Bump theupdateframework/tuf-on-ci from ae7c08473b22b6d5e15025f5c3bf6d4dde5e8074 to 6b4f943b684c385d9ab9d849d72c1c6cb23ffd2f

[dependabot[bot]]

Bumps theupdateframework/tuf-on-ci from ae7c08473b22b6d5e15025f5c3bf6d4dde5e8074 to 6b4f943b684c385d9ab9d849d72c1c6cb23ffd2f.

Changelog

Sourced from theupdateframework/tuf-on-ci's changelog.

Changelog

Unreleased

v0.9.0

GitHub Actions users are adviced to upgrade for safer dependency pinning that should avoid breakage in future.

Changes

• actions: test-repository action has many additional features (#239)
• actions: python package versions are now in logs again (#247)
• signer: Improve signing robustness (#237)
• Dependency updates (including more strictly pinned securesystemslib)

GitHub Actions upgrade instructions

A plain version bump from 0.8 works: Workflows require no changes.

v0.8.0

Changes

• Signer now opens PRs in a browser automatically when in non-maintainer signing flow
• Signer now has runtime version checking: A message is printed out if a new version is available
• Actions have dependency updates

GitHub Actions upgrade instructions

A plain version bump from 0.7 works: Workflows require no changes.

v0.7.0

Changes

• Signer has improved signing error handling
• Custom fields in TargetFile metadata are now preserved during target update (this is a workaround mostly for sigstore root-signing legacy artifacts)

Upgrade instructions

A plain version bump from 0.6 works: Workflows require no changes.

v0.6.0

NOTE: please see upgrade instructions below.

... (truncated)

Commits

• 6b4f943 Merge pull request #273 from theupdateframework/dependabot/github_actions/act...
• 0698658 Merge pull request #271 from theupdateframework/dependabot/github_actions/act...
• 16b094c Merge pull request #272 from theupdateframework/dependabot/github_actions/act...
• a7027b0 build(deps): bump actions/upload-artifact in /actions/upload-repository
• 919b38c build(deps): bump actions/download-artifact from 4.1.4 to 4.1.5
• eb6789d build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.2
• 130c354 Merge pull request #268 from theupdateframework/dependabot/pip/build-dependen...
• 3ea20f7 build(deps): bump hatchling in the build-dependencies group
• 030a747 Merge pull request #266 from theupdateframework/pin-requirements/ff97580
• e2b11b1 repo: Update pinned requirements
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Superseded by #80.