search

Ouranosinc / xclim

Library of derived climate variables, ie climate indicators, based on xarray.
https://xclim.readthedocs.io/en/stable/
Apache License 2.0
333 stars 59 forks source link

Bump the actions group across 1 directory with 7 updates #1979

Closed dependabot[bot] closed 3 weeks ago

dependabot[bot] commented 3 weeks ago

Bumps the actions group with 7 updates in the / directory:

Package From To
actions/checkout 4.2.1 4.2.2
actions/setup-python 5.2.0 5.3.0
crazy-max/ghaction-import-gpg 6.1.0 6.2.0
actions/dependency-review-action 4.3.4 4.4.0
actions/cache 4.1.1 4.1.2
coverallsapp/github-action 2.3.3 2.3.4
pypa/gh-action-pypi-publish 1.10.3 1.11.0

Updates actions/checkout from 4.2.1 to 4.2.2

Release notes

Sourced from actions/checkout's releases.

v4.2.2

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v4.2.1...v4.2.2

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

v4.1.2

v4.1.1

v4.1.0

... (truncated)

Commits


Updates actions/setup-python from 5.2.0 to 5.3.0

Release notes

Sourced from actions/setup-python's releases.

v5.3.0

What's Changed

Bug Fixes:

Enhancements:

New Contributors

Full Changelog: https://github.com/actions/setup-python/compare/v5...v5.3.0

Commits


Updates crazy-max/ghaction-import-gpg from 6.1.0 to 6.2.0

Release notes

Sourced from crazy-max/ghaction-import-gpg's releases.

v6.2.0

Full Changelog: https://github.com/crazy-max/ghaction-import-gpg/compare/v6.1.0...v6.2.0

Commits
  • cb9bde2 Merge pull request #205 from crazy-max/dependabot/npm_and_yarn/openpgp-5.11.2
  • 652ac61 chore: update generated content
  • 0404dfd build(deps): bump openpgp from 5.11.0 to 5.11.2
  • 63a9470 Merge pull request #209 from crazy-max/dependabot/npm_and_yarn/actions/core-1...
  • e3a6456 chore: update generated content
  • f0d6155 Merge pull request #207 from crazy-max/dependabot/npm_and_yarn/micromatch-4.0.8
  • 8812250 build(deps): bump @​actions/core from 1.10.1 to 1.11.1
  • 35465df build(deps): bump micromatch from 4.0.4 to 4.0.8
  • ea88154 Merge pull request #204 from crazy-max/dependabot/github_actions/docker/bake-...
  • 871d8a5 build(deps): bump docker/bake-action from 4 to 5
  • Additional commits viewable in compare view


Updates actions/dependency-review-action from 4.3.4 to 4.4.0

Release notes

Sourced from actions/dependency-review-action's releases.

v4.4.0

What's Changed

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.5...v4.4.0

v4.3.5

What's Changed

New Contributors

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.4...v4.3.5

Commits
  • 4081bf9 Merge pull request #846 from actions/merge-group-bug-fix
  • 03e585e fixing minor typo
  • 08b4117 updating dist code
  • 9c3441f updating dist code
  • 304a544 updating tests
  • e99353b fixing merge_group schema bug
  • a6993e2 Merge pull request #840 from actions/dependabot-updates
  • d92f08b Bump eslint-plugin-jest and ts-jest
  • 3e334b7 Merge pull request #822 from actions/dependabot/npm_and_yarn/got-14.4.2
  • 32b7d88 Merge pull request #832 from actions/jonjanego-patch-3
  • Additional commits viewable in compare view


Updates actions/cache from 4.1.1 to 4.1.2

Release notes

Sourced from actions/cache's releases.

v4.1.2

What's Changed

New Contributors

Full Changelog: https://github.com/actions/cache/compare/v4...v4.1.2

Changelog

Sourced from actions/cache's changelog.

Releases

4.1.2

  • Add GitHub Enterprise Cloud instances hostname filters to inform API endpoint choices - #1474
  • Security fix: Bump braces from 3.0.2 to 3.0.3 - #1475

4.1.1

  • Restore original behavior of cache-hit output - #1467

4.1.0

  • Ensure cache-hit output is set when a cache is missed - #1404
  • Deprecate save-always input - #1452

4.0.2

  • Fixed restore fail-on-cache-miss not working.

4.0.1

  • Updated isGhes check

4.0.0

  • Updated minimum runner version support from node 12 -> node 20

3.3.3

  • Updates @​actions/cache to v3.2.3 to fix accidental mutated path arguments to getCacheVersion actions/toolkit#1378
  • Additional audit fixes of npm package(s)

3.3.2

  • Fixes bug with Azure SDK causing blob downloads to get stuck.

3.3.1

  • Reduced segment size to 128MB and segment timeout to 10 minutes to fail fast in case the cache download is stuck.

3.3.0

  • Added option to lookup cache without downloading it.

3.2.6

  • Fix zstd not being used after zstd version upgrade to 1.5.4 on hosted runners.

3.2.5

... (truncated)

Commits
  • 6849a64 Release 4.1.2 #1477
  • 5a1720c Merge branch 'Link-/prep-4.1.2' of https://github.com/actions/cache into Link...
  • d9fef48 Merge branch 'main' into Link-/prep-4.1.2
  • a50e8d0 Merge branch 'main' into Link-/prep-4.1.2
  • acc9ae5 Merge pull request #1481 from actions/dependabot/github_actions/actions/setup...
  • 1ea5f18 Merge branch 'main' into Link-/prep-4.1.2
  • cc679ff Merge branch 'main' into dependabot/github_actions/actions/setup-node-4
  • 366d43d Merge pull request #1483 from actions/dependabot/github_actions/github/codeql...
  • 02bf319 Bump github/codeql-action from 2 to 3
  • 6f6220b Merge branch 'main' into dependabot/github_actions/actions/setup-node-4
  • Additional commits viewable in compare view


Updates coverallsapp/github-action from 2.3.3 to 2.3.4

Release notes

Sourced from coverallsapp/github-action's releases.

v2.3.4

What's Changed

  • Add coverage-reporter-platform input option by @​afinetooth in coverallsapp/github-action#233
    • Since we have added support for coverage-reporter on aarch64, we need to provide users of our github-action the ability to select this architecture-specific version of coverage-reporter when they're using an aarch64 / arm64 runner in CI.

Full Changelog: https://github.com/coverallsapp/github-action/compare/v2...v2.3.4

Commits


Updates pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.11.0

🔏 Helping you become a trusted supply chain link 🔗

Two months ago, in v1.10.0, @​woodruffw💰 integrated support for generating and uploading PEP 740 digital attestations that can be used as provenance objects when analyzing dependency chains for the integrity.

To make sure it works well, it was implemented as an opt-in, so a relatively small subset of projects was able to try it out, and a few issues have been determined and fixed during this time.

That changes today! This version changes the feature toggle to “on by default”. This means that from now on, every project making use of Trusted Publishing will start producing and publishing digital attestations without having to do any modifications to how they use this action.

@​woodruffw💰 flipped the respective toggle in #277 with the possibility to opt-out.

🛠️ Internal Dependencies

@​woodruffw💰 bumped sigstore to v3.5.1 and pypi-attestations to v0.0.13 in lock files via #276.

🪞 Full Diff: https://github.com/pypa/gh-action-pypi-publish/compare/v1.10.3...v1.11.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to William for working on improving the supply chain provenance in the ecosystem! The overall effort is tracked @ pypi/warehouse#15871.

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @Zeitsperre.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
github-actions[bot] commented 3 weeks ago

[!NOTE] It appears that this Pull Request modifies the main.yml workflow.

On inspection, the XCLIM_TESTDATA_BRANCH environment variable is set to the most recent tag (v2024.8.23).

No further action is required.

dependabot[bot] commented 3 weeks ago

One of your CI runs failed on this pull request, so Dependabot won't merge it.

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

coveralls commented 3 weeks ago

Coverage Status

coverage: 89.377%. remained the same when pulling e8687e331225d36724cc9d09790c3a3ea66d7bd2 on dependabot/github_actions/actions-fe4b5119e2 into d712bc244b301133c7c2911580481e856f17e7ae on main.