Skip to content

ci: bump the github-actions group across 1 directory with 12 updates #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

ci: bump the github-actions group across 1 directory with 12 updates #306

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 1, 2025 •
edited
Loading

Bumps the github-actions group with 12 updates in the / directory:

Package From To
actions/checkout 4.2.2 5.0.0
github/codeql-action 3.28.11 3.29.11
python-semantic-release/python-semantic-release 9.21.0 10.3.1
astral-sh/setup-uv 5.3.1 6.6.0
hynek/build-and-inspect-python-package 2.12.0 2.13.0
actions/download-artifact 4.1.9 5.0.0
softprops/action-gh-release 2.2.1 2.3.2
docker/setup-buildx-action 3.10.0 3.11.1
docker/login-action 3.4.0 3.5.0
docker/metadata-action 5.7.0 5.8.0
docker/build-push-action 6.15.0 6.18.0
ossf/scorecard-action 2.4.1 2.4.2

Updates actions/checkout from 4.2.2 to 5.0.0

Release notes

Sourced from actions/checkout's releases.

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v4.3.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

V5.0.0

V4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

v4.1.4

v4.1.3

... (truncated)

Commits

Updates github/codeql-action from 3.28.11 to 3.29.11

Release notes

Sourced from github/codeql-action's releases.

v3.29.11

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.11 - 21 Aug 2025

  • Update default CodeQL bundle version to 2.22.4. #3044

See the full CHANGELOG.md for more information.

v3.29.10

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.10 - 18 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.9

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.9 - 12 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.8

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.8 - 08 Aug 2025

  • Fix an issue where the Action would autodetect unsupported languages such as HTML. #3015

See the full CHANGELOG.md for more information.

v3.29.7

This is a re-release of v3.29.5 to mitigate an issue that was discovered with v3.29.6.

v3.29.6

CodeQL Action Changelog

... (truncated)

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.29.11 - 21 Aug 2025

  • Update default CodeQL bundle version to 2.22.4. #3044

3.29.10 - 18 Aug 2025

No user facing changes.

3.29.9 - 12 Aug 2025

No user facing changes.

3.29.8 - 08 Aug 2025

  • Fix an issue where the Action would autodetect unsupported languages such as HTML. #3015

3.29.7 - 07 Aug 2025

This release rolls back 3.29.6 to address issues with language autodetection. It is identical to 3.29.5.

3.29.6 - 07 Aug 2025

  • The cleanup-level input to the analyze Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. #2999
  • Update default CodeQL bundle version to 2.22.3. #3000

3.29.5 - 29 Jul 2025

  • Update default CodeQL bundle version to 2.22.2. #2986

3.29.4 - 23 Jul 2025

No user facing changes.

3.29.3 - 21 Jul 2025

No user facing changes.

3.29.2 - 30 Jun 2025

  • Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

... (truncated)

Commits
  • 3c3833e Merge pull request #3052 from github/update-v3.29.11-14148a433
  • 8c4bfbd Update changelog for v3.29.11
  • 14148a4 Merge pull request #3044 from github/update-bundle/codeql-bundle-v2.22.4
  • 71b2cb3 Add changelog note
  • 2bf7825 Update default bundle to codeql-bundle-v2.22.4
  • db69a51 Merge pull request #3049 from github/update-supported-enterprise-server-versions
  • a68d47b Merge pull request #3050 from github/henrymercer/init-not-called-config-error
  • e496ff9 Make "init not called" a configuration error
  • fd2ea72 Update supported GitHub Enterprise Server versions
  • 6dee5bc Merge pull request #3045 from github/dependabot/npm_and_yarn/npm-5b4171dd16
  • Additional commits viewable in compare view

Updates python-semantic-release/python-semantic-release from 9.21.0 to 10.3.1

Release notes

Sourced from python-semantic-release/python-semantic-release's releases.

v10.3.1 (2025-08-06)

This release is published under the MIT License.

🪲 Bug Fixes

  • github-actions: Refactor the action output error checking for non-release executions (PR#1308, 5385724)

📖 Documentation

  • github-actions: Adjust docs for direct links to action example workflows (PR#1309, 8efebe2)

✅ Resolved Issues

  • #1303: Improve GitHub Actions Docs

  • #1307: v10.3.0 doesn't support a stage-then-release approach in GitHub Actions

Detailed Changes: v10.3.0...v10.3.1

Installable artifacts are available from:

v10.3.0

2025-08-05 WARNING: GitHub Action broke if Action is run in a non-release mode (e.g. --no-commit, or --noop), see #1307 - Resolved in v10.3.1

v10.3.0 (2025-08-04)

This release is published under the MIT License.

✨ Features

  • github-actions: Add commit_sha as a GitHub Actions output value (PR#1289, 39b647b)

  • github-actions: Add previous_version as a GitHub Actions output value (PR#1302, c0197b7)

  • github-actions: Add release_notes as a GitHub Actions output value (PR#1300, a3fd23c)

  • github-actions: Add release link as a GitHub Actions output value (PR#1301, 888aea1)

🪲 Bug Fixes

... (truncated)

Changelog

Sourced from python-semantic-release/python-semantic-release's changelog.

.. _changelog:

========= CHANGELOG

.. _changelog-v10.3.1:

v10.3.1 (2025-08-06)

🪲 Bug Fixes

  • github-actions: Refactor the action output error checking for non-release executions, closes [#1307](https://github.com/python-semantic-release/python-semantic-release/issues/1307)_ (PR#1308, 5385724)

📖 Documentation

  • github-actions: Adjust docs for direct links to action example workflows, closes [#1303](https://github.com/python-semantic-release/python-semantic-release/issues/1303)_ (PR#1309, 8efebe2)

.. _#1303: python-semantic-release/python-semantic-release#1303 .. _#1307: python-semantic-release/python-semantic-release#1307 .. _5385724: python-semantic-release/python-semantic-release@5385724 .. _8efebe2: python-semantic-release/python-semantic-release@8efebe2 .. _PR#1308: python-semantic-release/python-semantic-release#1308 .. _PR#1309: python-semantic-release/python-semantic-release#1309

.. _changelog-v10.3.0:

v10.3.0 (2025-08-04)

✨ Features

  • github-actions: Add commit_sha as a GitHub Actions output value, closes [#717](https://github.com/python-semantic-release/python-semantic-release/issues/717)_ (PR#1289, 39b647b)

  • github-actions: Add previous_version as a GitHub Actions output value (PR#1302, c0197b7)

  • github-actions: Add release_notes as a GitHub Actions output value (PR#1300, a3fd23c)

  • github-actions: Add release link as a GitHub Actions output value (PR#1301, 888aea1)

... (truncated)

Commits
  • 5b9d941 10.3.1
  • 5385724 fix(github-actions): refactor the action output error checking for non-releas...
  • 8efebe2 docs(github-actions): adjust docs for direct links to action example workflow...
  • ac438f2 ci(deps): bump mikepenz/action-junit-report@v5.6.1 action to v5.6.2 (#1305)
  • bdbfd23 10.3.0
  • c0197b7 feat(github-actions): add previous_version as a GitHub Actions output value...
  • 888aea1 feat(github-actions): add release link as a GitHub Actions output value (#1...
  • a3fd23c feat(github-actions): add release_notes as a GitHub Actions output value (#...
  • 2ce2e94 docs(getting-started): fixes changelog.exclude_commit_patterns example in s...
  • 39b647b feat(github-actions): add commit_sha as a GitHub Actions output value (#1289)
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 5.3.1 to 6.6.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v6.5.0 🌈 Better error messages, bug fixes and copilot agent settings

Changes

This release brings better error messages in case the GitHub API is impacted, fixes a few bugs and allows to disable problem matchers for better use in Copilot Agent workspaces.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v6.4.3 🌈 fix relative paths starting with dots

🐛 Bug fixes

v6.4.2 🌈 Interpret relative inputs as under working-directory

Changes

This release will interpret relative paths in inputs as relative to the value of working-directory (default is ${{ github.workspace }}) . This means the following configuration

- uses: astral-sh/setup-uv@v6
   with:
     working-directory: /my/path
     cache-dependency-glob: uv.lock

... (truncated)

Commits

Updates hynek/build-and-inspect-python-package from 2.12.0 to 2.13.0

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.13.0

Added

  • New output: package_name is the name of the built package as stored in metadata. #162

  • The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

  • All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements.

    Since chosen prefix SHA-1 hash collision attacks exist, this is but security theater against serious attackers.

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.13.0

Added

  • New output: package_name is the name of the built package as stored in metadata. #162

  • The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

  • All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements[^st].

[^st]: Chosen prefix SHA-1 hash collision attacks exist. Against serious attackers, this is but security theater.

2.12.0

Changed

  • This release only updates the tools we use. It's important for being able to handle packaging metadata 2.4, as published by recent versions of Hatchling, though. #161

2.11.0

Added

  • New output: package_version is the version of the package that was built. #152

2.10.0

Changed

... (truncated)

Commits

Updates actions/download-artifact from 4.1.9 to 5.0.0

Release notes

Sourced from actions/download-artifact's releases.

v5.0.0

What's Changed

v5.0.0

🚨 Breaking Change

This release fixes an inconsistency in path behavior for single artifact downloads by ID. If you're downloading single artifacts by ID, the output path may change.

What Changed

Previously, single artifact downloads behaved differently depending on how you specified the artifact:

  • By name: name: my-artifact → extracted to path/ (direct)
  • By ID: artifact-ids: 12345 → extracted to path/my-artifact/ (nested)

Now both methods are consistent:

  • By name: name: my-artifact → extracted to path/ (unchanged)
  • By ID: artifact-ids: 12345 → extracted to path/ (fixed - now direct)

Migration Guide

✅ No Action Needed If:
  • You download artifacts by name
  • You download multiple artifacts by ID
  • You already use merge-multiple: true as a workaround
⚠️ Action Required If:

You download single artifacts by ID and your workflows expect the nested directory structure.

Before v5 (nested structure):

- uses: actions/download-artifact@v4
  with:
    artifact-ids: 12345
    path: dist
# Files were in: dist/my-artifact/

Where my-artifact is the name of the artifact you previously uploaded

To maintain old behavior (if needed):

</tr></table>

... (truncated)

Commits
  • 634f93c Merge pull request #416 from actions/single-artifact-id-download-path
  • b19ff43 refactor: resolve download path correctly in artifact download tests (mainly ...
  • e262cbe bundle dist
  • bff23f9 update docs
  • fff8c14 fix download path logic when downloading a single artifact by id
  • 448e3f8 Merge pull request #407 from actions/nebuk89-patch-1
  • 47225c4 Update README.md
  • d3f86a1 Merge pull request #404 from actions/robherley/v4.3.0
  • fc02353 prep for v4.3.0 release
  • 7745437 Merge pull request #402 from actions/joshmgross/download-by-id-example
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 2.2.1 to 2.3.2

Release notes

Sourced from softprops/action-gh-release's releases.

v2.3.2

  • fix: revert fs readableWebStream change

v2.3.1

What's Changed

Bug fixes 🐛

New Contributors

Full Changelog: softprops/action-gh-release@v2.3.0...v2.3.1

v2.3.0

  • Migrate from jest to vitest
  • Replace mime with mime-types
  • Bump to use node 24
  • Dependency updates

Full Changelog: softprops/action-gh-release@v2.2.2...v2.3.0

v2.2.2

What's Changed

Bug fixes 🐛

Other Changes 🔄

New Contributors

Full Changelog: softprops/action-gh-release@v2.2.1...v2.2.2

Changelog

Sourced from softprops/action-gh-release's changelog.

2.3.2

  • fix: revert fs readableWebStream change

2.3.1

Bug fixes 🐛

2.3.0

  • Migrate from jest to vitest
  • Replace mime with mime-types
  • Bump to use node 24
  • Dependency updates

2.2.2

What's Changed

Bug fixes 🐛

Other Changes 🔄

2.2.1

What's Changed

Bug fixes 🐛

Other Changes 🔄

2.2.0

What's Changed

Exciting New Features 🎉

... (truncated)

Commits

Updates docker/setup-buildx-action from 3.10.0 to 3.11.1

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.11.1

Full Changelog: docker/setup-buildx-action@v3.11.0...v3.11.1

v3.11.0

Full Changelog: docker/setup-buildx-action@v3.10.0...v3.11.0

Commits
  • e468171 Merge pull request #429 from crazy-max/fix-keep-state
  • a3e7502 chore: update generated content
  • b145473 fix keep-state not being respected
  • 18ce135 Merge pull request #425 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 0e198e9 chore: update generated content
  • 05f3f3a build(deps): bump @​docker/actions-toolkit from 0.61.0 to 0.62.1
  • 6229134 Merge pull request #427 from crazy-max/keep-state
  • c6f6a07 chore: update generated content
  • 6c5e29d skip builder creation if one already exists with the same name
  • 548b297 ci: keep-state check
  • Additional commits viewable in compare view

Updates docker/login-action from 3.4.0 to 3.5.0

Release notes

Sourced from docker/login-action's releases.

v3.5.0

@dependabot
ci: bump the github-actions group across 1 directory with 12 updates
029c6df 
Bumps the github-actions group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.11` | `3.29.11` |
| [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `9.21.0` | `10.3.1` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `5.3.1` | `6.6.0` |
| [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package) | `2.12.0` | `2.13.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.1.9` | `5.0.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.2.1` | `2.3.2` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.11.1` |
| [docker/login-action](https://github.com/docker/login-action) | `3.4.0` | `3.5.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.7.0` | `5.8.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.15.0` | `6.18.0` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.2` |



Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...08c6903)

Updates `github/codeql-action` from 3.28.11 to 3.29.11
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6bb031a...3c3833e)

Updates `python-semantic-release/python-semantic-release` from 9.21.0 to 10.3.1
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@26bb37c...5b9d941)

Updates `astral-sh/setup-uv` from 5.3.1 to 6.6.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@f94ec6b...4959332)

Updates `hynek/build-and-inspect-python-package` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@b5076c3...c52c3a4)

Updates `actions/download-artifact` from 4.1.9 to 5.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@cc20338...634f93c)

Updates `softprops/action-gh-release` from 2.2.1 to 2.3.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@c95fe14...72f2c25)

Updates `docker/setup-buildx-action` from 3.10.0 to 3.11.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@b5ca514...e468171)

Updates `docker/login-action` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@74a5d14...184bdaa)

Updates `docker/metadata-action` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@902fa8e...c1e5197)

Updates `docker/build-push-action` from 6.15.0 to 6.18.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@471d1dc...2634353)

Updates `ossf/scorecard-action` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@f49aabe...05b42c6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 3.29.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: python-semantic-release/python-semantic-release
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 6.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: hynek/build-and-inspect-python-package
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/metadata-action
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/build-push-action
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration labels Sep 1, 2025
@dependabot dependabot bot requested a review from afuetterer as a code owner September 1, 2025 14:12
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 1, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Oct 1, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/github-actions-fb254b1909 branch October 1, 2025 07:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afuetterer afuetterer Awaiting requested review from afuetterer afuetterer is a code owner

Assignees

No one assigned

Labels

deps: github-actions Pull requests that update GitHub Actions code type: ci Continuous Integration

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants