search

theupdateframework / tuf-on-ci-template

2 stars 1 forks source link

Bump theupdateframework/tuf-on-ci from 0.6.0 to 0.7.0 #23

Closed dependabot[bot] closed 4 months ago

dependabot[bot] commented 4 months ago

Bumps theupdateframework/tuf-on-ci from 0.6.0 to 0.7.0.

Release notes

Sourced from theupdateframework/tuf-on-ci's releases.

v0.7.0

Changes

  • Signer has improved signing error handling
  • Custom fields in TargetFile metadata are now preserved during target update (this is a workaround mostly for sigstore root-signing legacy artifacts)

Upgrade instructions

A plain version bump from 0.6 works: Workflows require no changes.

Changelog

Sourced from theupdateframework/tuf-on-ci's changelog.

Changelog

Unreleased

v0.7.0

Changes

  • Signer has improved signing error handling
  • Custom fields in TargetFile metadata are now preserved during target update (this is a workaround mostly for sigstore root-signing legacy artifacts)

Upgrade instructions

A plain version bump from 0.6 works: Workflows require no changes.

v0.6.0

NOTE: please see upgrade instructions below.

Changes

  • Signing events now happen in GitHub pull requests
  • Signer now probes for PKCS11 module: configuring that is no longer required, as long as as the module is in one of the expected locations.

Upgrade instructions

  • As usual we recommend copying your workflows from https://github.com/theupdateframework/tuf-on-ci-template/.
    • signing event action no longer needs issues: write permission but instead requires pull-requests: write
  • Custom token users need to create a new token with an additional permission Pull requests: write
  • Settings->Actions->General->Allow GitHub Actions to create and approve pull requests needs to be enabled in repository settings (not required if a custom token is used)

v0.5.0

NOTE: Do not accept a dependabot upgrade, please see upgrade instructions.

This release contains improved failure handling and testing.

Changes

  • New action test-repository: This new action enables smoke testing every published repository with a TUF client.
  • New action update-issue: This action enables automated filing of

... (truncated)

Commits
  • 3a44844 Merge pull request #197 from jku/release-0.7
  • 64c4419 Release 0.7.0
  • ef2d953 Merge pull request #193 from jku/preserve-custom-metadata-in-target-files
  • 4974744 Merge pull request #196 from theupdateframework/dependabot/github_actions/act...
  • 731989f build(deps): bump google-github-actions/auth in /actions/online-sign
  • 5cb2aac Merge pull request #195 from jku/better-sign-failure-handling
  • 5458bed Merge pull request #194 from jku/lint-improvements
  • e8270fd signer: Simplification with assignment expression
  • c4fcda3 lint: Enable more rulesets
  • 8a3224c signer: Improve failure handling during sign
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)