:seedling: Bump github.com/rhysd/actionlint from 1.6.27 to 1.7.1

dependabot[bot] commented 4 months ago

Bumps github.com/rhysd/actionlint from 1.6.27 to 1.7.1.

Release notes

Sourced from github.com/rhysd/actionlint's releases.

v1.7.1
Support ubuntu-24.04 runner label, which was recently introduced as beta. (#425, thanks @bitcoin-tools)

Remove the support for macos-10 runner label which was officially dropped about 2 years ago.

Remove the support for windows-2016 runner label which was officially dropped about 2 years ago.

Document URLs used in help output and links in the playground prefer specific version tag rather than main branch. For example,

Before: https://github.com/rhysd/actionlint/tree/main/docs

After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
Fix actionlint wrongly reports an error when using ghcr.io or docker.io at image field of action metadata file of Docker action without docker:// scheme. (#428)
runs:
  using: 'docker'
  # This should be OK
  image: 'ghcr.io/user/repo:latest'
Fix checking preactjs/compressed-size-action@v2 usage caused a false positive. (#422)

Fix an error message when invalid escaping is found in globs.

The design of the playground page is overhauled following the upgrade of bulma package to v1.

Current actionlint version is shown in the heading.

The color theme is changed to the official dark theme.

The list of useful links is added to the bottom of the page as 'Resources' section.
v1.7.0
From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.
name: 'My action'
author: '...'
# ERROR: 'description' section is missing
branding:
ERROR: Invalid icon name
icon: dog
runs:
ERROR: Node.js runtime version is too old
using: 'node12'
ERROR: The source file being run by this action does not exist
main: 'this-file-does-not-exist.js'
ERROR: 'env' configuration is only allowed for Docker actions
env:
SOME_VAR: SOME_VALUE
actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.

Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
Add runner.environment property. (#412)
- run: echo 'Run by GitHub-hosted runner'
  if: runner.environment == 'github-hosted'
Using outdated popular actions is now detected at error. See the document for more details.

... (truncated)

Changelog

Sourced from github.com/rhysd/actionlint's changelog.

v1.7.1 - 28 May 2024
Support ubuntu-24.04 runner label, which was recently introduced as beta. (#425, thanks @bitcoin-tools)

Remove the support for macos-10 runner label which was officially dropped about 2 years ago.

Remove the support for windows-2016 runner label which was officially dropped about 2 years ago.

Document URLs used in help output and links in the playground prefer specific version tag rather than main branch. For example,

Before: https://github.com/rhysd/actionlint/tree/main/docs

After: https://github.com/rhysd/actionlint/tree/v1.7.1/docs
Fix actionlint wrongly reports an error when using ghcr.io or docker.io at image field of action metadata file of Docker action without docker:// scheme. (#428)
runs:
  using: 'docker'
  # This should be OK
  image: 'ghcr.io/user/repo:latest'
Fix checking preactjs/compressed-size-action@v2 usage caused a false positive. (#422)

Fix an error message when invalid escaping is found in globs.

The design of the playground page is overhauled following the upgrade of bulma package to v1.

Current actionlint version is shown in the heading.

The color theme is changed to the official dark theme.

The list of useful links is added to the bottom of the page as 'Resources' section.
[Changes][v1.7.1]

v1.7.0 - 08 May 2024
From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.
name: 'My action'
author: '...'
# ERROR: 'description' section is missing
branding:
ERROR: Invalid icon name
icon: dog
runs:
ERROR: Node.js runtime version is too old
using: 'node12'
ERROR: The source file being run by this action does not exist
main: 'this-file-does-not-exist.js'
ERROR: 'env' configuration is only allowed for Docker actions
env:
SOME_VAR: SOME_VALUE
actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.

Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.

... (truncated)

Commits

62dc61a bump up version to v1.7.1
95b7390 describe testing in CONTRIBUTING.md
dbe4c46 update Go and playground dependencies to the latest
10e833c fix ghcr.io/ and docker.io Docker images are not allowed at image in ac...
c33463f Merge pull request #429 from rhysd/ci/9231952028
9abf560 update generated files by go generate on CI
92535a2 prefer document URL at specific version tag
4c3740e remove windows-2016 runner label support which was dropped in 2022
b879f2b fix indirect package import
a1ff3f7 Merge pull request #426 from rhysd/ci/9136328169
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

netlify[bot] commented 4 months ago

Deploy Preview for ossf-scorecard canceled.

Name	Link
Latest commit	ab1a35710bd2df2d76604ac5792cbe936d61eb5a
Latest deploy log	https://app.netlify.com/sites/ossf-scorecard/deploys/66ba9022ce1cd80008ac11c3

justaugustus commented 3 months ago

@dependabot rebase

spencerschrock commented 1 month ago

@dependabot rebase

dependabot[bot] commented 1 month ago

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

ossf / scorecard-webapp