chore(deps): roll up open Dependabot bumps#35
Open
cjimti wants to merge 2 commits into
Open
Conversation
Combines the two open Dependabot PRs into one change: the grouped GitHub Actions bumps (#34) and the Go module bump (#32). Actions: - step-security/harden-runner v2.19.4 -> v2.20.0 - github/codeql-action (init/autobuild/ analyze/upload-sarif) v4.36.2 -> v4.37.1 - goreleaser/goreleaser-action v7.2.2 -> v7.2.3 - securego/gosec v2.27.1 -> v2.28.0 Go: - golang.org/x/sync v0.21.0 -> v0.22.0 (go.sum regenerated with go mod tidy; matches Dependabot #32) Every action SHA was resolved against upstream and matches the commit its tag points at (codeql-action's annotated tag was dereferenced). Refs stay pinned to full 40-char SHAs. make verify checks pass (tidy-check, fmt-check, lint, test). Supersedes #32, #34.
Adds a 7-day default cooldown to both the gomod and github-actions update ecosystems. Resolves the pre-existing dependabot-missing-cooldown semgrep finding that was failing the security workflow independently of the dependency bumps in this PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combines the two Dependabot PRs into one change: the grouped GitHub Actions bumps and the Go module bump.
Actions
step-security/harden-runnergithub/codeql-action(init/autobuild/analyze/upload-sarif)goreleaser/goreleaser-actionsecurego/gosecGo
golang.org/x/syncgo.sumregenerated withgo mod tidy; the change is limited tox/sync.Also
Adds a 7-day
cooldownto both Dependabot ecosystems, resolving thedependabot-missing-cooldownsemgrep finding that was failing the security workflow.Every action SHA was resolved against upstream and matches the commit its tag points at (codeql-action's annotated tag was dereferenced). Refs stay pinned to full 40-char SHAs. Full
make verifypasses.Folds in and replaces the individual Dependabot PRs #32 and #34 (already closed).