search

kommendorkapten / tuf-repo-test-4

0 stars 1 forks source link

Bump theupdateframework/tuf-on-ci from ae7c08473b22b6d5e15025f5c3bf6d4dde5e8074 to 130c354cb0397564707fa1471ed2056e541cc5ca #78

Closed dependabot[bot] closed 6 months ago

dependabot[bot] commented 6 months ago

Bumps theupdateframework/tuf-on-ci from ae7c08473b22b6d5e15025f5c3bf6d4dde5e8074 to 130c354cb0397564707fa1471ed2056e541cc5ca.

Changelog

Sourced from theupdateframework/tuf-on-ci's changelog.

Changelog

Unreleased

v0.9.0

GitHub Actions users are adviced to upgrade for safer dependency pinning that should avoid breakage in future.

Changes

  • actions: test-repository action has many additional features (#239)
  • actions: python package versions are now in logs again (#247)
  • signer: Improve signing robustness (#237)
  • Dependency updates (including more strictly pinned securesystemslib)

GitHub Actions upgrade instructions

A plain version bump from 0.8 works: Workflows require no changes.

v0.8.0

Changes

  • Signer now opens PRs in a browser automatically when in non-maintainer signing flow
  • Signer now has runtime version checking: A message is printed out if a new version is available
  • Actions have dependency updates

GitHub Actions upgrade instructions

A plain version bump from 0.7 works: Workflows require no changes.

v0.7.0

Changes

  • Signer has improved signing error handling
  • Custom fields in TargetFile metadata are now preserved during target update (this is a workaround mostly for sigstore root-signing legacy artifacts)

Upgrade instructions

A plain version bump from 0.6 works: Workflows require no changes.

v0.6.0

NOTE: please see upgrade instructions below.

... (truncated)

Commits
  • 130c354 Merge pull request #268 from theupdateframework/dependabot/pip/build-dependen...
  • 3ea20f7 build(deps): bump hatchling in the build-dependencies group
  • 030a747 Merge pull request #266 from theupdateframework/pin-requirements/ff97580
  • e2b11b1 repo: Update pinned requirements
  • e8b58cb Merge pull request #255 from jku/workflow-improvements
  • dacbb6d Dependabot: Tweak pip ecosystem handling
  • 4f86de1 signer: Add missing init.py
  • 6f3d7ff workflow: Update CI workflow
  • bde9e55 Merge pull request #238 from kipz/kipz/deep-targets
  • 64e236f tests: Add a missing expected test result
  • Additional commits viewable in compare view


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 6 months ago

Superseded by #79.