Bump the github-action-updates group across 1 directory with 9 updates

[dependabot]

Bumps the github-action-updates group with 9 updates in the / directory:

Package	From	To
step-security/harden-runner	2.8.1	2.9.1
actions/checkout	4.1.6	4.1.7
actions/setup-python	5.1.0	5.2.0
actions/upload-artifact	4.3.3	4.4.0
actions/download-artifact	4.1.7	4.1.8
pypa/gh-action-pypi-publish	1.8.14	1.10.0
github/codeql-action	3.25.8	3.26.6
actions/dependency-review-action	4.3.3	4.3.4
ossf/scorecard-action	2.3.3	2.4.0

Updates step-security/harden-runner from 2.8.1 to 2.9.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.9.1

What's Changed

Release v2.9.1 by @​h0x0er and @​varunsh-coder in #440 This release includes two changes:

1. Updated markdown displayed in the job summary by the Harden-Runner Action.
2. Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.

Full Changelog: step-security/harden-runner@v2...v2.9.1

v2.9.0

What's Changed

Release v2.9.0 by @​h0x0er and @​varunsh-coder in step-security/harden-runner#435 This release includes:

• Enterprise Tier - Telemetry Upload Enhancement: For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
• Harden-Runner Agent Authentication: The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
• README Update: A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
• Dependency Update: Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

Commits

• 5c7944e Merge pull request #440 from step-security/rc-11
• c79be45 Merge branch 'main' into rc-11
• deb3383 Merge pull request #446 from h0x0er/log-step
• 23c8215 update dist
• 727d06a logging step
• f0db2aa Merge pull request #441 from step-security/dependabot/github_actions/github/c...
• 1938ffc Merge branch 'main' into dependabot/github_actions/github/codeql-action-3.25.13
• 8e7dd2c Merge pull request #442 from step-security/dependabot/github_actions/step-sec...
• f2823ee Bump step-security/publish-unit-test-result-action from 1 to 2
• 5f95e05 Bump github/codeql-action from 2.13.4 to 3.25.13
• Additional commits viewable in compare view

Updates actions/checkout from 4.1.6 to 4.1.7

Release notes

Sourced from actions/checkout's releases.

v4.1.7

What's Changed

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

New Contributors

• @​orhantoy made their first contribution in actions/checkout#1774

Full Changelog: actions/checkout@v4.1.6...v4.1.7

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.1.7

• Bump the minor-npm-dependencies group across 1 directory with 4 updates by @​dependabot in actions/checkout#1739
• Bump actions/checkout from 3 to 4 by @​dependabot in actions/checkout#1697
• Check out other refs/* by commit by @​orhantoy in actions/checkout#1774
• Pin actions/checkout's own workflows to a known, good, stable version. by @​jww3 in actions/checkout#1776

v4.1.6

• Check platform to set archive extension appropriately by @​cory-miller in actions/checkout#1732

v4.1.5

• Update NPM dependencies by @​cory-miller in actions/checkout#1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in actions/checkout#1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in actions/checkout#1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in actions/checkout#1695
• README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @​cory-miller in actions/checkout#1707

v4.1.4

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in actions/checkout#1692
• Add dependabot config by @​cory-miller in actions/checkout#1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in actions/checkout#1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in actions/checkout#1643

v4.1.3

• Check git version before attempting to disable sparse-checkout by @​jww3 in actions/checkout#1656
• Add SSH user parameter by @​cory-miller in actions/checkout#1685
• Update actions/checkout version in update-main-version.yml by @​jww3 in actions/checkout#1650

v4.1.2

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in actions/checkout#1598

v4.1.1

• Correct link to GitHub Docs by @​peterbe in actions/checkout#1511
• Link to release page from what's new section by @​cory-miller in actions/checkout#1514

v4.1.0

• Add support for partial checkout filters

v4.0.0

• Support fetching without the --progress option
• Update to node20

v3.6.0

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

v3.5.3

• Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in
• Fix typos found by codespell

... (truncated)

Commits

• 692973e Prepare 4.1.7 release (#1775)
• 6ccd57f Pin actions/checkout's own workflows to a known, good, stable version. (#1776)
• b17fe1e Handle hidden refs (#1774)
• b80ff79 Bump actions/checkout from 3 to 4 (#1697)
• b1ec302 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1739)
• See full diff in compare view

Updates actions/setup-python from 5.1.0 to 5.2.0

Release notes

Sourced from actions/setup-python's releases.

v5.2.0

What's Changed

Bug fixes:

• Add .zip extension to Windows package downloads for Expand-Archive Compatibility by @​priyagupta108 in actions/setup-python#916 This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly.
• Add arch to cache key by @​Zxilly in actions/setup-python#896 This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts

Documentation changes:

• Fix display of emojis in contributors doc by @​sciencewhiz in actions/setup-python#899
• Documentation update for caching poetry dependencies by @​gowridurgad in actions/setup-python#908

Dependency updates:

• Bump @​iarna/toml version from 2.2.5 to 3.0.0 by @​priya-kinthali in actions/setup-python#912
• Bump pyinstaller from 3.6 to 5.13.1 by @​aparnajyothi-y in actions/setup-python#923

New Contributors

• @​sciencewhiz made their first contribution in actions/setup-python#899
• @​priyagupta108 made their first contribution in actions/setup-python#916
• @​Zxilly made their first contribution in actions/setup-python#896
• @​aparnajyothi-y made their first contribution in actions/setup-python#923

Full Changelog: actions/setup-python@v5...v5.2.0

v5.1.1

What's Changed

Bug fixes:

• fix(ci): update all failing workflows by @​mayeut in actions/setup-python#863 This update ensures compatibility and optimal performance of workflows on the latest macOS version.

Documentation changes:

• Documentation update for cache by @​gowridurgad in actions/setup-python#873

Dependency updates:

• Bump braces from 3.0.2 to 3.0.3 and undici from 5.28.3 to 5.28.4 by @​dependabot in actions/setup-python#893

New Contributors

• @​gowridurgad made their first contribution in actions/setup-python#873

Full Changelog: actions/setup-python@v5...v5.1.1

Commits

• f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
• 2bd53f9 Documentation update for caching poetry dependencies (#908)
• 80b49d3 fix: add arch to cache key (#896)
• 036a523 Fix: Add .zip extension to Windows package downloads for Expand-Archive C...
• 04c1311 Fix display of emojis in contributors doc (#899)
• cb68456 Updated @​iarna/toml version to 3.0.0 (#912)
• 39cd149 Documentation update for cache (#873)
• a0d74c0 fix(ci): update all failing workflows (#863)
• 4eb7dbc Bump braces from 3.0.2 to 3.0.3 (#893)
• See full diff in compare view

Updates actions/upload-artifact from 4.3.3 to 4.4.0

Release notes

Sourced from actions/upload-artifact's releases.

v4.4.0

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

• Exclude hidden files by default by @​joshmgross in actions/upload-artifact#598

Full Changelog: actions/upload-artifact@v4.3.6...v4.4.0

v4.3.6

What's Changed

• Revert to @​actions/artifact 2.1.8 by @​robherley in actions/upload-artifact#594

Full Changelog: actions/upload-artifact@v4...v4.3.6

v4.3.5

What's Changed

• Bump @​actions/artifact to v2.1.9 by @​robherley in actions/upload-artifact#588
  • Fixed artifact upload chunk timeout logic #1774
  • Use lazy stream to prevent issues with open file limits #1771

Full Changelog: actions/upload-artifact@v4.3.4...v4.3.5

v4.3.4

What's Changed

• Update @​actions/artifact version, bump dependencies by @​robherley in actions/upload-artifact#584

Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4

Commits

• 5076954 Merge pull request #598 from actions/joshmgross/exclude-hidden-files
• d52396a Add a warning about enabling include-hidden-files
• 710f362 Remove "merged" from include-hidden-files input description
• 3b315f2 npm run release again 🙂
• 3be2180 Remove another trailing comma
• 453e8d0 Update glob license
• 0a398c1 npm run release
• a0c40cf Update to latest @actions/glob and fix tests
• acb59e4 lint
• cb6558b Exclude hidden files by default
• Additional commits viewable in compare view

Updates actions/download-artifact from 4.1.7 to 4.1.8

Release notes

Sourced from actions/download-artifact's releases.

v4.1.8

What's Changed

• Update @​actions/artifact version, bump dependencies by @​robherley in actions/download-artifact#341

Full Changelog: actions/download-artifact@v4...v4.1.8

Commits

• fa0a91b Merge pull request #341 from actions/robherley/bump-pkgs
• b54d088 Update @​actions/artifact version, bump dependencies
• See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.8.14 to 1.10.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.10.0

🔏 Anything fancy, eh?

This time, @​woodruffw💰 implemented support for PEP 740 attestations functionality in #236 and #245. This is a big deal, as it is a huge step forward to replacing what the deprecated GPG signatures used to provide in a more meaningful way.

[!IMPORTANT] ✨ Please, do opt into trying this feature out early. It can be enabled as follows:

  with:
    attestations: true

Leave any feedback on this in this release discussion or the PR.

🙏 And please, thank William for working on this amazing improvement for the ecosystem! The overall effort is tracked @ pypi/warehouse#15871, by the way.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.9.0...v1.10.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

v1.9.0

💅 Cosmetic Output Improvements

• @​woodruffw💰 updated the tense on password nudge in #234
• @​shenxianpeng💰 helped us disable the progress bar that was being produced by the twine upload command via #231
• @​woodruffw💰 also linked the PyPI status dashboard in the trusted publishing error message via pypa/gh-action-pypi-publish#243

🛠️ Internal Dependencies

• pre-commit linters got auto-updated @ #225
• some notable dependency bumps include
  • cryptography == 42.0.7
  • id == 1.4.0
  • idna == 3.7 via #228
  • requests == 2.32.0 via #240
  • Twine == 5.1.0

⚙️ Secret Stuff

In #241, @​br3ndonland💰 added a Docker label linking the container image to this repository for GHCR to display it nicely. This is preparatory work for a big performance-focused refactoring he's working on in #230.

💪 New Contributors

• @​shenxianpeng made their first contribution in pypa/gh-action-pypi-publish#231
• @​br3ndonland made their first contribution in pypa/gh-action-pypi-publish#241

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.8.14...v1.9.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​pradyunsg💰 for promptly unblocking this release to Marketplace as GitHub started asking for yet another developer agreement signature from the organization admins.

Commits

• 8a08d61 Expose PEP 740 attestations functionality
• fb9fc6a Merge pull request #245 from trail-of-forks/ww/bump-twine
• 4d020ff requirements: re-compile requirements with latest twine
• ec4db0b Merge PR #243 into unstable/v1
• e790844 oidc-exchange: link to status dashboard
• 87b624f 💅Update homepage @ Dockerfile to GH Marketplace
• da2f9bb Merge pull request #241 from br3ndonland/ghcr-label
• abbea2d Add Docker label for GHCR
• 2734d07 build(deps): bump requests from 2.31.0 to 2.32.0 in /requirements (#240)
• a54b9b8 ---
• Additional commits viewable in compare view

Updates github/codeql-action from 3.25.8 to 3.26.6

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.26.6 - 29 Aug 2024

• Update default CodeQL bundle version to 2.18.3. #2449

3.26.5 - 23 Aug 2024

• Fix an issue where the csrutil system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled. #2441

3.26.4 - 21 Aug 2024

• Deprecation: The add-snippets input on the analyze Action is deprecated and will be removed in the first release in August 2025. #2436
• Fix an issue where the disk usage system call used for telemetry would fail on MacOS ARM machines with System Integrity Protection disabled, and then surface a warning. The system call is now disabled for these machines. #2434

3.26.3 - 19 Aug 2024

• Fix an issue where the CodeQL Action could not write diagnostic messages on Windows. This issue did not impact analysis quality. #2430

3.26.2 - 14 Aug 2024

• Update default CodeQL bundle version to 2.18.2. #2417

3.26.1 - 13 Aug 2024

No user facing changes.

3.26.0 - 06 Aug 2024

• Deprecation: Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you. #2403
• Bump the minimum CodeQL bundle version to 2.13.5. #2408

3.25.15 - 26 Jul 2024

• Update default CodeQL bundle version to 2.18.1. #2385

3.25.14 - 25 Jul 2024

• Experimental: add a new start-proxy action which starts the same HTTP proxy as used by github/dependabot-action. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2376

3.25.13 - 19 Jul 2024

... (truncated)

Commits

• 4dd1613 Merge pull request #2452 from github/update-v3.26.6-7233ec5e6
• dd9dd2d Update changelog for v3.26.6
• 7233ec5 Merge pull request #2449 from github/update-bundle/codeql-bundle-v2.18.3
• a32c44d Add changelog note
• 2966897 Update default bundle to codeql-bundle-v2.18.3
• b8efe4d Merge pull request #2435 from github/update-supported-enterprise-server-versions
• ab408a8 Merge branch 'main' into update-supported-enterprise-server-versions
• 864b979 Merge pull request #2443 from github/dbartol/config-file-telemetry
• d36c7aa Merge pull request #2448 from github/dependabot/npm_and_yarn/npm-09b7c43f6b
• b3bf514 Update checked-in dependencies
• Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.3.3 to 4.3.4

Release notes

Sourced from actions/dependency-review-action's releases.

v4.3.4

What's Changed

• Include all added dependencies in scorecard entries by @​elireisman in actions/dependency-review-action#783
• Update SPDX Expression Parsing by @​febuiles in actions/dependency-review-action#719
  • This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.

Full Changelog: actions/dependency-review-action@v4.3.3...v4.3.4

Commits

• 5a2ce3f Merge pull request #791 from actions/juxtin/update-version
• ac6a6ad Prepare even more for v4.3.4
• 3e2b917 Merge pull request #790 from actions/juxtin/update-version
• d9ab9c8 Update version in package.json
• 8c152c7 Merge pull request #769 from actions/dependabot/npm_and_yarn/zod-3.23.8
• 0085d30 Update dist
• 08b5bf2 Bump zod from 3.22.4 to 3.23.8
• 986fce9 Merge pull request #784 from actions/dependabot/npm_and_yarn/got-14.4.1
• 28743f8 Merge pull request #719 from actions/change-spdx-parser
• d6f34c3 Merge pull request #789 from actions/dependabot/npm_and_yarn/braces-3.0.3
• Additional commits viewable in compare view

Updates ossf/scorecard-action from 2.3.3 to 2.4.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.0

What's Changed

This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.

• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0 by @​spencerschrock in ossf/scorecard-action#1410
• 🐛 lower license sarif alert threshold to 9 by @​spencerschrock in ossf/scorecard-action#1411

Documentation

• docs: dogfooding badge by @​jkowalleck in ossf/scorecard-action#1399

New Contributors

• @​jkowalleck made their first contribution in ossf/scorecard-action#1399

Full Changelog: ossf/scorecard-action@v2.3.3...v2.4.0

Commits

• 62b2cac bump docker tag to v2.4.0 for release (#1414)
• c09630c lower license score alert threshold to 9 (#1411)
• cf8594c 🌱 Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#1413)
• de5fcb9 🌱 Bump the github-actions group with 2 updates (#1412)
• a46b90b bump scorecard to v5.0.0 release (#1410)
• 9fc518d 🌱 Bump golang in the docker-images group (#1407)
• a8eaa1b 🌱 Bump the github-actions group with 2 updates (#1408)
• 873d5fd 🌱 Bump the github-actions group across 1 directory with 2 updates (#...
• 54cc1fe 🌱 Bump the docker-images group with 2 updates (#1401)
• 82bcb91 🌱 Bump golang.org/x/net from 0.26.0 to 0.27.0 (#1400)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

The following labels could not be found: skip-changelog.

[dependabot]

Superseded by #59.