From 98e17c5317aa094540b295d85c17fcf704408c90 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 09:47:42 +0100 Subject: [PATCH] Bump the action-packages group across 1 directory with 7 updates (#182) Bumps the action-packages group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `2` | `4` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `5` | `6` | | [mikefarah/yq](https://github.com/mikefarah/yq) | `4.43.1` | `4.44.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `2` | `4` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.3.1` | `2.3.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.1` | `4.3.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `2` | `3` | Updates `actions/checkout` from 2 to 4 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v2...v4) Updates `docker/build-push-action` from 5 to 6 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v5...v6) Updates `mikefarah/yq` from 4.43.1 to 4.44.2 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](https://github.com/mikefarah/yq/compare/v4.43.1...v4.44.2) Updates `actions/setup-node` from 2 to 4 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v2...v4) Updates `ossf/scorecard-action` from 2.3.1 to 2.3.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/0864cf19026789058feabb7e87baa5f140aac736...dc50aa9510b46c811795eb24b2f1ba02a914e534) Updates `actions/upload-artifact` from 4.3.1 to 4.3.3 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/5d5d22a31266ced268874388b861e4b58bb5c2f3...65462800fd760344b1a7b4382951275a0abb4808) Updates `github/codeql-action` from 2 to 3 - [Release notes](https://github.com/github/codeql-action/releases) - [Commits](https://github.com/github/codeql-action/compare/v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major dependency-group: action-packages - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: action-packages - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: action-packages - dependency-name: actions/setup-node dependency-type: direct:production update-type: version-update:semver-major dependency-group: action-packages - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-packages - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-packages - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: action-packages ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/build-push-action.yml | 10 +++++----- .github/workflows/cypress_tests.yml | 4 ++-- .github/workflows/scorecard.yml | 8 ++++---- .github/workflows/trivy.yml | 6 +++--- .github/workflows/yarn_build.yml | 4 ++-- 5 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build-push-action.yml b/.github/workflows/build-push-action.yml index 872d8b1..5e94f10 100644 --- a/.github/workflows/build-push-action.yml +++ b/.github/workflows/build-push-action.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4.1.1 + uses: actions/checkout@v4 - name: Log in to the Container registry uses: docker/login-action@v3 @@ -30,14 +30,14 @@ jobs: - name: Build and push frontend Docker image id: frontend_build - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v6 with: file: ./container/frontend.dockerfile push: true tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/frontend:${{ github.sha }} - name: Build and push scigateway Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v6 id: scigateway_build with: context: ./container @@ -52,12 +52,12 @@ jobs: token: ${{ secrets.GITOPS_STAGING_EDIT_TOKEN }} - name: Edit the YAML frontend file for staging - uses: mikefarah/yq@v4.43.1 + uses: mikefarah/yq@v4.44.2 with: cmd: yq e -i '.spec.template.spec.containers[] |= select(.name == "frontend").image = "ghcr.io/fiaisis/frontend@${{ steps.frontend_build.outputs.digest }}"' './components/frontend/envs/staging/frontend.yml' - name: Edit the YAML scigateway file for staging - uses: mikefarah/yq@v4.43.1 + uses: mikefarah/yq@v4.44.2 with: cmd: yq e -i '.spec.template.spec.containers[] |= select(.name == "scigateway").image = "ghcr.io/fiaisis/scigateway@${{ steps.scigateway_build.outputs.digest }}"' './components/scigateway/envs/staging/scigateway.yml' diff --git a/.github/workflows/cypress_tests.yml b/.github/workflows/cypress_tests.yml index 22db299..d814cad 100644 --- a/.github/workflows/cypress_tests.yml +++ b/.github/workflows/cypress_tests.yml @@ -5,9 +5,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 - name: Setup Node.js - uses: actions/setup-node@v2 + uses: actions/setup-node@v4 with: node-version: '14' cache: 'yarn' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 277d421..5155e3e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -20,25 +20,25 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.1.0 + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v3.1.0 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3 with: results_file: results.sarif results_format: sarif publish_results: true - name: "Upload artifact" - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1 + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 with: name: SARIF file path: results.sarif retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4 + uses: github/codeql-action/upload-sarif@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10 with: sarif_file: results.sarif \ No newline at end of file diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 0c3e730..9bc4ec9 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -14,10 +14,10 @@ jobs: runs-on: ubuntu-20.04 steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Build Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v6 with: file: ./container/frontend.D tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/frontend:${{ github.sha }} @@ -36,7 +36,7 @@ jobs: if: failure() - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 if: failure() with: sarif_file: trivy-results.sarif \ No newline at end of file diff --git a/.github/workflows/yarn_build.yml b/.github/workflows/yarn_build.yml index 43808e5..39b33fe 100644 --- a/.github/workflows/yarn_build.yml +++ b/.github/workflows/yarn_build.yml @@ -4,9 +4,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Use Node.js - uses: actions/setup-node@v2 + uses: actions/setup-node@v4 with: node-version: 14 - name: Install dependencies