Skip to content

ci: bump the github-actions group across 1 directory with 10 updates #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
afuetterer merged 1 commit into from
Feb 1, 2025
Merged

ci: bump the github-actions group across 1 directory with 10 updates #239

afuetterer merged 1 commit into from
Feb 1, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 1, 2025

Bumps the github-actions group with 10 updates in the / directory:

Package From To
github/codeql-action 3.27.6 3.28.8
actions/setup-python 5.3.0 5.4.0
python-semantic-release/python-semantic-release 9.15.1 9.17.0
hynek/build-and-inspect-python-package 2.10.0 2.12.0
softprops/action-gh-release 2.1.0 2.2.1
pypa/gh-action-pypi-publish 1.12.2 1.12.4
docker/setup-buildx-action 3.7.1 3.8.0
docker/build-push-action 6.10.0 6.13.0
astral-sh/setup-uv 4.2.0 5.2.2
peter-evans/create-pull-request 7.0.5 7.0.6

Updates github/codeql-action from 3.27.6 to 3.28.8

Release notes

Sourced from github/codeql-action's releases.

v3.28.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

See the full CHANGELOG.md for more information.

v3.28.7

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.7 - 29 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.6

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

See the full CHANGELOG.md for more information.

v3.28.5

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

See the full CHANGELOG.md for more information.

v3.28.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.4 - 23 Jan 2025

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.28.8 - 29 Jan 2025

  • Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #2744

3.28.7 - 29 Jan 2025

No user facing changes.

3.28.6 - 27 Jan 2025

  • Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #2726

3.28.5 - 24 Jan 2025

  • Update default CodeQL bundle version to 2.20.3. #2717

3.28.4 - 23 Jan 2025

No user facing changes.

3.28.3 - 22 Jan 2025

  • Update default CodeQL bundle version to 2.20.2. #2707
  • Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #2710
  • Uploading debug artifacts for CodeQL analysis is temporarily disabled. #2712

3.28.2 - 21 Jan 2025

No user facing changes.

3.28.1 - 10 Jan 2025

  • CodeQL Action v2 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v3. For more information, see this changelog post. #2677
  • Update default CodeQL bundle version to 2.20.1. #2678

3.28.0 - 20 Dec 2024

  • Bump the minimum CodeQL bundle version to 2.15.5. #2655
  • Don't fail in the unusual case that a file is on the search path. #2660.

3.27.9 - 12 Dec 2024

... (truncated)

Commits
  • dd74661 Merge pull request #2746 from github/update-v3.28.8-a91a3f767
  • 3210a3c Fix Kotlin version in changelog
  • 72f9d02 Update changelog for v3.28.8
  • a91a3f7 Merge pull request #2744 from github/igfoo/kot2.1.10
  • c520fb5 Merge pull request #2745 from github/mergeback/v3.28.7-to-main-6e545590
  • 3879c57 Add changelog entry
  • 0c21937 Run "npm run build"
  • 5a61bf0 Kotlin: The 2.20.3 release supports Kotlin 2.1.10.
  • 163d119 Update checked-in dependencies
  • bcf5cec Update changelog and version after v3.28.7
  • Additional commits viewable in compare view

Updates actions/setup-python from 5.3.0 to 5.4.0

Release notes

Sourced from actions/setup-python's releases.

v5.4.0

What's Changed

Enhancements:

Documentation changes:

Dependency updates:

New Contributors

Full Changelog: actions/setup-python@v5...v5.4.0

Commits

Updates python-semantic-release/python-semantic-release from 9.15.1 to 9.17.0

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v9.17.0 (2025-01-26)

Features

  • changelog: Add sort_numerically filter function to template environment (#1146, 7792388)

  • changelog: Parse squashed commits individually (#1112, cf785ca)

  • config: Extend support of remote urls aliased using git insteadOf configurations (#1151, 4045037)

  • parsers: Parse squashed commits individually (#1112, cf785ca)

  • parser-angular: Apply PR/MR numbers to all parsed commits from a squash merge (#1112, cf785ca)

  • parser-angular: Upgrade angular parser to parse squashed commits individually (#1112, cf785ca)

  • parser-emoji: Add functionality to interpret scopes from gitmoji commit messages (#1112, cf785ca)

  • parser-emoji: Upgrade emoji parser to parse squashed commits individually (#1112, cf785ca)

  • version: Parse squashed commits individually (#1112, cf785ca)

Bug Fixes

  • github-action: Disable writing python bytecode in action execution (#1152, 315ae21)

Performance Improvements

  • logging: Remove irrelevant debug logging statements (#1147, f1ef4ec)

Documentation

  • changelog-templates: Add description for new sort_numerically filter function (#1146, 7792388)

  • commit-parsing: Add description for squash commit evaluation option of default parsers (#1112, cf785ca)

  • configuration: Update the commit_parser_options setting description (#1112, cf785ca)

Resolved Issues

  • #1085: Commit Parser: Add support for squash commits (BitBucket Specific)

  • #1150: Request support of git insteadOf url aliases

Detailed Changes: v9.16.1...v9.17.0

... (truncated)

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

.. _changelog:

========= CHANGELOG

.. _changelog-v9.17.0:

v9.17.0 (2025-01-26)

✨ Features

  • changelog: Add sort_numerically filter function to template environment (PR#1146, 7792388)

  • changelog: Parse squashed commits individually (PR#1112, cf785ca)

  • config: Extend support of remote urls aliased using git insteadOf configurations, closes [#1150](https://github.com/python-semantic-release/python-semantic-release/issues/1150)_ (PR#1151, 4045037)

  • parsers: Parse squashed commits individually (PR#1112, cf785ca)

  • parser-angular: Apply PR/MR numbers to all parsed commits from a squash merge (PR#1112, cf785ca)

  • parser-angular: Upgrade angular parser to parse squashed commits individually, closes [#1085](https://github.com/python-semantic-release/python-semantic-release/issues/1085)_ (PR#1112, cf785ca)

  • parser-emoji: Add functionality to interpret scopes from gitmoji commit messages (PR#1112, cf785ca)

  • parser-emoji: Upgrade emoji parser to parse squashed commits individually (PR#1112, cf785ca)

  • version: Parse squashed commits individually (PR#1112, cf785ca)

🪲 Bug Fixes

  • github-action: Disable writing python bytecode in action execution (PR#1152, 315ae21)

⚡ Performance Improvements

  • logging: Remove irrelevant debug logging statements (PR#1147, f1ef4ec)

📖 Documentation

... (truncated)

Commits
  • cdfda70 9.17.0
  • cf785ca feat(parsers): parse squashed commits individually (#1112)
  • 4045037 feat(config): extend support of remote urls aliased using git insteadOf con...
  • abe0f9e test(cmd-changelog): add changelog validator for 4 channel git flow repo (#1153)
  • 315ae21 fix(github-action): disable writing python bytecode in action execution (#1152)
  • f1ef4ec perf(logging): remove irrelevant debug logging statements (#1147)
  • 7792388 feat(changelog): add sort_numerically filter function to template environme...
  • 7edaa90 ci(deps): bump python-semantic-release/publish-action@v9.15.2 action to 9.1...
  • d6a3be3 9.16.1
  • c4056fc fix(parser-custom): handle relative parent directory paths to module file bet...
  • Additional commits viewable in compare view

Updates hynek/build-and-inspect-python-package from 2.10.0 to 2.12.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.12.0

This release only updates our dependencies to support packaging metadata v2.4 (as created, for example, by recent Hatchling releases).

[!NOTE] To upload packages with metadata v2.4 (which is required for PEP 639 license metadata) using the official pypi-publish GitHub Action, you must make sure to use its v1.12.4 or later.

v2.11.0

Added

  • New output: package_version is the version of the package that was built. #152
Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.12.0

Changed

  • This release only updates the tools we use. It's important for being able to handle packaging metadata 2.4, as published by recent versions of Hatchling, though. #161

2.11.0

Added

  • New output: package_version is the version of the package that was built. #152

2.10.0

Changed

2.9.0

Changed

  • uv build is now used instead of the build package. Since the actual build of the packages is done by the packaging backend (the one you define in your pyproject.toml under build-system.build-backend -- for example, Setuptools or Hatchling), this should make no difference except for faster runs. #140

2.8.0 - 2024-07-25

Changed

  • Use uv's new uv cache prune --ci to only cache downloaded files. This makes the cache smaller and faster to pack/unpack.

... (truncated)

Commits

Updates softprops/action-gh-release from 2.1.0 to 2.2.1

Release notes

Sourced from softprops/action-gh-release's releases.

v2.2.1

What's Changed

Bug fixes 🐛

Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.2.0...v2.2.1

v2.2.0

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.1.0...v2.2.0

Changelog

Sourced from softprops/action-gh-release's changelog.

2.2.1

What's Changed

Bug fixes 🐛

Other Changes 🔄

2.2.0

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

2.1.0

What's Changed

Exciting New Features 🎉

Other Changes 🔄

2.0.9

  • maintenance release with updated dependencies

... (truncated)

Commits
  • c95fe14 release 2.2.1
  • deddb09 fix: big file uploads (#562)
  • 33fcd69 chore: update error and warning messages for not matching files in files fiel...
  • 01050bd chore(deps): bump @​types/node from 22.10.2 to 22.10.5 (#569)
  • 92dffe6 chore(deps): bump @​types/node from 22.10.1 to 22.10.2 (#559)
  • 7b4da11 release 2.2.0
  • 64f1fa1 feat: read the release assets asynchronously (#552)
  • 9e35a64 chore(deps): bump prettier from 3.4.1 to 3.4.2 (#554)
  • 92bc83c chore(deps): bump @​types/node from 22.9.4 to 22.10.1 (#551)
  • 09f0e37 chore(deps): bump prettier from 3.3.3 to 3.4.1 (#550)
  • Additional commits viewable in compare view

Updates pypa/gh-action-pypi-publish from 1.12.2 to 1.12.4

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.12.4

✨ What's Changed

The main theme of this patch release that the support for uploading PEP 639 licensing metadata to PyPI has been fixed in #327.

🛠️ Internal Updates

A few smaller updates include the attestation existence being checked earlier in the process now, listing all the violating files together, not just one (PR #315). And the lock file with the software available in runtime has been re-pinned in #329. Additionally, the CI now runs the smoke-tests against both Ubuntu 22.04 and 24.04 explicitly via da900af96347cc027433720ad4f122117645459d.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.12.3...v1.12.4

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​dnicolodi💰 and @​woodruffw💰 for releasing the license metadata support fix in Twine!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

GH Sponsors badge

v1.12.3

✨ What's Improved

With the updates by @​woodruffw💰 and @​webknjaz💰 via #309 and #313, it is now possible to publish [distribution packages] that include [core metadata v2.4], like those built using [maturin]. This is done by bumping Twine to v6.0.1 and pkginfo to v1.12.0.

📝 Docs

We've made an attempt to clarify the runtime and workflow shape that are expected to be supported for calling this action in: https://github.com/marketplace/actions/pypi-publish#Non-goals.

[!TIP] Please, let us know in the release discussion if anything still remains unclear. TL;DR always call [pypi-publish] once per job; don't invoke it in reusable workflows; physically move building the dists into separate jobs having restricted permissions and storing the dists as GitHub Actions artifacts; when using self-hosted runners, make sure to still use [pypi-publish] on a GitHub-provided infra with runs-on: ubuntu-latest, while building and testing may remain self-hosted; don't perform any other actions in the publishing job; don't call [pypi-publish] from composite actions.

🛠️ Internal Updates

@​br3ndonland💰 improved the container image generation automation to include Git SHA in #301. And @​woodruffw💰 added the workflow_ref context to Trusted Publishing debug logging in #305, helping us diagnose misconfigurations faster. #313 also extends the smoke test in the CI to check against the [maturin]-made dists. Additionally, jeepney and secretstorage transitive deps have been added to the pip constraint-based lock file, as Dependabot seems to have missed those earlier.

... (truncated)

Commits
  • 76f52bc Merge pull request #329 from webknjaz/maintenance/runtime-lockfile-24-02-2025
  • 72de13b 📌 Mass-upgrade transitive dependency pins
  • 1995f2e Merge pull request #327 from webknjaz/maintenance/twine-6.1-pep639
  • 29f40bd 📦 Enable metadata 2.4 support in Twine
  • 10df67d 📦 Enable support for PEP 639 metadata
  • e0449d2 🧪 Integrate a unified alls-green GHA status
  • cebc64f 🧪 Bump setuptools in smoke test to v75.8.0
  • da900af 🧪 Run smoke tests against Ubuntu 24 and 22
  • 8cafb5c 💰 Sync the funding config
  • 916e576 Merge pull request #315 from webknjaz/refactoring/attestations-exist-bundle
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.7.1 to 3.8.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.8.0

Full Changelog: docker/setup-buildx-action@v3.7.1...v3.8.0

Commits
  • 6524bf6 Merge pull request #390 from crazy-max/buildx-cloud-latest
  • 8d5e074 chore: update generated content
  • 7199e57 make cloud prefix optional to download buildx if driver is cloud
  • db63cee Merge pull request #381 from docker/dependabot/github_actions/codecov/codecov...
  • 043ebe1 Merge pull request #389 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 686da90 chore: update generated content
  • a3d7487 Merge pull request #382 from docker/dependabot/npm_and_yarn/cross-spawn-7.0.6
  • 4dcdbce build(deps): bump @​docker/actions-toolkit from 0.39.0 to 0.48.0
  • 1a8ac74 ci: fix deprecated input for codecov-action
  • e827ebe build(deps): bump cross-spawn from 7.0.3 to 7.0.6
  • Additional commits viewable in compare view

Updates docker/build-push-action from 6.10.0 to 6.13.0

Release notes

Sourced from docker/build-push-action's releases.

v6.13.0

Full Changelog: docker/build-push-action@v6.12.0...v6.13.0

v6.12.0

Full Changelog: docker/build-push-action@v6.11.0...v6.12.0

v6.11.0

Full Changelog: docker/build-push-action@v6.10.0...v6.11.0

Commits
  • ca877d9 Merge pull request #1308 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • d2fe919 chore: update generated content
  • f0fc9ec chore(deps): Bump @​docker/actions-toolkit from 0.51.0 to 0.53.0
  • 67a2d40 Merge pull request #1300 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 0b1b1c9 chore: update generated content
  • b6a7c2c chore(deps): Bump @​docker/actions-toolkit from 0.49.0 to 0.51.0
  • 31ca4e5 Merge pull request #1296 from crazy-max/bake-v6
  • e613db9 update bake-action to v6
  • b32b51a Merge pull request #1281 from docker/dependabot/npm_and_yarn/docker/actions-t...
  • 594bf46 Merge pull request #1294 from crazy-max/fix-e2e
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 4.2.0 to 5.2.2

Release notes

Sourced from astral-sh/setup-uv's releases.

v5.2.2 🌈 Full support for GHES

Changes

This release fixes some issues that prevented use with GitHub Enterprise Server instances.

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

@dependabot
ci: bump the github-actions group across 1 directory with 10 updates
92dd145 
Bumps the github-actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.27.6` | `3.28.8` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.3.0` | `5.4.0` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `9.15.1` | `9.17.0` |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `2.10.0` | `2.12.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.1.0` | `2.2.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.12.2` | `1.12.4` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.7.1` | `3.8.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.10.0` | `6.13.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `4.2.0` | `5.2.2` |
| [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7.0.5` | `7.0.6` |



Updates `github/codeql-action` from 3.27.6 to 3.28.8
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@aa57810...dd74661)

Updates `actions/setup-python` from 5.3.0 to 5.4.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@0b93645...4237552)

Updates `python-semantic-release/python-semantic-release` from 9.15.1 to 9.17.0
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@a323379...cdfda70)

Updates `hynek/build-and-inspect-python-package` from 2.10.0 to 2.12.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@f01e4d0...b5076c3)

Updates `softprops/action-gh-release` from 2.1.0 to 2.2.1
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@01570a1...c95fe14)

Updates `pypa/gh-action-pypi-publish` from 1.12.2 to 1.12.4
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@15c56db...76f52bc)

Updates `docker/setup-buildx-action` from 3.7.1 to 3.8.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@c47758b...6524bf6)

Updates `docker/build-push-action` from 6.10.0 to 6.13.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@48aba3b...ca877d9)

Updates `astral-sh/setup-uv` from 4.2.0 to 5.2.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@38f3f10...4db9619)

Updates `peter-evans/create-pull-request` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@5e91468...67ccf78)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: hynek/build-and-inspect-python-package
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/create-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from afuetterer as a code owner February 1, 2025 07:50
@dependabot dependabot bot added deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration labels Feb 1, 2025
@afuetterer afuetterer merged commit 2b814fe into main Feb 1, 2025
12 of 13 checks passed
@afuetterer afuetterer deleted the dependabot/github_actions/github-actions-012ae8b65f branch February 1, 2025 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afuetterer afuetterer afuetterer approved these changes

Assignees

No one assigned

Labels

deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@afuetterer