Repository navigation
ci(deps): bump the github-actions group across 1 directory with 11 updates - #139
Merged
gabrielfrasantos merged 1 commit intoOct 23, 2026
Conversation
…dates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.1` | `2.22.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [EnricoMi/publish-unit-test-result-action](https://github.com/enricomi/publish-unit-test-result-action) | `2.24.0` | `2.25.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.7.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` | | [reviewdog/action-suggester](https://github.com/reviewdog/action-suggester) | `1.26.1` | `1.26.3` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.2.0` | `3.3.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0` | `7.1.0` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.2` | `0.24.3` | | [devcontainers/action](https://github.com/devcontainers/action) | `1.4.3` | `1.4.4` | Updates `step-security/harden-runner` from 2.21.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e14015d...ccd8616) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) Updates `EnricoMi/publish-unit-test-result-action` from 2.24.0 to 2.25.0 - [Release notes](https://github.com/enricomi/publish-unit-test-result-action/releases) - [Commits](EnricoMi/publish-unit-test-result-action@d0a4676...7622c5b) Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@cc914d7...85b2b9f) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...6f2ac81) Updates `reviewdog/action-suggester` from 1.26.1 to 1.26.3 - [Release notes](https://github.com/reviewdog/action-suggester/releases) - [Commits](reviewdog/action-suggester@c387862...ac5ce6d) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@2d11466...fa7117d) Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) Updates `anchore/sbom-action` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@3ad7283...66cbf4b) Updates `devcontainers/action` from 1.4.3 to 1.4.4 - [Release notes](https://github.com/devcontainers/action/releases) - [Commits](devcontainers/action@1082abd...bef2cf2) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: EnricoMi/publish-unit-test-result-action dependency-version: 2.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: reviewdog/action-suggester dependency-version: 1.26.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: devcontainers/action dependency-version: 1.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 25 | 0 | 0 | 0.3s | ||
| zizmor | 25 | 0 | 0 | 1 | 6.06s | ||
| ✅ DOCKERFILE | hadolint | 3 | 0 | 0 | 0.19s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.22s | ||
| ✅ JSON | prettier | 22 | 3 | 0 | 0 | 0.35s | |
| ✅ JSON | v8r | 22 | 0 | 0 | 6.56s | ||
| ✅ MARKDOWN | markdownlint | 12 | 0 | 0 | 0 | 0.45s | |
| ✅ MARKDOWN | markdown-table-formatter | 12 | 0 | 0 | 0 | 0.13s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.63s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 31.28s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 70.43s | ||
| ✅ REPOSITORY | osv-scanner | yes | no | no | 1.0s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 0.6s | ||
| ✅ REPOSITORY | syft | yes | no | no | 2.04s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 11.44s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.22s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 2.85s | ||
| lychee | 88 | 1 | 0 | 9.28s | |||
| ✅ YAML | prettier | 33 | 0 | 0 | 0 | 0.52s | |
| ✅ YAML | v8r | 33 | 0 | 0 | 6.68s | ||
| ✅ YAML | yamllint | 33 | 0 | 0 | 0.96s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........133
🔗 Unique.........112
✅ Successful.....127
⏳ Timeouts.........0
🔀 Redirected......13
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 30:7) | Rejected status code: 403 Forbidden
Hint: Followed 13 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ ACTION / zizmor - 1 warning
INFO zizmor: 🌈 zizmor v1.25.0
WARN audit: zizmor: one or more inputs contains YAML anchors; see https://docs.zizmor.sh/usage/#yaml-anchors for details
INFO audit: zizmor: 🌈 completed .github/workflows/build-push-test.yml
INFO audit: zizmor: 🌈 completed .github/workflows/continuous-integration.yml
INFO audit: zizmor: 🌈 completed .github/workflows/image-cleanup.yml
INFO audit: zizmor: 🌈 completed .github/workflows/issue-cleanup.yml
INFO audit: zizmor: 🌈 completed .github/workflows/issue-creation-tool-versions.yml
INFO audit: zizmor: 🌈 completed .github/workflows/linting-formatting.yml
INFO audit: zizmor: 🌈 completed .github/workflows/ossf-scorecard.yml
INFO audit: zizmor: 🌈 completed .github/workflows/pr-conventional-title.yml
INFO audit: zizmor: 🌈 completed .github/workflows/pr-image-cleanup.yml
INFO audit: zizmor: 🌈 completed .github/workflows/pr-report.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release-build.yml
INFO audit: zizmor: 🌈 completed .github/workflows/release-please.yml
INFO audit: zizmor: 🌈 completed .github/workflows/update-dependencies.yml
INFO audit: zizmor: 🌈 completed .github/workflows/vulnerability-scan.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-acceptance-test.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-build-push-test.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-build-push.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-dependency-review.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-document-generation.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-integration-test-docker.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-integration-test-podman.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-integration-test.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-mirror-image.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-publish-templates.yml
INFO audit: zizmor: 🌈 completed .github/workflows/wc-sanitize-image-name.yml
{
"$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
"runs": [
{
"invocations": [
{
"executionSuccessful": true
}
],
"results": [],
"tool": {
"driver": {
"downloadUri": "https://github.com/zizmorcore/zizmor",
"informationUri": "https://docs.zizmor.sh",
"name": "zizmor",
"rules": [],
"semanticVersion": "1.25.0",
"version": "1.25.0"
}
}
}
],
"version": "2.1.0"
No fixes available to apply.
}
Notices
REPOSITORY_KICS. See Removed linters to find their replacements.
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.1.0 (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
gabrielfrasantos
deleted the
dependabot/github_actions/github-actions-b94bc91fa2
branch
October 23, 2026 15:15
Contributor
Pull Request Report (#139)Static measures
Time related measures
Status check related measures
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 11 updates in the / directory:
2.21.12.22.18.0.18.0.22.24.02.25.00.6.40.7.14.38.24.39.01.26.11.26.32.4.42.5.03.2.03.3.07.0.07.1.00.24.20.24.31.4.31.4.4Updates
step-security/harden-runnerfrom 2.21.1 to 2.22.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
ccd8616Merge pull request #704 from h0x0er/jatin/ghes-endp037ccfdimplicitly add ghes endpoint in allowListe7438c7Merge pull request #703 from h0x0er/jatin/ghes-codebuild-fixesafb0b33fixes for armour rules not getting initialised351661cMerge pull request #701 from step-security/rc-441dc7f2eMerge pull request #702 from h0x0er/jatin/ghes-changes-upaf5ca38simplified ghes config creation9a6d710fix274c65eafixceac816resovled commentsUpdates
actions/download-artifactfrom 8.0.1 to 8.0.2Release notes
Sourced from actions/download-artifact's releases.
Commits
9000827Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2e455989Prepare download-artifact v8.0.2a00b90cMerge pull request #492 from actions/tunc-d-download-artifact-package-bump29bb7ceUpdate@actions/artifactto 6.3.1484a0b5Update the readme (#473)Updates
EnricoMi/publish-unit-test-result-actionfrom 2.24.0 to 2.25.0Release notes
Sourced from EnricoMi/publish-unit-test-result-action's releases.
Commits
7622c5bReleasing v2.25.0d1ea8e5Upgrade pinned Python dependencies (#800)67b1885Bump PyJWT to 2.15.1 (GHSA-42vr-xj54-vc7v, GHSA-x33g-cr3x-6449) (#799)071ec54Upgrade Python dependencies (#796)f937390Make Python dependency files stable (#795)182f45fUpgrading GitHub Actions across platforms (#794)fd268daUpgrade python dependencies (#793)c9bbcab[chore] pin docker + add dependabot (#764)Updates
zizmorcore/zizmor-actionfrom 0.6.4 to 0.7.1Release notes
Sourced from zizmorcore/zizmor-action's releases.
... (truncated)
Commits
85b2b9fSync zizmor versions (#178)38c745aREADME: bump pins (#177)f9597c8Sync zizmor versions (#175)2181e51Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)27d989bchore(deps): bump the github-actions group with 2 updates (#173)a91218cBootstrap zizmor without Docker (#169)ee3f1bfchore(deps): bump the github-actions group with 2 updates (#170)8eacaa5README: bump pins (#167)Updates
github/codeql-action/upload-sariffrom 4.38.2 to 4.39.0Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
6f2ac81Merge pull request #4239 from github/update-v4.39.0-d63383a73eb1c428Trigger workflows4443333Update changelog for v4.39.0d63383aMerge pull request #4233 from github/mbg/start-proxy/report-version8dec0b9Renamepathtoresultin tests4eabea6Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version57938b8Merge pull request #4201 from github/mario-campos/automate-changenotes-assembleee07b50Merge pull request #4236 from github/mbg/add-missing-changenotesa897ed5Add change note for #4206c8bd019Add change note for #4198Updates
reviewdog/action-suggesterfrom 1.26.1 to 1.26.3Release notes
Sourced from reviewdog/action-suggester's releases.
Commits
ac5ce6dMerge pull request #152 from reviewdog/renovate/reviewdog-action-actionlint-1.x3b65975chore(deps): update reviewdog/action-actionlint action to v1.80.2ee817b4Merge pull request #151 from reviewdog/renovate/reviewdog-action-actionlint-1.xff52a03chore(deps): update reviewdog/action-actionlint action to v1.80.18219e3dMerge pull request #150 from reviewdog/renovate/reviewdog-action-actionlint-1.x1a214b9chore(deps): update reviewdog/action-actionlint action to v1.80.0e2afd88Merge pull request #149 from reviewdog/renovate/reviewdog-action-misspell-1.x3b6d147chore(deps): update reviewdog/action-misspell action to v1.30.2e7837e5Merge pull request #148 from reviewdog/renovate/reviewdog-action-actionlint-1.x9bc5cd8chore(deps): update reviewdog/action-actionlint action to v1.79.1Updates
ossf/scorecard-actionfrom 2.4.4 to 2.5.0Release notes
Sourced from ossf/scorecard-action's releases.
Commits
fa7117dBump action tag for v2.5.0 release (#1720)cef4eb5🌱 Bump Scorecard to v5.6.0 (#1719)bedb16e✨ Add intoto results format (#1702)de70347Remove the leftover debug print of the auth token (#1709)950873d🌱 Derive the reported Scorecard version from go.mod (#1718)2ce8ee4🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)aabdf5a🌱 Bump the github-actions group across 1 directory with 7 updates (#...b4b9adf🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file4e9f2a2📖 RELEASE.md: Document drafting release notesf618e8b🌱 Build the image with Go 1.27.2 and refresh distrolessUpdates
actions/create-github-app-tokenfrom 3.2.0 to 3.3.0Release notes
Sourced from actions/create-github-app-token's releases.
Changelog
Sourced from actions/create-github-app-token's changelog.
Commits
64ab729chore(main): release 3.3.0 (#402)f3a828eci: create signed dist commits in release workflow (#404)655017fdocs: clarify when owner grants access to all repositories (#378)12461a3fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)a47236ffeat: update permission inputs (#399)a69c19dfix(deps): bump the production-dependencies group across 1 directory with 3 u...d5cb7aebuild(deps): bump actions/checkout from 6 to 7 (#384)575da86build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...e85f677test: omit stack traces from snapshots (#401)9419396build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)Updates
actions/setup-nodefrom 7.0.0 to 7.1.0Release notes
Sourced from actions/setup-node's releases.
Commits
949feb2Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)7207c4fchore: update dependencies and add license files (#1642)54337e0Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)fb54fa8Bump jest-each from 30.4.1 to 30.5.2 (#1636)7f84f1dBump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)0c54c7bBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1615)a829419Bump@types/semverfrom 7.7.1 to 7.8.0 (#1616)680d1e4Support absolute paths in node-version-file (#1633)db0fb3aBump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)94196eeBump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)Updates
anchore/sbom-actionfrom 0.24.2 to 0.24.3Release notes
Sourced from anchore/sbom-action's releases.
Commits
66cbf4bchore(deps): update Syft to latest release (#735)6b31fa7chore(deps-dev): bump type-fest from 5.9.0 to 5.10.0 (#742)85bda36chore(deps-dev): bump@types/nodefrom 26.5.1 to 26.6.1 (#741)7b97c1echore(deps): bump github.com/anchore/go-make in /.make (#738)891b055chore(deps): bump anchore/go-make/.github/actions/setup (#740)f73cf48chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#739)13576dbchore(deps-dev): bump@types/nodefrom 26.4.1 to 26.5.1 (#737)Description has been truncated