24 
Bumps [github.com/bradleyfalzon/ghinstallation/v2](https://github.com/bradleyfalzon/ghinstallation) from 2.4.0 to 2.10.0.
- [Release notes](https://github.com/bradleyfalzon/ghinstallation/releases)
- [Commits](bradleyfalzon/ghinstallation@v2.4.0...v2.10.0)

---
updated-dependencies:
- dependency-name: github.com/bradleyfalzon/ghinstallation/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @karankohli-cf
build(deps): bump golang from 1.21 to 1.22 (#62)
336a854 
Bumps golang from 1.21 to 1.22.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: karankohli-cf <[email protected]>
@karankohli-cf
add to dockerfile
520c18c
@karankohli-cf
push changes
b9618cd
@karankohli-cf karankohli-cf deleted the sync branch June 10, 2024 12:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@karankohli-cf @roryscarson @hkhrais