Skip to content

ci: bump the actions group across 1 directory with 10 updates - #25

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-393ca023b6
Open

ci: bump the actions group across 1 directory with 10 updates#25
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-393ca023b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

Package From To
actions/checkout 4.4.0 7.0.1
actions/attest-build-provenance 2.4.0 4.2.2
actions/upload-artifact 4.6.2 7.0.1
actions/create-github-app-token 2.2.2 3.2.0
getplumber/plumber 0.4.26 0.4.60
actions/download-artifact 4.3.0 8.0.1
mikepenz/release-changelog-builder-action 5.4.1 6.3.0
softprops/action-gh-release 2.6.2 3.0.3
aquasecurity/trivy-action 0.35.0 0.36.0
gitleaks/gitleaks-action 2.3.9 3.0.0

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/attest-build-provenance from 2.4.0 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

v4.1.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/create-github-app-token from 2.2.2 to 3.2.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

  • improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

  • deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

v3.0.0

3.0.0 (2026-03-14)

Bug Fixes

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • bcd2ba4 chore(main): release 3.2.0 (#370)
  • f24bbd8 fix: validate private-key input (#376)
  • 363531b docs: capitalize Git as a proper noun in README (#374)
  • fd28011 docs: update procedure to configure Git (#287)
  • 85eb8dd feat: support full repository names in repositories input (#372)
  • c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
  • e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
  • 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
  • 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
  • 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
  • Additional commits viewable in compare view

Updates getplumber/plumber from 0.4.26 to 0.4.60

Release notes

Sourced from getplumber/plumber's releases.

v0.4.60

0.4.60 (2026-09-11)

✨ Features

  • platform: decode policy min_points and the push response's global score into a verdict (83dbfba)
  • platform: evaluate resolved policies as first-class runs with no local fallback (1fedc61)
  • platform: in platform mode the resolved policies drive the log, the push and the exit code (8f4b6ba)
  • platform: local gates, thresholds and the degraded exit are inert in platform mode (551eac6)
  • platform: per-policy artifacts, badge and MR comment from the platform verdict (5ef59c2), closes #467
  • platform: per-policy log sections and the platform verdict block (13d0da9)

🐛 Bug Fixes

  • platform: a --no-controls run is not platform mode in the summary (65ae90c)
  • platform: carry each run's not-evaluable marks in its policy report entry (d16571b)
  • platform: decode the gate strictly, only the global score tolerantly (ef0733a)
  • platform: honest verdict line, collection diagnostics and header in platform mode (db8aedf)
  • platform: inventory runs keep their guards in platform mode, pin the run-level dismissal mark (ee6de90)
  • platform: platform-mode artifacts carry only the policies' verdicts (b8c3411)
  • platform: tolerant gate decode and validated global letter (9c292fe)
  • platform: track the two image controls independently in pbom verdicts (2928548)

📚 Documentation

  • platform: platform mode evaluates only the platform's policies and takes its verdict (8ff0c69)
  • platform: replace em dashes and restore template backticks (f73aa78)

✅ Tests

  • platform: cover outputControlEntries's multi-policy accumulation (7e7fe68)
  • platform: cover the post-action and pbom summaries through the cmd path (7e334ba)
  • platform: cover the report's un-applied policy entry and min_points (93b6185)
  • platform: cover the union's not-evaluable swap and the degraded sections (e10cc50), closes #220
  • platform: pin the notEvaluable key removal in platform-mode json reports (6cc5dd0)

👷 CI/CD

  • release: pin v0.4.59 refs [skip ci] (8da00d4)

v0.4.59

0.4.59 (2026-09-10)

✨ Features

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.4.63 (2026-09-14)

✨ Features

  • cmd: push a linked run that evaluated nothing, with the marker the platform records (row 63) (c713d04)
  • control: drive platform-mode collection from the union of the resolved policies (row 62) (f318bcb)

🐛 Bug Fixes

  • cmd: ignore --controls and --skip-controls on a linked run (row 64) (f93ed94)
  • cmd: terminal, exit code and docs follow the policy verdicts on a linked run (row 62) (9b5d4ff)

♻️ Refactoring

  • gitlab: export the multi-document CI parser as ParseGitlabCIConf (row 54) (0795790)

👷 CI/CD

  • release: pin v0.4.62 refs [skip ci] (1840df4)

0.4.62 (2026-09-12)

🐛 Bug Fixes

  • gitremote: eat every userinfo @ up to the last one before the path (d370cbd)
  • platform: a served empty include list is complete attribution, not unknown (754ab69)
  • platform: use the includes the resolve endpoint serves (dc10a57)

✅ Tests

  • platform: pin the no-attribution branch of the includes served line (9b18a79)
  • platform: pin the wire-level decode of resolve response includes (4e2837d)

👷 CI/CD

  • release: pin v0.4.61 refs [skip ci] (cc366ec)

0.4.61 (2026-09-12)

✨ Features

  • configuration: export nullable on schema fields so an editor knows when unset is meaningful (6ce3630)

... (truncated)

Commits
  • f84005b chore(release): 0.4.60 [skip ci]
  • e10cc50 test(platform): cover the union's not-evaluable swap and the degraded sections
  • d16571b fix(platform): carry each run's not-evaluable marks in its policy report entry
  • 7e7fe68 test(platform): cover outputControlEntries's multi-policy accumulation
  • 93b6185 test(platform): cover the report's un-applied policy entry and min_points
  • 65ae90c fix(platform): a --no-controls run is not platform mode in the summary
  • 7e334ba test(platform): cover the post-action and pbom summaries through the cmd path
  • 2928548 fix(platform): track the two image controls independently in pbom verdicts
  • ef0733a fix(platform): decode the gate strictly, only the global score tolerantly
  • f73aa78 docs(platform): replace em dashes and restore template backticks
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates mikepenz/release-changelog-builder-action from 5.4.1 to 6.3.0

Release notes

Sourced from mikepenz/release-changelog-builder-action's releases.

v6.3.0

🚀 Features

  • ci: add OpenSSF Scorecard analysis and fix CI badge

💬 Other

  • ci: fix Scorecard Dangerous-Workflow finding (script injection)
  • dev -> main
  • ci: run Scorecard on develop, the default branch

📦 Dependencies

  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.4
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 4823a29
  • chore(deps): update node devdependency non-major updates
  • fix(deps): update dependency https-proxy-agent to v9.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance
  • chore(deps): update actions/checkout action to v7
  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.5
  • chore(deps): update dependency js-yaml to v5
  • chore(deps): lock file maintenance
  • chore(deps): update node devdependency non-major updates
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 2449e39
  • chore(deps): update dependency vite to v8.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance

... (truncated)

Commits
  • cb021f9 Merge pull request #1666 from mikepenz/develop
  • 48658d7 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#1665)
  • 6c6fe84 Merge pull request #1661 from mikepenz/renovate/node-devdependency-non-major-...
  • 27dc4b4 chore: rebuild dist for renovate
  • f911262 chore(deps): update node devdependency non-major updates
  • 217d3c7 Merge pull request #1660 from mikepenz/renovate/js-yaml-5.x
  • a5deb72 chore: rebuild dist for renovate
  • 72b7476 chore: sync js-yaml version between devDependencies and overrides
  • 325c6d9 chore(deps): update dependency js-yaml to v5.3.0
  • 390cad3 chore(deps): lock file maintenance (#1664)
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.6.2 to 3.0.3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 458a873c-8abe-444f-b9df-53f51f57f81b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot
ci: bump the actions group across 1 directory with 10 updates
653759a 
Bumps the actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.2.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.2` | `3.2.0` |
| [getplumber/plumber](https://github.com/getplumber/plumber) | `0.4.26` | `0.4.60` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [mikepenz/release-changelog-builder-action](https://github.com/mikepenz/release-changelog-builder-action) | `5.4.1` | `6.3.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.2` | `3.0.3` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` |



Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

Updates `actions/attest-build-provenance` from 2.4.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@e8998f9...4d10147)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `actions/create-github-app-token` from 2.2.2 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@fee1f7d...bcd2ba4)

Updates `getplumber/plumber` from 0.4.26 to 0.4.60
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@7ad9d26...f84005b)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...3e5f45b)

Updates `mikepenz/release-changelog-builder-action` from 5.4.1 to 6.3.0
- [Release notes](https://github.com/mikepenz/release-changelog-builder-action/releases)
- [Commits](mikepenz/release-changelog-builder-action@c9dc836...cb021f9)

Updates `softprops/action-gh-release` from 2.6.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@3bb1273...efb3536)

Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@57a97c7...ed142fd)

Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: getplumber/plumber
  dependency-version: 0.4.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: mikepenz/release-changelog-builder-action
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-393ca023b6 branch from ce6410f to 653759a Compare September 14, 2026 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants