build(deps): bump theupdateframework/tuf-on-ci from 0.8.0 to 0.9.0

[dependabot[bot]]

Bumps theupdateframework/tuf-on-ci from 0.8.0 to 0.9.0.

Release notes

Sourced from theupdateframework/tuf-on-ci's releases.

v0.9.0

GitHub Actions users are adviced to upgrade for safer dependency pinning that should avoid breakage in future.

Changes

• actions: test-repository action has many additional features (#239)
• actions: python package versions are now in logs again (#247)
• signer: Improve signing robustness (#237)
• Dependency updates (including more strictly pinned securesystemslib)

GitHub Actions upgrade instructions

A plain version bump from 0.8 works: Workflows require no changes.

Changelog

Sourced from theupdateframework/tuf-on-ci's changelog.

Changelog

Unreleased

v0.9.0

GitHub Actions users are adviced to upgrade for safer dependency pinning that should avoid breakage in future.

Changes

• actions: test-repository action has many additional features (#239)
• actions: python package versions are now in logs again (#247)
• signer: Improve signing robustness (#237)
• Dependency updates (including more strictly pinned securesystemslib)

GitHub Actions upgrade instructions

A plain version bump from 0.8 works: Workflows require no changes.

v0.8.0

Changes

• Signer now opens PRs in a browser automatically when in non-maintainer signing flow
• Signer now has runtime version checking: A message is printed out if a new version is available
• Actions have dependency updates

GitHub Actions upgrade instructions

A plain version bump from 0.7 works: Workflows require no changes.

v0.7.0

Changes

• Signer has improved signing error handling
• Custom fields in TargetFile metadata are now preserved during target update (this is a workaround mostly for sigstore root-signing legacy artifacts)

Upgrade instructions

A plain version bump from 0.6 works: Workflows require no changes.

v0.6.0

NOTE: please see upgrade instructions below.

... (truncated)

Commits

• ebf63d4 Merge pull request #244 from jku/release-v9
• 1345aaa Release v0.9
• 208148e Merge pull request #247 from jku/pip-install-output
• a69f9f9 Merge pull request #237 from jku/verify-sig-after-signing
• 71cdc03 actions: Improve pip install output
• 551e5f1 Merge pull request #243 from jku/fix-securesystemslib-pinning
• 0cb593a repo, signer: Pin securesystemslib better
• 2ac7c7c Merge pull request #239 from jku/test-repository-improvements
• 16779a7 actions: Add a way to initialize client in test-repository
• 86eff57 actions: Fix a copy-paste bug in test-repository
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[jku]

test-repository action has some new optional inputs we will want to use

• update_base_url: upgrade testing
• valid_days: verifies that new repository is valid x days from now
• valid_offline_days: verifies that root and targets are valid x days from now

but I will file an issue for that