ci: bump oven-sh/setup-bun from 2.0.2 to 2.2.0 - #83
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
dependencies
dependabot
Bot
requested review from
GangGreenTemperTatum,
afogel,
bar-capsule,
fewdisc,
mamicidal,
rocklambros and
sclintonowasp
as code owners
September 10, 2026 12:54
github-actions
Bot
added
the
status:needs-triage
|
Thanks for this. It is queued rather than ignored. This pull request does not reference an issue carrying If this is an editorial correction, tick that box in the description and this comment stops applying. |
dependabot
Bot
force-pushed
the
dependabot/github_actions/oven-sh/setup-bun-2.2.0
branch
from
September 10, 2026 13:54
3ed3022 to
62fd1b9
Compare
rocklambros
added a commit
that referenced
this pull request
Sep 22, 2026
…179) CodeQL default setup was turned on for this repository on 2026-09-21 and covers the Actions language. This adds zizmor, which the [OWASP GitHub Actions Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html) recommends beside CodeQL for defense in depth. zizmor reads each workflow's logic and checks what CodeQL does not: hash pins no tag points to, version comments that disagree with their pin, App tokens broader than the job needs, and credentials a checkout leaves in `.git/config`. Run against `integration` before this change with online audits on, zizmor 1.30.1 reported 15 findings. This clears 13. The other two are `github-app` findings on `board-reconcile.yml`, whose App token takes the installation's full grant instead of naming its repository and permissions. Token scopes are not changing right now, so those two stay open in code scanning, where they record the deferred decision instead of disappearing behind a suppression. - **`pr-intake.yml`, 1 high.** zizmor flags every `pull_request_target`. This one checks out no code and reads the pull request body as data through an environment variable, which the workflow's header already explains. It carries an inline `zizmor: ignore` that points at that explanation. - **Eleven checkouts across nine workflows, 11 low.** Each left the job's token in `.git/config`. None of those jobs pushes with git. They call `gh` with `GH_TOKEN` or touch no network at all, and `sync_version.yml` hands its push to `create-pull-request`, which configures its own token. All eleven now set `persist-credentials: false`. The checkout in `validate-owasp-metadata.yaml` also gains the `# v7.0.1` comment every other pin carries. - **`reference-implementation.yml`, 1 medium.** The setup-bun pin `735343b` is v2.0.2, and its comment said v2.0.1. Only the comment changes. Dependabot's #83 already treats it as 2.0.2. The new workflow runs zizmor from a `zizmor` dependency group in `uv.lock`, pinned with hashes. No new action enters the Actions allowlist, and Dependabot's uv ecosystem moves zizmor under the existing 7-day cooldown. The group is not a default group, so `uv sync --locked` in the deploy and test jobs never installs it. A default sync against this lockfile would uninstall it. It runs on pull requests and pushes that touch `.github/`, an action definition, `pyproject.toml`, or `uv.lock`, and weekly, because the online audits compare pins against advisories published after the pin. Findings upload as SARIF under the category `zizmor`, and the job stays green on findings so code scanning tracks them and a ruleset can gate on them later. A tool or upload failure still fails the job. A pull request from a fork cannot upload with its read-only token, so it gets annotations instead. `upload-sarif` is pinned at v4.38.0 because v4.38.1 was three days old, inside the cooldown this repository applies to its dependencies. Open pull requests #162 and #169 add workflows that zizmor will flag once they land, for unset `persist-credentials` and the same `# v2.0.1` setup-bun comment. Verified locally: zizmor 1.30.1 with online audits reports only the two deferred `github-app` findings, with 1 ignored and 26 low-confidence findings suppressed by the default persona. The workflow's own command produces valid SARIF 2.1.0. `actionlint` is clean. `uv lock --check` passes under uv 0.9.9, the version CI pins, and the lockfile diff adds only zizmor. `uv run pytest` gives 278 passed, 1 skipped. Signed-off-by: Rock Lambros <rock@rockcyber.com>
Bumps [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun) from 2.0.2 to 2.2.0. - [Release notes](https://github.com/oven-sh/setup-bun/releases) - [Commits](oven-sh/setup-bun@735343b...0c5077e) --- updated-dependencies: - dependency-name: oven-sh/setup-bun dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/oven-sh/setup-bun-2.2.0
branch
from
September 22, 2026 03:23
62fd1b9 to
549a519
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps oven-sh/setup-bun from 2.0.2 to 2.2.0.
Release notes
Sourced from oven-sh/setup-bun's releases.
... (truncated)
Commits
0c5077erelease: v2.2.0 (#177)1255e43ci: update actions for theRelease new action versionworkflow (#175)61861d1ci: update actions for theautofix.ciworkflow (#174)6f5bd06ci: useactions/checkout@v6.0.2in the test workflow (#173)e391475build: update action runtime to Node.js 24 (#176)ecf28ddrelease: v2.1.3 (#170)95edc15fix: validate cached binary version matches requested version (#146) (#169)4c32875feat: add AVX2 support detection for x64 Linux systems (#167)0ff83bffix: use native Windows ARM64 binary for Bun >= 1.3.10 (#165)ab8cb4efeat: add bun- prefix to cache keys (#160)