Skip to content

ci: bump the github-actions group with 8 updates #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump the github-actions group with 8 updates #235

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 1, 2025 •
edited
Loading

Bumps the github-actions group with 8 updates:

Package From To
github/codeql-action 3.27.6 3.28.0
python-semantic-release/python-semantic-release 9.15.1 9.15.2
hynek/build-and-inspect-python-package 2.10.0 2.11.0
softprops/action-gh-release 2.1.0 2.2.0
pypa/gh-action-pypi-publish 1.12.2 1.12.3
docker/setup-buildx-action 3.7.1 3.8.0
astral-sh/setup-uv 4.2.0 5.1.0
peter-evans/create-pull-request 7.0.5 7.0.6

Updates github/codeql-action from 3.27.6 to 3.28.0

Release notes

Sourced from github/codeql-action's releases.

v3.28.0

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.28.0 - 20 Dec 2024

  • Bump the minimum CodeQL bundle version to 2.15.5. #2655
  • Don't fail in the unusual case that a file is on the search path. #2660.

See the full CHANGELOG.md for more information.

v3.27.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.9 - 12 Dec 2024

No user facing changes.

See the full CHANGELOG.md for more information.

v3.27.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.7 - 10 Dec 2024

  • We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631
  • Update default CodeQL bundle version to 2.20.0. #2636

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.28.0 - 20 Dec 2024

  • Bump the minimum CodeQL bundle version to 2.15.5. #2655
  • Don't fail in the unusual case that a file is on the search path. #2660.

3.27.9 - 12 Dec 2024

No user facing changes.

3.27.8 - 12 Dec 2024

  • Fixed an issue where streaming the download and extraction of the CodeQL bundle did not respect proxy settings. #2624

3.27.7 - 10 Dec 2024

  • We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #2631
  • Update default CodeQL bundle version to 2.20.0. #2636

3.27.6 - 03 Dec 2024

  • Update default CodeQL bundle version to 2.19.4. #2626

3.27.5 - 19 Nov 2024

No user facing changes.

3.27.4 - 14 Nov 2024

No user facing changes.

3.27.3 - 12 Nov 2024

No user facing changes.

3.27.2 - 12 Nov 2024

  • Fixed an issue where setting up the CodeQL tools would sometimes fail with the message "Invalid value 'undefined' for header 'authorization'". #2590

3.27.1 - 08 Nov 2024

... (truncated)

Commits
  • 48ab28a Merge pull request #2662 from github/update-v3.28.0-d01b25e64
  • 4946b76 Update changelog for v3.28.0
  • d01b25e Merge pull request #2660 from github/henrymercer/fix-error-file-on-path
  • 7d6d36c Add changelog note
  • b58f447 Use @actions/io to locate binaries
  • 64cc90b Merge pull request #2653 from github/dependabot/npm_and_yarn/npm-61c837125e
  • d8f8eca Merge branch 'main' into dependabot/npm_and_yarn/npm-61c837125e
  • 562042d Merge pull request #2655 from github/aeisenberg/deprecate-2.14
  • beed6ff Change codeql version used in test
  • 5f0a4d3 Bump the minimum supported version of CodeQL to 2.15.5
  • Additional commits viewable in compare view

Updates python-semantic-release/python-semantic-release from 9.15.1 to 9.15.2

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v9.15.2 (2024-12-16)

Bug Fixes

  • changelog: Ensures user rendered files are trimmed to end with a single newline (#1118, 6dfbbb0)

  • cli: Add error message of how to gather full error output (#1116, ba85532)

  • cmd-version: Enable maintenance prereleases (#864, b88108e)

  • cmd-version: Fix handling of multiple prerelease token variants & git flow merges (#1120, 8784b9a)

  • cmd-version: Fix version determination algorithm to capture commits across merged branches (#1120, 8784b9a)

  • cmd-version: Forces tag timestamp to be same time as release commit (#1117, 7898b11)

  • cmd-version: Handle multiple prerelease token variants properly (#1120, 8784b9a)

  • config: Ensure default config loads on network mounted windows environments (#1124, a64cbc9)

  • version: Remove some excessive log msgs from debug to silly level (#1120, 8784b9a)

  • version-bump: Increment based on current commit's history only (#864, b88108e)

Performance Improvements

  • cmd-version: Refactor version determination algorithm for accuracy & speed (#1120, 8784b9a)

Resolved Issues

  • #789: Fix: Version determination of 4 branch GitFlow repo
  • #861: Releasing a prerelease patch of a maintenance version
  • #1123: Default configuration fails with changelog error on windows with network mounted directory path

Detailed Changes: v9.15.1...v9.15.2

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

CHANGELOG

v9.15.2 (2024-12-16)

Bug Fixes

  • changelog: Ensures user rendered files are trimmed to end with a single newline (#1118, 6dfbbb0)

  • cli: Add error message of how to gather full error output (#1116, ba85532)

  • cmd-version: Enable maintenance prereleases (#864, b88108e)

  • test(fixtures): improve changelog generator to filter by max version

  • test(fixtures): add repo fixture of a trunk only repo w/ dual version support

  • test(fixtures): add repo fixture of a trunk only repo w/ dual version support & prereleases

  • test(cmd-version): add rebuild repo tests for new dual version support repos

  • test(version-determination): adjust unit tests of increment_version logic

This clarifies repeated function calls and pytest parameter names included the unclear assert diff. Adds additional tests to check bad states for failures and refactored to match new function signature.

  • fix(version-bump): increment based on current commit's history only

Refactor duplicate logging messages and flow to process out odd cases in a fail fast methodology. This removes the reliance on any last full release that is not within the history of the current branch.

Resolves: #861

  • cmd-version: Fix handling of multiple prerelease token variants & git flow merges (#1120, 8784b9a)

  • refactor: define a custom logging level of silly

  • fix(version): remove some excessive log msgs from debug to silly level

  • test(fixtures): refactor builder functions for version file updates

... (truncated)

Commits
  • 7b3f716 9.15.2
  • a64cbc9 fix(config): ensure default config loads on network mounted windows environme...
  • 1346637 ci(deps): bump psr/publish-action & tj-actions/changed-files action versi...
  • b88108e fix(cmd-version): enable maintenance prereleases (#864)
  • ea10354 ci(pr-wkflow): add pipeline concurrency limit for branch updates of PRs
  • a72591c test(cmd-version): limit rebuild repos to only angular in non-comprehensive t...
  • 8784b9a fix(cmd-version): fix handling of multiple prerelease token variants & git fl...
  • 6dfbbb0 fix(changelog): ensures user rendered files are trimmed to end with a single ...
  • 7898b11 fix(cmd-version): forces tag timestamp to be same time as release commit (#1117)
  • ba85532 fix(cli): add error message of how to gather full error output (#1116)
  • See full diff in compare view

Updates hynek/build-and-inspect-python-package from 2.10.0 to 2.11.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.11.0

Added

  • New output: package_version is the version of the package that was built. #152
Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.11.0

Added

  • New output: package_version is the version of the package that was built. #152

2.10.0

Changed

2.9.0

Changed

  • uv build is now used instead of the build package. Since the actual build of the packages is done by the packaging backend (the one you define in your pyproject.toml under build-system.build-backend -- for example, Setuptools or Hatchling), this should make no difference except for faster runs. #140

2.8.0 - 2024-07-25

Changed

  • Use uv's new uv cache prune --ci to only cache downloaded files. This makes the cache smaller and faster to pack/unpack. #135

Fixed

  • Turns out, the default location of uv's cache cannot be cached and actions/cache fails silently with an opaque "Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved." log message. We have moved the cache to /tmp. #135

... (truncated)

Commits

Updates softprops/action-gh-release from 2.1.0 to 2.2.0

Release notes

Sourced from softprops/action-gh-release's releases.

v2.2.0

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.1.0...v2.2.0

Changelog

Sourced from softprops/action-gh-release's changelog.

2.2.0

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

2.1.0

What's Changed

Exciting New Features 🎉

Other Changes 🔄

2.0.9

  • maintenance release with updated dependencies

2.0.8

Other Changes 🔄

2.0.7

Bug fixes 🐛

... (truncated)

Commits
  • 7b4da11 release 2.2.0
  • 64f1fa1 feat: read the release assets asynchronously (#552)
  • 9e35a64 chore(deps): bump prettier from 3.4.1 to 3.4.2 (#554)
  • 92bc83c chore(deps): bump @​types/node from 22.9.4 to 22.10.1 (#551)
  • 09f0e37 chore(deps): bump prettier from 3.3.3 to 3.4.1 (#550)
  • f138a07 chore(deps): bump @​vercel/ncc from 0.38.2 to 0.38.3 (#543)
  • 39a5683 fix(docs): clarify the default for tag_name (#544)
  • 62368ac chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 (#545)
  • 181b5bc chore(deps): bump @​types/node from 22.9.0 to 22.9.4 (#547)
  • 3284404 chore(deps): bump typescript from 5.6.3 to 5.7.2 (#548)
  • See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.12.3

✨ What's Improved

With the updates by @​woodruffw💰 and @​webknjaz💰 via #309 and #313, it is now possible to publish distribution packages that include core metadata v2.4, like those built using maturin. This is done by bumping Twine to v6.0.1 and pkginfo to v1.12.0.

📝 Docs

We've made an attempt to clarify the runtime and workflow shape that are expected to be supported for calling this action in: https://github.com/marketplace/actions/pypi-publish#Non-goals.

[!TIP] Please, let us know in the release discussion if anything still remains unclear. TL;DR always call pypi-publish once per job; don't invoke it in reusable workflows; physically move building the dists into separate jobs having restricted permissions and storing the dists as GitHub Actions artifacts; when using self-hosted runners, make sure to still use pypi-publish on a GitHub-provided infra with runs-on: ubuntu-latest, while building and testing may remain self-hosted; don't perform any other actions in the publishing job; don't call pypi-publish from composite actions.

🛠️ Internal Updates

@​br3ndonland💰 improved the container image generation automation to include Git SHA in #301. And @​woodruffw💰 added the workflow_ref context to Trusted Publishing debug logging in #305, helping us diagnose misconfigurations faster. #313 also extends the smoke test in the CI to check against the maturin-made dists. Additionally, jeepney and secretstorage transitive deps have been added to the pip constraint-based lock file, as Dependabot seems to have missed those earlier.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.2...v1.12.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​samuelcolvin💰 for nudging me to cut this release sooner and for sponsoring me via @​pydantic💰!

🔌 Shameless Plug: The other day I've made this 🦋 Bluesky 🇺🇦 FOSS Maintainers Starter Pack subscribe to read news from people like me :)

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits
  • 67339c7 📦 Only keep lower bounds @ input requirements
  • cbd6d01 📝Fix a typo in "privileges" @ README
  • 7252a9a 📝 Outline unsupported scenarios in README
  • a536fa9 📌📦 Include jeepney & secretstorage pins
  • 43caae4 💅📦 Split transitive dep constraints
  • f371c3d Merge pull request #313 from webknjaz/maintenance/metadata-2.4
  • 138a121 📌📦 Pin pkginfo to v1.12 @ runtime deps
  • ff2b051 🧪 Add a Maturin-based package to CI
  • 0a0a6ae 🧪 Allow CI to register multiple distributions
  • e7723a4 Merge pull request #309 from trail-of-forks/ww/bumptwine
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.7.1 to 3.8.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.8.0

Full Changelog: docker/setup-buildx-action@v3.7.1...v3.8.0

Commits
  • 6524bf6 Merge pull request #390 from crazy-max/buildx-cloud-latest
  • 8d5e074 chore: update generated content
  • 7199e57 make cloud prefix optional to download buildx if driver is cloud
  • db63cee Merge pull request #381 from docker/dependabot/github_actions/codecov/codecov...
  • 043ebe1 Merge pull request #389 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 686da90 chore: update generated content
  • a3d7487 Merge pull request #382 from docker/dependabot/npm_and_yarn/cross-spawn-7.0.6
  • 4dcdbce build(deps): bump @​docker/actions-toolkit from 0.39.0 to 0.48.0
  • 1a8ac74 ci: fix deprecated input for codecov-action
  • e827ebe build(deps): bump cross-spawn from 7.0.3 to 7.0.6
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 4.2.0 to 5.1.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v5.1.0 🌈 Fewer cache invalidations

Changes

This release includes less frequently invalidated caches and a fix for setting the correct VIRTUAL_ENV

🐛 Bug fixes

🚀 Enhancements

📚 Documentation

v5.0.1 🌈 The christmas elves overlooked something

Changes

With so many breaking changes so close to the end of the year we missed something.

Thank you @​ryanhiebert for quickly reporting that our new defaults fail the workflow if neither a uv.lock nor a requirements*.txt can be found. This is now a warning instead.

🐛 Bug fixes

v5.0.0 🎄 Merry Christmas - Help fastly and users by default

Changes

This christmans 🎄 release is a bit early bit still full of presents 🎁 Since we are changing some of the defaults this can lead to breaking changes, thus the major version increase.

Here are the highlights:

Default to enable-cache: true on GitHub hosted runners

Did you know that that Fastly, the company hosting PyPI, theoretically has to pay $12.5 million per month and so far have served more than 2.41 exabytes of data? image

This is why they asked us to turn on caching by default. After weighting the pros and cons we decided to automatically upload the cache to the GitHub Actions cache when running on GitHub hosted runners. You can still disable that with enable-cache: false.

I remember when I first got into actions and didn't understand all the magic. I was baffled that some actions did something behind the scenes to make everything faster. I hope with this change we help a lot of users who are don't want to or are afraid to understand what enable-cache does.

Add **/requirements*.txt to default cache-dependency-glob

If caching is enabled we automatically searched for a uv.lock file and when this changed we knew we had to refresh the cache. A lot of projects don't use this but rather the good old requirements.txt. We now automatically search for both uv.lockand requirements*.txt (this means also requirements-test.txt, requirements-dev.txt, ...) files. You can change this with cache-dependency-glob

... (truncated)

Commits
  • 887a942 Set VIRTUAL_ENV to .venv instead of .venv/bin (#210)
  • d174a24 Align use of actions/setup-python with uv docu (#207)
  • 12c852e Remove uv version from cache key (#206)
  • 180f8b4 Fix wrong cacheDependencyPathHash (#201)
  • e3fb95a Warn instead of fail for no-dependency-glob (#200)
  • 2af22b5 chore: update known checksums for 0.5.11 (#198)
  • dd57877 Auto activate venv when python-version is set (#194)
  • 85aa0bf chore: update known checksums for 0.5.10 (#196)
  • 1f2cbfa Bump @​types/node from 22.10.1 to 22.10.2 (#189)
  • 25b3ce6 chore: update known checksums for 0.5.9 (#195)
  • Additional commits viewable in compare view

Updates peter-evans/create-pull-request from 7.0.5 to 7.0.6

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.6

⚙️ Fixes an issue with commit signing where unicode characters in file paths were not preserved.

What's Changed

@dependabot
ci: bump the github-actions group with 8 updates
565e2bb 
Bumps the github-actions group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.27.6` | `3.28.0` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `9.15.1` | `9.15.2` |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `2.10.0` | `2.11.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.1.0` | `2.2.0` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.2` | `1.12.3` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.7.1` | `3.8.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `4.2.0` | `5.1.0` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.5` | `7.0.6` |


Updates `github/codeql-action` from 3.27.6 to 3.28.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@aa57810...48ab28a)

Updates `python-semantic-release/python-semantic-release` from 9.15.1 to 9.15.2
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.md)
- [Commits](python-semantic-release/python-semantic-release@a323379...7b3f716)

Updates `hynek/build-and-inspect-python-package` from 2.10.0 to 2.11.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@f01e4d0...14c7e53)

Updates `softprops/action-gh-release` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@01570a1...7b4da11)

Updates `pypa/gh-action-pypi-publish` from 1.12.2 to 1.12.3
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@15c56db...67339c7)

Updates `docker/setup-buildx-action` from 3.7.1 to 3.8.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@c47758b...6524bf6)

Updates `astral-sh/setup-uv` from 4.2.0 to 5.1.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@38f3f10...887a942)

Updates `peter-evans/create-pull-request` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@5e91468...67ccf78)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: hynek/build-and-inspect-python-package
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/create-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from afuetterer as a code owner January 1, 2025 07:50
@dependabot dependabot bot added deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration labels Jan 1, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 1, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Feb 1, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-6df37deb59 branch February 1, 2025 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afuetterer afuetterer Awaiting requested review from afuetterer afuetterer is a code owner

Assignees

No one assigned

Labels

deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants