Bump docker/build-push-action from 5 to 6

dependabot[bot] commented 2 months ago

Bumps docker/build-push-action from 5 to 6.

Release notes

Sourced from docker/build-push-action's releases.

v6.0.0

Export build record and generate build summary by @crazy-max in docker/build-push-action#1120

Bump @docker/actions-toolkit from 0.24.0 to 0.26.0 in docker/build-push-action#1132 docker/build-push-action#1136 docker/build-push-action#1138

Bump braces from 3.0.2 to 3.0.3 in docker/build-push-action#1137

[!NOTE] This major release adds support for generating Build summary and exporting build record for your build. You can disable this feature by setting DOCKER_BUILD_NO_SUMMARY: true environment variable in your workflow.

Full Changelog: https://github.com/docker/build-push-action/compare/v5.4.0...v6.0.0

v5.4.0

Show builder information before building by @crazy-max in docker/build-push-action#1128

Handle attestations correctly with provenance and sbom inputs by @crazy-max in docker/build-push-action#1086

Bump @docker/actions-toolkit from 0.19.0 to 0.24.0 in docker/build-push-action#1088 docker/build-push-action#1105 docker/build-push-action#1121 docker/build-push-action#1127

Bump undici from 5.28.3 to 5.28.4 in docker/build-push-action#1090

Full Changelog: https://github.com/docker/build-push-action/compare/v5.3.0...v5.4.0

v5.3.0

Bump @docker/actions-toolkit from 0.18.0 to 0.19.0 in docker/build-push-action#1080

Full Changelog: https://github.com/docker/build-push-action/compare/v5.2.0...v5.3.0

v5.2.0

Disable quotes detection for outputs input by @crazy-max in docker/build-push-action#1074

Warn about ignored inputs by @favonia in docker/build-push-action#1019

Bump @docker/actions-toolkit from 0.14.0 to 0.18.0 in docker/build-push-action#1070

Bump undici from 5.26.3 to 5.28.3 in docker/build-push-action#1057

Full Changelog: https://github.com/docker/build-push-action/compare/v5.1.0...v5.2.0

v5.1.0

Add annotations input by @crazy-max in docker/build-push-action#992

Add secret-envs input by @elias-lundgren in docker/build-push-action#980

Bump @babel/traverse from 7.17.3 to 7.23.2 in docker/build-push-action#991

Bump @docker/actions-toolkit from 0.13.0-rc.1 to 0.14.0 in docker/build-push-action#990 docker/build-push-action#1006

Full Changelog: https://github.com/docker/build-push-action/compare/v5.0.0...v5.1.0

Commits

c382f71 Merge pull request #1120 from crazy-max/build-summary
5a5b70d chore: update generated content
dc24cf9 don't generate summary for cloud driver
667cb22 DOCKER_BUILD_NO_SUMMARY env to disable summary
d880b19 generate build summary
e51051a export build record and upload artifact
86c2bd0 Merge pull request #1137 from docker/dependabot/npm_and_yarn/braces-3.0.3
268d2b1 Merge pull request #1138 from docker/dependabot/npm_and_yarn/docker/actions-t...
2b8dc7f chore: update generated content
840c12b chore(deps): Bump @docker/actions-toolkit from 0.25.1 to 0.26.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions[bot] commented 2 months ago

:mag: Vulnerabilities of `sommerfeldio/source2adoc:e8c1e83b1201e6e77782be2ab697dad279e192fd`

:package: Image Reference sommerfeldio/source2adoc:e8c1e83b1201e6e77782be2ab697dad279e192fd

digest	`sha256:b84e47ecb673f28fbc6820a152b4c96b25197cae0bf4b72354f3feaffbb7176e`
vulnerabilities
size	6.8 MB
packages	21

:package: Base Image alpine:3

also known as	`3.20` `3.20.0` `latest`
digest	`sha256:216266c86fc4dcef5619930bd394245824c2af52fd21ba7c6fa0e618657d4c3b`
vulnerabilities

ssl_client 1.36.1-r28 (apk)

pkg:apk/alpine/ssl_client@1.36.1-r28?arch=x86_64&upstream=busybox&distro=alpine-3.20.0
```dockerfile # Dockerfile (39:39) FROM alpine:3.20.0 AS run ```

Affected range	`<1.36.1-r29`
Fixed version	`1.36.1-r30`
EPSS Score	`0.04%`
EPSS Percentile	`13th percentile`

Description

Affected range	`<1.36.1-r29`
Fixed version	`1.36.1-r30`
EPSS Score	`0.04%`
EPSS Percentile	`13th percentile`

Description

libssl3 3.3.0-r2 (apk)

pkg:apk/alpine/libssl3@3.3.0-r2?arch=x86_64&upstream=openssl&distro=alpine-3.20.0
```dockerfile # Dockerfile (39:39) FROM alpine:3.20.0 AS run ```

Affected range	`<3.3.0-r3`
Fixed version	`3.3.0-r3`

Description

github-actions[bot] commented 2 months ago

Overview

Image reference	`sommerfeldio/source2adoc:rc`	`sommerfeldio/source2adoc:e8c1e83b1201e6e77782be2ab697dad279e192fd`
- digest	`dc77e1e53326`	`b84e47ecb673`
- provenance	https://github.com/sommerfeld-io/source2adoc/commit/dc2b9496fa5374c8cb2f95306921de39ee33c913	https://github.com/sommerfeld-io/source2adoc/commit/e8c1e83b1201e6e77782be2ab697dad279e192fd
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	6.8 MB	6.8 MB (+9 B)
- packages	25	21 (-4)
Base Image	`alpine:3` also known as: • `3.20` • `3.20.0` • `latest`	`alpine:3.20.0` also known as: • `3` • `3.20` • `latest`
- vulnerabilities

Labels (3 changes)

> * `±` 3 changed > * _9 unchanged_ ```diff maintainer=sebastian@sommerfeld.io org.opencontainers.image.authors=source2adoc open source project -org.opencontainers.image.created=2024-06-11T08:34:11.088Z +org.opencontainers.image.created=2024-06-17T19:46:23.365Z org.opencontainers.image.description=Streamline the process of generating AsciiDoc documentation from inline comments within source code files. This tool converts inline documentation into AsciiDoc files, tailored for seamless integration with Antora. org.opencontainers.image.documentation=https://source2adoc.sommerfeld.io org.opencontainers.image.licenses=NOASSERTION -org.opencontainers.image.revision=dc2b9496fa5374c8cb2f95306921de39ee33c913 +org.opencontainers.image.revision=e8c1e83b1201e6e77782be2ab697dad279e192fd org.opencontainers.image.source=https://github.com/sommerfeld-io/source2adoc org.opencontainers.image.title=source2adoc org.opencontainers.image.url=https://github.com/sommerfeld-io/source2adoc org.opencontainers.image.vendor=source2adoc open source project -org.opencontainers.image.version=main +org.opencontainers.image.version=pr-71 ```

Packages and Vulnerabilities (4 package changes and 0 vulnerability changes)

> * :heavy_minus_sign: 3 packages removed > * :infinity: 1 packages changed > * 20 packages unchanged

Changes for packages of type apk (3 changes)

	Package	Version `sommerfeldio/source2adoc:rc`
:heavy_minus_sign:	ca-certificates	`20240226-r0`
:heavy_minus_sign:	openssl	`3.3.0-r2`

		Removed vulnerabilities (1):
:heavy_minus_sign:	pax-utils	`1.3.7-r2`

Changes for packages of type golang (1 changes)

	Package	Version `sommerfeldio/source2adoc:rc`	Version `sommerfeldio/source2adoc:e8c1e83b1201e6e77782be2ab697dad279e192fd`
:infinity:	stdlib	`go1.22.4`	`1.22.4`

sommerfeld-io / source2adoc