From 712b656b97188bcd215bfe4650954e8b7a782f82 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 11:27:40 +0000 Subject: [PATCH] chore(deps): bump the actions group across 1 directory with 10 updates Bumps the actions group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` | | [azure/setup-helm](https://github.com/azure/setup-helm) | `4` | `5` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `8` | `9` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6` | `7` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) Updates `actions/setup-go` from 5 to 7 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v7) Updates `azure/setup-helm` from 4 to 5 - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](https://github.com/azure/setup-helm/compare/v4...v5) Updates `golangci/golangci-lint-action` from 8 to 9 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/v8...v9) Updates `docker/setup-qemu-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4) Updates `goreleaser/goreleaser-action` from 6 to 7 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: azure/setup-helm dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: golangci/golangci-lint-action dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: goreleaser/goreleaser-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/easyp.yml | 4 ++-- .github/workflows/edge.yml | 10 ++++----- .github/workflows/go.yml | 42 +++++++++++++++++------------------ .github/workflows/release.yml | 18 +++++++-------- 4 files changed, 37 insertions(+), 37 deletions(-) diff --git a/.github/workflows/easyp.yml b/.github/workflows/easyp.yml index 7d2aa4e..3ca07d7 100644 --- a/.github/workflows/easyp.yml +++ b/.github/workflows/easyp.yml @@ -20,7 +20,7 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: EasyP Lint uses: easyp-tech/actions/lint@v1.1.1 with: @@ -36,7 +36,7 @@ jobs: if: github.ref_type != 'tag' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: EasyP Breaking diff --git a/.github/workflows/edge.yml b/.github/workflows/edge.yml index 2ae6d67..31b72da 100644 --- a/.github/workflows/edge.yml +++ b/.github/workflows/edge.yml @@ -45,18 +45,18 @@ jobs: needs: verify runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v3 + - uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ghcr.io/${{ github.repository }} tags: | @@ -70,7 +70,7 @@ jobs: # Not goreleaser: it builds from a tag and would refuse here. The # Dockerfile is the same one the release build uses. - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@v7 with: context: . push: true diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 0673e1b..62f03c5 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -35,9 +35,9 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: # Read the version from go.mod so this never drifts from the module. go-version-file: go.mod @@ -57,9 +57,9 @@ jobs: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -75,9 +75,9 @@ jobs: name: Tidy runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -116,9 +116,9 @@ jobs: --health-retries 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -150,9 +150,9 @@ jobs: name: Vulnerabilities runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -172,9 +172,9 @@ jobs: name: Chart runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: azure/setup-helm@v4 + - uses: azure/setup-helm@v5 # Templates are code nothing else compiles. These checks cover the two # ways that has bitten: a value rendered in a form the service cannot @@ -195,9 +195,9 @@ jobs: name: Chart on a cluster runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: azure/setup-helm@v4 + - uses: azure/setup-helm@v5 - name: Create cluster uses: helm/kind-action@v1 @@ -346,9 +346,9 @@ jobs: name: Generated code is current runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -385,7 +385,7 @@ jobs: name: Secret scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -393,7 +393,7 @@ jobs: # organisation repositories, and refusing to run is worse than the scan # taking a few seconds longer. --redact so a finding does not print the # credential into a public build log. - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -413,9 +413,9 @@ jobs: name: Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: go-version-file: go.mod cache: true @@ -425,7 +425,7 @@ jobs: sdk/go.sum - name: Lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@v9 with: # golangci-lint refuses to start when it is built with an older Go # than the one go.mod targets, so this has to keep up with go.mod. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6036e8b..bb92d63 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,24 +32,24 @@ jobs: # certificate, so nothing long-lived has to be stored as a secret. id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/setup-go@v5 + - uses: actions/setup-go@v7 with: # Read the version from go.mod: the pinned 1.24 had drifted from the # module's 1.26 and only worked via toolchain auto-download. @@ -91,7 +91,7 @@ jobs: # a finding here costs a fix and a re-tag, not a pull from the registry. # The second pass publishes what the first built. - name: Build the release - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: version: '~> v2' args: release --clean --skip=publish --timeout=90m @@ -108,7 +108,7 @@ jobs: severity: HIGH,CRITICAL - name: Publish the release - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@v7 with: # A major-series pin, not `latest`: an unpinned tool is how the lint # job broke, and a release pipeline is the worst place to find that @@ -144,9 +144,9 @@ jobs: permissions: packages: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: azure/setup-helm@v4 + - uses: azure/setup-helm@v5 # Charts are immutable by convention and mutable in fact: an OCI tag can be # overwritten. appVersion equality is enforced above, and nothing enforced