dependabot[bot]
85ceff2383
chore(deps): bump the github-actions group across 1 directory with 7 updates ( #11642 )
...
Bumps the github-actions group with 7 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `7.0.0` | `7.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.32.5` | `4.35.4` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `8.0.0` | `8.0.1` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) | `2.5.0` | `3.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.2.0` | `6.4.0` |
| [vedantmgoyal9/winget-releaser](https://github.com/vedantmgoyal9/winget-releaser ) | `19e706d4c9121098010096f9c495a70a7518b30f` | `7bd472be23763def6e16bd06cc8b1cdfab0e2fd5` |
| [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action ) | `2.1.26` | `2.2.0` |
Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
Updates `github/codeql-action` from 4.32.5 to 4.35.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/c793b717bc78562f491db7b0e93a3a178b099162...68bde559dea0fdcac2102bfdf6230c5f70eb485e )
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c )
Updates `softprops/action-gh-release` from 2.5.0 to 3.0.0
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/a06a81a03ee405af7f2048a818ed3f03bbf83c7b...b4309332981a82ec1c5618f44dd2e27cc8bfbfda )
Updates `actions/setup-node` from 6.2.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `vedantmgoyal9/winget-releaser` from 19e706d4c9121098010096f9c495a70a7518b30f to 7bd472be23763def6e16bd06cc8b1cdfab0e2fd5
- [Release notes](https://github.com/vedantmgoyal9/winget-releaser/releases )
- [Commits](https://github.com/vedantmgoyal9/winget-releaser/compare/19e706d4c9121098010096f9c495a70a7518b30f...7bd472be23763def6e16bd06cc8b1cdfab0e2fd5 )
Updates `cbrgm/mastodon-github-action` from 2.1.26 to 2.2.0
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases )
- [Commits](https://github.com/cbrgm/mastodon-github-action/compare/fc8b40e2ec9e8208654b0bd8695e03ecc3364d7d...776364a15dd1171530479600c75363f7cbc89ef5 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: cbrgm/mastodon-github-action
dependency-version: 2.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-version: 4.35.4
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: vedantmgoyal9/winget-releaser
dependency-version: 7bd472be23763def6e16bd06cc8b1cdfab0e2fd5
dependency-type: direct:production
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-15 21:39:30 +02:00
Zoltan Kochan
6b2a955a15
ci: address zizmor findings across workflows ( #11608 )
...
Resolves all 30 zizmor alerts reported on main after #11607 :
- template-injection (19): move `${{ ... }}` interpolations in `run:` blocks
to `env:` so untrusted-ish values (workflow_dispatch inputs, github.ref_name,
github.actor) can't break out of shell quoting.
- artipacked (8): add `persist-credentials: false` to `actions/checkout` in
audit, benchmark, ci, codeql-analysis, docker, release, test workflows.
`update-lockfile.yml` keeps the persisted token (later step pushes to a
branch) with a `zizmor: ignore[artipacked]` comment and justification.
- dependabot-cooldown (1): add a 7-day cooldown so brand-new (potentially
malicious) Actions releases don't get auto-PR'd day-of-release.
- ref-version-mismatch (1): `bluwy/release-for-reddit-action` SHA pointed at
the `v2` tag, not a non-existent `v2.0.0`. Fix the comment.
- superfluous-actions (1): mark `softprops/action-gh-release` with a
`zizmor: ignore` and justification — the release pipeline is sensitive and
the action is battle-tested; we're not swapping it for `gh release` here.
Verified locally with `zizmor --persona regular .github` (online audits on):
No findings to report. Good job! (2 ignored, 32 suppressed)
---
Written by an agent (Claude Code, claude-opus-4-7).
2026-05-12 22:03:41 +02:00
dependabot[bot]
28daa2cb2e
build(deps): bump the github-actions group across 1 directory with 4 updates ( #10833 )
...
Bumps the github-actions group with 4 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact ), [actions/download-artifact](https://github.com/actions/download-artifact ), [github/codeql-action](https://github.com/github/codeql-action ) and [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action ).
Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 )
Updates `github/codeql-action` from 4.31.11 to 4.32.5
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/19b2f06db2b6f5108140aeb04014ef02b648f789...c793b717bc78562f491db7b0e93a3a178b099162 )
Updates `cbrgm/mastodon-github-action` from 2.1.23 to 2.1.26
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases )
- [Commits](https://github.com/cbrgm/mastodon-github-action/compare/3ebdc72dcd894e1be460179eb0d01835f3689b2f...fc8b40e2ec9e8208654b0bd8695e03ecc3364d7d )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/download-artifact
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-version: 4.32.5
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: cbrgm/mastodon-github-action
dependency-version: 2.1.26
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-02 23:53:39 +01:00
dependabot[bot]
cda7187dbd
chore(deps): bump the github-actions group across 1 directory with 5 updates ( #10518 )
...
Bumps the github-actions group with 5 updates in the / directory:
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-26 15:06:30 +01:00
dependabot[bot]
226e22392b
chore(deps): bump github/codeql-action in the github-actions group ( #10320 )
...
Bumps the github-actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action ).
Updates `github/codeql-action` from 4.31.7 to 4.31.8
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/cf1bb45a277cb3c205638b2cd5c984db1c46a412...1b168cd39490f61582a9beae412bb7057a6b2c4e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.8
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-22 12:24:37 +01:00
dependabot[bot]
b6dc9439ae
chore(deps): bump the github-actions group across 1 directory with 5 updates ( #10291 )
...
Bumps the github-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `6.0.0` | `6.0.1` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.31.5` | `4.31.7` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) | `2.4.2` | `2.5.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.0.0` | `6.1.0` |
| [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action ) | `2.1.21` | `2.1.22` |
Updates `actions/checkout` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...8e8c483db84b4bee98b60c0593521ed34d9990e8 )
Updates `github/codeql-action` from 4.31.5 to 4.31.7
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/fdbfb4d2750291e159f0156def62b853c2798ca2...cf1bb45a277cb3c205638b2cd5c984db1c46a412 )
Updates `softprops/action-gh-release` from 2.4.2 to 2.5.0
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/5be0e66d93ac7ed76da52eca8bb058f665c3a5fe...a06a81a03ee405af7f2048a818ed3f03bbf83c7b )
Updates `actions/setup-node` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/2028fbc5c25fe9cf00d9f06a71cc4710d4507903...395ad3262231945c25e8478fd5baf05154b1d79f )
Updates `cbrgm/mastodon-github-action` from 2.1.21 to 2.1.22
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases )
- [Commits](https://github.com/cbrgm/mastodon-github-action/compare/96ff691bc465fd7654dfb68697f94465125a7e21...771a3605941f6e3e8a900efed5807d3e74586e1c )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-version: 4.31.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: softprops/action-gh-release
dependency-version: 2.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: cbrgm/mastodon-github-action
dependency-version: 2.1.22
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-08 15:25:20 +01:00
dependabot[bot]
ad0cfad1b8
chore(deps): bump the github-actions group across 1 directory with 2 updates ( #10229 )
...
Bumps the github-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ) and [github/codeql-action](https://github.com/github/codeql-action ).
Updates `actions/checkout` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 )
Updates `github/codeql-action` from 4.31.2 to 4.31.5
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...fdbfb4d2750291e159f0156def62b853c2798ca2 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-version: 4.31.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-24 15:02:57 +01:00
dependabot[bot]
5e65855aa8
chore(deps): bump the github-actions group across 1 directory with 2 updates ( #10152 )
...
Bumps the github-actions group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action ) and [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action ).
Updates `github/codeql-action` from 4.30.9 to 4.31.2
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/16140ae1a102900babc80a33c44059580f687047...0499de31b99561a6d14a36a5f662c2a54f91beee )
Updates `cbrgm/mastodon-github-action` from 2.1.20 to 2.1.21
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases )
- [Commits](https://github.com/cbrgm/mastodon-github-action/compare/92418eedbe66fd0e5252a752c49e4f29f7787978...96ff691bc465fd7654dfb68697f94465125a7e21 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: cbrgm/mastodon-github-action
dependency-version: 2.1.21
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-05 11:48:42 +01:00
Ryo Matsukawa
5ebc45bcc2
chore: pin actions for security ( #10111 )
2025-10-22 13:36:19 +02:00
dependabot[bot]
f3195f0de8
chore(deps): bump the github-actions group with 2 updates ( #10085 )
...
Bumps the github-actions group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup ) and [github/codeql-action](https://github.com/github/codeql-action ).
Updates `pnpm/action-setup` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/v4.1.0...v4.2.0 )
Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-13 14:15:58 +02:00
dependabot[bot]
077a569307
chore(deps): bump actions/checkout in the github-actions group ( #9901 )
...
Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout ).
Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 17:51:20 +02:00
dependabot[bot]
f97ff6bf16
chore(deps): bump the github-actions group with 6 updates ( #8008 )
...
Bumps the github-actions group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `3` | `4` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `3` | `4` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `2` | `3` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) | `1` | `2` |
| [bluwy/release-for-reddit-action](https://github.com/bluwy/release-for-reddit-action ) | `1` | `2` |
| [cbrgm/mastodon-github-action](https://github.com/cbrgm/mastodon-github-action ) | `1` | `2` |
Updates `actions/checkout` from 3 to 4
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v3...v4 )
Updates `actions/setup-node` from 3 to 4
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v3...v4 )
Updates `github/codeql-action` from 2 to 3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v2...v3 )
Updates `softprops/action-gh-release` from 1 to 2
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/v1...v2 )
Updates `bluwy/release-for-reddit-action` from 1 to 2
- [Release notes](https://github.com/bluwy/release-for-reddit-action/releases )
- [Changelog](https://github.com/bluwy/release-for-reddit-action/blob/master/CHANGELOG.md )
- [Commits](https://github.com/bluwy/release-for-reddit-action/compare/v1...v2 )
Updates `cbrgm/mastodon-github-action` from 1 to 2
- [Release notes](https://github.com/cbrgm/mastodon-github-action/releases )
- [Commits](https://github.com/cbrgm/mastodon-github-action/compare/v1...v2 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: softprops/action-gh-release
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: bluwy/release-for-reddit-action
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: cbrgm/mastodon-github-action
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-24 15:40:29 +02:00
MCMXC
becacb99a9
build: update used versions in github workflow actions ( #5168 )
...
- update all actions/* to v3
- update github/codeql-action/* to v2
2022-08-06 21:11:15 +03:00
neilnaveen
6bbb7b1d26
chore: Set permissions for GitHub actions ( #4607 )
...
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ )
Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com >
2022-04-22 03:04:45 +03:00
Zoltan Kochan
bc9dbc5ba7
ci: add coeql analysis
2021-03-13 01:17:18 +02:00
dependabot[bot]