Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump actions/upload-artifact from 4.3.0 to 4.4.3 #9715

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 10, 2024

Bumps actions/upload-artifact from 4.3.0 to 4.4.3.

Release notes

Sourced from actions/upload-artifact's releases.

v4.4.3

What's Changed

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

What's Changed

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

v4.4.0

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

Full Changelog: actions/upload-artifact@v4.3.6...v4.4.0

v4.3.6

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.3.6

v4.3.5

What's Changed

... (truncated)

Commits
  • b4b15b8 Merge pull request #632 from actions/joshmgross/undo-dependency-changes
  • 92b01eb Undo indirect dependency updates from #627
  • 8448086 Merge pull request #627 from actions/robherley/v4.4.2
  • b1d4642 add explicit relative and absolute symlinks to workflow
  • d50e660 bump version
  • aabe6f8 build with @​actions/artifact v2.1.11
  • 604373d Merge pull request #625 from actions/robherley/artifact-2.1.10
  • 0150148 paste right core version
  • a009b25 update licenses
  • 9f6f6f4 update @​actions/core and @​actions/artifact to latest versions
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.3.0 to 4.4.3.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.3.0...b4b15b8)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from moabu as a code owner October 10, 2024 10:37
@dependabot dependabot bot added github_actions Pull requests that update Github_actions code kind-dependencies Pull requests that update a dependency file labels Oct 10, 2024
Copy link

DryRun Security Summary

The pull request updates the version of the actions/upload-artifact GitHub Action in two workflows, one for Scorecard security analysis and another for testing the Jans Project's Linux installer, which includes good security practices like GPG key management, runner hardening, and comprehensive testing.

Expand for full summary

Summary:

The code changes in this pull request are focused on updating the version of the actions/upload-artifact GitHub Action used in two separate GitHub Actions workflows. These workflows are responsible for running the Scorecard security analysis and testing the Jans Project's Linux installer.

The Scorecard analysis workflow updates the actions/upload-artifact action from version v4.4.0 to v4.4.3, which is a minor version update that typically includes bug fixes and improvements. This change does not introduce any significant security concerns.

The workflow for testing the Linux installer also updates the actions/upload-artifact action, but the overall workflow demonstrates good security practices, such as GPG key management, runner hardening, and comprehensive testing across different persistence backends. These practices help ensure the security and reliability of the Jans Project's Linux installer.

Files Changed:

  1. .github/workflows/scorecard.yml:

    • The changes update the version of the actions/upload-artifact action from v4.4.0 to v4.4.3.
    • The file defines the GitHub Actions workflow for the Scorecard analysis, which checks the security posture of the open-source project.
  2. .github/workflows/test_docker_linux_installer.yml:

    • The changes update the version of the actions/upload-artifact action used in the workflow.
    • The workflow includes security-conscious practices, such as GPG key management, runner hardening, and comprehensive testing of the Jans monolith demo across different persistence backends.

Overall, the changes in this pull request are minor and do not introduce any immediate security concerns. The workflows demonstrate a focus on maintaining the security and reliability of the Jans Project's codebase.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
github_actions Pull requests that update Github_actions code kind-dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants