Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 22, 2025

Bumps burnett01/rsync-deployments from 5.2 to 8.

Release notes

Sourced from burnett01/rsync-deployments's releases.

v8

v8-release-banner

What's Changed

Version v8 (8.0.2) offers the following features:

  • feat: latest Alpine 3.23.0
  • feat: latest Rsync 3.4.1-r1
  • feat: integrate rsync-docker 3rd party into this action as 1st party code (no more dependency, better audit, single source of truth)
    • backported:
      • agent-start
      • agent-stop
      • agent-askpass
      • agent-add
      • hosts-add
      • hosts-clear
    • new added:
      • ssh-init
      • hosts-init
    • improved:
      • stricter permissions on .ssh/ folder (700) and known_hosts (600)
      • use set -eu in all scipts
  • feat: new strict_host_keys option to enable support for strict host key verification. Default: false (to keep backward compatibility)
  • feat: new debug option to see the commands executed (-x) by this action
  • feat: this action is now scanned for vulnerabilities by Snyk
  • feat; this action is now scanned by CodeQL for Q/A
  • feat: this action now performs CI tasks such as Validation, Linting and Unit Tests
  • fix: various shell syntax for robustness
  • fix: use printf and redirect output to non-stdout instead of echo in sensitive code locations
  • refactor: use $HOME instead of tilde ~ for robustness
  • feat: cross-platform support
  • chore: Deprecate 7.0.2
  • chore: EOL 7.0.0 & 7.0.1

New release channels:

From now on you can use @v8 instead of manually pinning to a version like 8.0.2.

The benefit of using v8 is that you will receive future MINOR+PATCH updates automatically, since v8 is a pointer to 8.x.x.

However, of course you are free to use the regular format like 8.0.2 directly.

Full Changelog: Burnett01/rsync-deployments@7.1.0...8.0.2

Contributors:

7.1.0

... (truncated)

Commits
  • 0c90252 Release/8.0.2 (#93)
  • 68d1fd5 chore: 8.0.1
  • 2c22263 fix: regression - using echo instead of printf again #90
  • 8a39558 feat: add README for SSH agent and known_hosts management scripts
  • 0f1cb79 fix: permissions of docker-rsync scripts
  • 05a269a v8 - 8.0.0 (#88)
  • 92961b5 feat: always force-upgrade alpine openssl
  • 96abc27 fix: snyk-docker-vulnerability-scan sarif
  • 7e729bf fix: snyk-docker-vulnerability-scan sarif
  • c23b68a chore: snyk output sarif file content
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [burnett01/rsync-deployments](https://github.com/burnett01/rsync-deployments) from 5.2 to 8.
- [Release notes](https://github.com/burnett01/rsync-deployments/releases)
- [Commits](Burnett01/rsync-deployments@0dc935c...0c90252)

---
updated-dependencies:
- dependency-name: burnett01/rsync-deployments
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Dec 22, 2025
@reiabreu reiabreu merged commit 40f3fd8 into master Dec 22, 2025
12 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/burnett01/rsync-deployments-8 branch December 22, 2025 07:42
@rzo1
Copy link
Contributor

rzo1 commented Dec 22, 2025

@reiabreu can we revert this change? The version is currently not on the allow list of ASF infra, so the nightlies deploy will fail: https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml#L54

@rzo1
Copy link
Contributor

rzo1 commented Dec 22, 2025

At least it was the case a few days ago, so I reverted that change on main a few days ago 🙂

reiabreu added a commit that referenced this pull request Dec 22, 2025
@abreur
Copy link

abreur commented Dec 22, 2025

Thanks for the heads up. aa6ff07 reverts it

@rzo1
Copy link
Contributor

rzo1 commented Dec 22, 2025

Thx 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants