Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes
Thanks to contributions from @cynthia-sg and @tegioz at CLOMonitor, there is a new Scorecard Result visualization page at https://securityscorecards.dev/viewer/?uri=<project-url>.
Scorecard action will retry when signing results and submitting them to our web API. This should help with flakiness from connection failures. (ossf/scorecard-action#1191)
The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.
ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the github-actions group with 4 updates: actions/checkout, github/codeql-action, ossf/scorecard-action and actions/upload-artifact.
Updates
actions/checkout
from 2 to 4Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
b4ffde6
Link to release page from what's new section (#1514)8530928
Correct link to GitHub Docs (#1511)7cdaf2f
Update CODEOWNERS to Launch team (#1510)8ade135
Prepare 4.1.0 release (#1496)c533a0a
Add support for partial checkout filters (#1396)72f2cec
Update README.md for V4 (#1452)3df4ab1
Release 4.0.0 (#1447)8b5e8b7
Support fetching without the --progress option (#1067)97a652b
Update default runtime to node20 (#1436)f43a0e5
Release 3.6.0 (#1437)Updates
github/codeql-action
from 2 to 3Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Commits
e86ee7f
fix typo in comment4f9fb97
update wording of deprecation warninga854253
ensure deprecation warning is only shown once per jobf72cffc
add v2 deprecation warningd13ca04
Merge pull request #2090 from github/mergeback/v3.23.1-to-main-0b21cf24475e2af
Update checked-in dependenciesUpdates
ossf/scorecard-action
from 2.1.2 to 2.3.1Release notes
Sourced from ossf/scorecard-action's releases.
... (truncated)
Commits
0864cf1
:seedling: Bump docker tag to for v2.3.1 release (#1284)72df3bf
:seedling: Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 (#1282)0ea411f
:seedling: Bump the docker-images group with 1 update (#1281)dbfd042
:seedling: Bump the github-actions group with 1 update (#1280)2fa1e2f
:seedling: Bump golang.org/x/net from 0.16.0 to 0.17.0 (#1278)652ddd0
:seedling: Bump github.com/google/go-cmp from 0.5.9 to 0.6.0 (#1277)28d0c92
:seedling: Group Dependabot updates for GitHub Actions and Dockerfiles (#1276)cb50491
:seedling: Bump distroless/base froma35b652
tob31a6e0
(#1275)87157ac
:seedling: Bump github/codeql-action from 2.21.9 to 2.22.1 (#1274)7c1648b
:seedling: Bump step-security/harden-runner from 2.5.1 to 2.6.0 (#1273)Updates
actions/upload-artifact
from 3.1.0 to 4.3.0Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
26f96df
Merge pull request #505 from actions/robherley/merge-artifacts530ed2c
use correct artifact name in test53ef698
add additional integration test for merge all behavior90b0f8e
add workflow to test merging199a58f
more docs3f353f9
ncc997fffa
add merge artifact sub-action52899c8
Merge pull request #504 from actions/robherley/reorganizeda58a3f
ncc1f64adb
fix importDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show