trailofbits / uthenticode

A cross-platform library for verifying Authenticode signatures
https://trailofbits.github.io/uthenticode/
MIT License
133 stars 33 forks source link

build(deps): bump lukka/run-vcpkg from 6 to 10 #65

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps lukka/run-vcpkg from 6 to 10.

Release notes

Sourced from lukka/run-vcpkg's releases.

run-vcpkg@v10.1 - fixes to post-action, hash for vcpkg-configuration.json

Changes:

  • The status of the job cannot be fetched correctly hence in any way. Hence the doNotCacheOnWorkflowFailure input is dropped and the action is not trying to detect a cancelled workflow with the intent of skipping the save of the cache (useful to avoid saving a partial cache). Now the cache is saved on the post action when:

    • the run-vcpkg execution succeeded.
    • there was a cache-miss.

    Users could implement their own logic and set the RUNVCPKG_NO_CACHE environment variable in any step of the workflow to force the post action to skip saving the cache.

  • The vcpkg-configuration.json file is automatically hashed and added to the cache key whenever found side by side with the hashed vcpkg.json file.

  • Disabled vcpkg's telemetry by default. It can be overridden by defining the environment variable VCPKG_ENABLE_METRICS.

run-vcpkg@v10 - support for manifest mode (vcpkg.json) as first class citizen

Changes:

  • Redesigned the inputs of run-vcpkg in order to support vcpkg's manifest mode: vcpkg.json.
  • Simplified and minimized the set of inputs of the action. Now the default is to not run vcpkg, but to let it run at run-cmake execution time (i.e. when CMake is generating project files).
  • Automatic hash on vcpkg.json for contributing to the key of vcpkg's artifact caching.
  • Automatic computation of primary and fallback keys for maximizing reuse of the cache.

run-vcpkg@v7.5 - Servicing fixes

Changes:

Fixes for deprecated features for GitHub runners:

Note: to keep your workflow up to date with bug and security fixes, just use the v7 branch to stay on the most recent v7.x version of this action, e.g., uses: lukka/run-vcpkg@v7

run-vcpkg@v7.4 - Fix diagnostic log automatic collection

Changes:

Fixes for #83

Note: to keep your workflow up to date with bug and security fixes, just use the v7 branch to stay on the most recent v7.x version of this action, e.g., uses: lukka/run-vcpkg@v7

run-vcpkg@v7.3 - dump CMakeOutput.log and vcpkg's log into the workflow log

Changes:

The run-vcpkg action accepts a list of regular expressions (in logCollectionRegExps input) that are used to identify log files and dump their content in the workflow log, to ease diagnosing failures. The default regular expressions are for CMake and vcpkg generated log files.

Note: to keep your workflow up to date with bug and security fixes, just use the v7 branch to stay on the most recent v7.x version of this action, e.g., uses: lukka/run-vcpkg@v7

run-vcpkg@v7.2 - check for vcpkgCommitId

Changes:

Fix for #80, that is a fatal check for vcpkgCommitId being a valid SHA1 hash (40 hex digits) is implemented. Improved the documentation about vcpkgCommitId.

Note: to keep your workflow up to date with bug and security fixes, just use the v7 branch to stay on the most recent v7.x version of this action, e.g., uses: lukka/run-vcpkg@v7

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)