Bump the action-packages group across 1 directory with 6 updates

[dependabot[bot]]

Bumps the action-packages group with 6 updates in the / directory:

Package	From	To
actions/checkout	3	4
docker/build-push-action	5	6
mikefarah/yq	4.44.1	4.44.2
step-security/harden-runner	2.8.0	2.8.1
actions/dependency-review-action	4.3.2	4.3.3
codecov/codecov-action	4.4.1	4.5.0

Updates actions/checkout from 3 to 4

Release notes

Sourced from actions/checkout's releases.

v4.0.0

What's Changed

• Update default runtime to node20 by @​takost in actions/checkout#1436
• Support fetching without the --progress option by @​simonbaird in actions/checkout#1067
• Release 4.0.0 by @​takost in actions/checkout#1447

New Contributors

• @​takost made their first contribution in actions/checkout#1436
• @​simonbaird made their first contribution in actions/checkout#1067

Full Changelog: https://github.com/actions/checkout/compare/v3...v4.0.0

v3.6.0

What's Changed

• Mark test scripts with Bash'isms to be run via Bash by @​dscho in actions/checkout#1377
• Add option to fetch tags even if fetch-depth > 0 by @​RobertWieczoreck in actions/checkout#579
• Release 3.6.0 by @​luketomlinson in actions/checkout#1437

New Contributors

• @​RobertWieczoreck made their first contribution in actions/checkout#579
• @​luketomlinson made their first contribution in actions/checkout#1437

Full Changelog: https://github.com/actions/checkout/compare/v3.5.3...v3.6.0

v3.5.3

What's Changed

• Fix: Checkout Issue in self hosted runner due to faulty submodule check-ins by @​megamanics in actions/checkout#1196
• Fix typos found by codespell by @​DimitriPapadopoulos in actions/checkout#1287
• Add support for sparse checkouts by @​dscho and @​dfdez in actions/checkout#1369
• Release v3.5.3 by @​TingluoHuang in actions/checkout#1376

New Contributors

• @​megamanics made their first contribution in actions/checkout#1196
• @​DimitriPapadopoulos made their first contribution in actions/checkout#1287
• @​dfdez made their first contribution in actions/checkout#1369

Full Changelog: https://github.com/actions/checkout/compare/v3...v3.5.3

v3.5.2

What's Changed

• Fix: Use correct API url / endpoint in GHES by @​fhammerl in actions/checkout#1289 based on #1286 by @​1newsr

Full Changelog: https://github.com/actions/checkout/compare/v3.5.1...v3.5.2

v3.5.1

What's Changed

• Improve checkout performance on Windows runners by upgrading @​actions/github dependency by @​BrettDong in actions/checkout#1246

New Contributors

• @​BrettDong made their first contribution in actions/checkout#1246

... (truncated)

Commits

• 692973e Prepare 4.1.7 release (#1775)
• 6ccd57f Pin actions/checkout's own workflows to a known, good, stable version. (#1776)
• b17fe1e Handle hidden refs (#1774)
• b80ff79 Bump actions/checkout from 3 to 4 (#1697)
• b1ec302 Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1739)
• a5ac7e5 Update for 4.1.6 release (#1733)
• 24ed1a3 Check platform for extension (#1732)
• 44c2b7a README: Suggest user.email to be `41898282+github-actions[bot]@​users.norepl...
• 8459bc0 Bump actions/upload-artifact from 2 to 4 (#1695)
• 3f603f6 Bump actions/setup-node from 1 to 4 (#1696)
• Additional commits viewable in compare view

Updates docker/build-push-action from 5 to 6

Release notes

Sourced from docker/build-push-action's releases.

v6.0.0

• Export build record and generate build summary by @​crazy-max in docker/build-push-action#1120
• Bump @​docker/actions-toolkit from 0.24.0 to 0.26.0 in docker/build-push-action#1132 docker/build-push-action#1136 docker/build-push-action#1138
• Bump braces from 3.0.2 to 3.0.3 in docker/build-push-action#1137

[!NOTE] This major release adds support for generating Build summary and exporting build record for your build. You can disable this feature by setting DOCKER_BUILD_NO_SUMMARY: true environment variable in your workflow.

Full Changelog: https://github.com/docker/build-push-action/compare/v5.4.0...v6.0.0

v5.4.0

• Show builder information before building by @​crazy-max in docker/build-push-action#1128
• Handle attestations correctly with provenance and sbom inputs by @​crazy-max in docker/build-push-action#1086
• Bump @​docker/actions-toolkit from 0.19.0 to 0.24.0 in docker/build-push-action#1088 docker/build-push-action#1105 docker/build-push-action#1121 docker/build-push-action#1127
• Bump undici from 5.28.3 to 5.28.4 in docker/build-push-action#1090

Full Changelog: https://github.com/docker/build-push-action/compare/v5.3.0...v5.4.0

v5.3.0

• Bump @​docker/actions-toolkit from 0.18.0 to 0.19.0 in docker/build-push-action#1080

Full Changelog: https://github.com/docker/build-push-action/compare/v5.2.0...v5.3.0

v5.2.0

• Disable quotes detection for outputs input by @​crazy-max in docker/build-push-action#1074
• Warn about ignored inputs by @​favonia in docker/build-push-action#1019
• Bump @​docker/actions-toolkit from 0.14.0 to 0.18.0 in docker/build-push-action#1070
• Bump undici from 5.26.3 to 5.28.3 in docker/build-push-action#1057

Full Changelog: https://github.com/docker/build-push-action/compare/v5.1.0...v5.2.0

v5.1.0

• Add annotations input by @​crazy-max in docker/build-push-action#992
• Add secret-envs input by @​elias-lundgren in docker/build-push-action#980
• Bump @​babel/traverse from 7.17.3 to 7.23.2 in docker/build-push-action#991
• Bump @​docker/actions-toolkit from 0.13.0-rc.1 to 0.14.0 in docker/build-push-action#990 docker/build-push-action#1006

Full Changelog: https://github.com/docker/build-push-action/compare/v5.0.0...v5.1.0

Commits

• c382f71 Merge pull request #1120 from crazy-max/build-summary
• 5a5b70d chore: update generated content
• dc24cf9 don't generate summary for cloud driver
• 667cb22 DOCKER_BUILD_NO_SUMMARY env to disable summary
• d880b19 generate build summary
• e51051a export build record and upload artifact
• 86c2bd0 Merge pull request #1137 from docker/dependabot/npm_and_yarn/braces-3.0.3
• 268d2b1 Merge pull request #1138 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 2b8dc7f chore: update generated content
• 840c12b chore(deps): Bump @​docker/actions-toolkit from 0.25.1 to 0.26.0
• Additional commits viewable in compare view

Updates mikefarah/yq from 4.44.1 to 4.44.2

Release notes

Sourced from mikefarah/yq's releases.

v4.44.2

• Handle numbers with underscores #2039
• Unique now works on maps and arrays #2068
• Added support for short hand splat with env[] expression #2071, as well as many other operators (split,select,eval,pick..)
• Bumped dependencies

Changelog

Sourced from mikefarah/yq's changelog.

4.44.2:

• Handle numbers with underscores #2039
• Unique now works on maps and arrays #2068
• Added support for short hand splat with env[] expression #2071, as well as many other operators (split,select,eval,pick..)
• Bumped dependencies

Commits

• f15500b Bumping version
• b8aec71 Preparing release
• 68aafb6 Handle numbers with underscores #2039
• d58870b Adding splat[] short hand to explode,collect,flatten,groupby,path,pivot,selec...
• f1964de Adding splat[] short hand to collect,eval,map,omit,path,pick
• 45eda8d Added support for shorthand splat[] for filter,reverse,sort,shuffle
• d9af2dd Support env[] expression #2071
• 7bad2f4 Adding back in commented tests :facepalm
• 3ea19ad clean code
• 42120e1 Unique now works on maps and arrays #2068
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.8.0 to 2.8.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.8.1

What's Changed

• Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in step-security/harden-runner#425 The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: https://github.com/step-security/harden-runner/compare/v2...v2.8.1

Commits

• 17d0e2b Merge pull request #425 from step-security/rc-9
• bb112d0 Update isGitHubHosted implementation
• f4f3f44 Merge pull request #407 from step-security/dependabot/github_actions/actions/...
• 7a946b5 Bump actions/dependency-review-action from 3.1.3 to 4.3.2
• 75a01c2 Merge pull request #417 from step-security/dependabot/github_actions/step-sec...
• 53413f1 Bump step-security/harden-runner from 2.7.1 to 2.8.0
• See full diff in compare view

Updates actions/dependency-review-action from 4.3.2 to 4.3.3

Release notes

Sourced from actions/dependency-review-action's releases.

Notes for v4.3.3

What's Changed

• Allow slashes in purl package names by @​juxtin in actions/dependency-review-action#765
• use the v3 version of the deps.dev API by @​josieang in actions/dependency-review-action#741
• PR with suggestions - [Improvement]: Help streamline / simplify dependency review action README by @​am-stead in actions/dependency-review-action#773
• fix show-openssf-scorecard-levels input by @​ramann in actions/dependency-review-action#776
• Updates to the contribution guidelines by @​jonjanego in actions/dependency-review-action#778
• Create issue templates by @​jonjanego in actions/dependency-review-action#777
• Fix the max comment length issue by @​jhutchings1 and @​elireisman in actions/dependency-review-action#767
• Bump project version to 4.3.3 in prep for a release by @​elireisman in actions/dependency-review-action#781

New Contributors

• @​josieang made their first contribution in actions/dependency-review-action#741
• @​am-stead made their first contribution in actions/dependency-review-action#773
• @​ramann made their first contribution in actions/dependency-review-action#776

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.3.2...v4.3.3

Commits

• 72eb03d Merge pull request #781 from actions/release-v4.3.3
• 137d8b4 bump to version v4.3.3
• e6b618e Merge pull request #767 from actions/max-comment-length
• 3c42649 fix ws for linter
• 8e6ea8d update packaging
• 1b3d277 post-review: add PR comment full summary test case
• 220872c Update src/main.ts
• 087d0f8 repackage to update dist
• 4531204 whitespace
• df1ca89 appease linter
• Additional commits viewable in compare view

Updates codecov/codecov-action from 4.4.1 to 4.5.0

Commits

• e28ff12 chore(release): bump to 4.5.0 (#1477)
• 7594baa Use an existing token even if the PR is from a fork (#1471)
• 81c0a51 feat: add support for tokenless v3 (#1410)
• f5e203f build(deps-dev): bump @​typescript-eslint/eslint-plugin from 7.12.0 to 7.13.0 ...
• 7c48363 build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#1475)
• 69e5d09 build(deps-dev): bump @​typescript-eslint/parser from 7.12.0 to 7.13.0 (#1474)
• feaf700 fix: handle trailing commas (#1470)
• 7b6a727 build(deps): bump github/codeql-action from 3.25.7 to 3.25.8 (#1472)
• ccf7a1f build(deps-dev): bump @​typescript-eslint/eslint-plugin from 7.11.0 to 7.12.0 ...
• f03f015 build(deps-dev): bump @​typescript-eslint/parser from 7.11.0 to 7.12.0 (#1467)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

[dependabot[bot]]

Looks like these dependencies are updatable in another way, so this is no longer needed.