chore(deps): update github actions #174

renovate · 2024-12-13T10:23:37Z

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	digest	`0c45773` -> `1bd1e32`
actions/checkout	action	digest	`0ad4b8f` -> `11bd719`
actions/checkout	action	minor	`v4.1.3` -> `v4.2.2`
actions/setup-node	action	digest	`60edb5d` -> `39370e3`
backstage/actions	action	patch	`v0.6.10` -> `v0.6.17`
step-security/harden-runner	action	minor	`v2.7.0` -> `v2.10.2`

Release Notes

actions/checkout (actions/checkout)

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in https://github.com/actions/checkout/pull/1941
Expand unit test coverage for isGhes by @jww3 in https://github.com/actions/checkout/pull/1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in https://github.com/actions/checkout/pull/1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in https://github.com/actions/checkout/pull/1180
Dependency updates by @dependabot- https://github.com/actions/checkout/pull/1777, https://github.com/actions/checkout/pull/1872

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in https://github.com/actions/checkout/pull/1739
Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/actions/checkout/pull/1697
Check out other refs/* by commit by @orhantoy in https://github.com/actions/checkout/pull/1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in https://github.com/actions/checkout/pull/1776

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in https://github.com/actions/checkout/pull/1732

backstage/actions (backstage/actions)

`v0.6.17`

Compare Source

What's Changed

Update generateFeedback.ts by @freben in https://github.com/backstage/actions/pull/161

New Contributors

@freben made their first contribution in https://github.com/backstage/actions/pull/161

Full Changelog: backstage/actions@v0.6.16...v0.6.17

`v0.6.16`

Compare Source

What's Changed

chore: add a note about documentation to changesets by @aramissennyeydd in https://github.com/backstage/actions/pull/160

New Contributors

@aramissennyeydd made their first contribution in https://github.com/backstage/actions/pull/160

Full Changelog: backstage/actions@v0.6.15...v0.6.16

`v0.6.15`

Compare Source

What's Changed

Updated to use Node 20 by @awanlin in https://github.com/backstage/actions/pull/156

Full Changelog: backstage/actions@v0.6.14...v0.6.15

`v0.6.14`

Compare Source

What's Changed

changeset-feedback: ignore knip-report.md by @Rugvip in https://github.com/backstage/actions/pull/157

Full Changelog: backstage/actions@v0.6.13...v0.6.14

`v0.6.13`

Compare Source

What's Changed

Filter out private packages by @awanlin in https://github.com/backstage/actions/pull/155

New Contributors

@awanlin made their first contribution in https://github.com/backstage/actions/pull/155

Full Changelog: backstage/actions@v0.6.12...v0.6.13

`v0.6.12`

Compare Source

What's Changed

changeset-feedback: match all kind of API report names by @Rugvip in https://github.com/backstage/actions/pull/154

Full Changelog: backstage/actions@v0.6.11...v0.6.12

`v0.6.11`

Compare Source

What's Changed

Fix for multiple-workspaces being required when it shouldn't @benjdlambert in https://github.com/backstage/actions/pull/152

Full Changelog: backstage/actions@v0.6.10...v0.6.11

step-security/harden-runner (step-security/harden-runner)

`v2.10.2`

Compare Source

What's Changed

Fixes low-severity command injection weaknesses
The advisory is here: GHSA-g85v-wf27-67xc
Bug fix to improve detection of whether Harden-Runner is running in a container

Full Changelog: step-security/harden-runner@v2...v2.10.2

`v2.10.1`

Compare Source

What's Changed

Release v2.10.1 by @varunsh-coder in https://github.com/step-security/harden-runner/pull/463
Bug fix: Resolves an issue where DNS resolution of .local domains was failing when using a Kind cluster in a GitHub Actions workflow.

Full Changelog: step-security/harden-runner@v2...v2.10.1

`v2.10.0`

Compare Source

What's Changed

Release v2.10.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/455

ARM Support: Harden-Runner Enterprise tier now supports GitHub-hosted ARM runners. This includes all the features that apply to previously supported GitHub-hosted x64 Linux runners.

Full Changelog: step-security/harden-runner@v2...v2.10.0

`v2.9.1`

Compare Source

What's Changed

Release v2.9.1 by @h0x0er and @varunsh-coder in #440
This release includes two changes:

Updated markdown displayed in the job summary by the Harden-Runner Action.
Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.

Full Changelog: step-security/harden-runner@v2...v2.9.1

`v2.9.0`

Compare Source

What's Changed

Release v2.9.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/435
This release includes:

Enterprise Tier - Telemetry Upload Enhancement:
For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
Harden-Runner Agent Authentication:
The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
README Update:
A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
Dependency Update:
Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

`v2.8.1`

Compare Source

What's Changed

Bug fix: Update isGitHubHosted implementation by @varunsh-coder in https://github.com/step-security/harden-runner/pull/425
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

`v2.8.0`

Compare Source

What's Changed

Release v2.8.0 by @h0x0er and @varunsh-coder in https://github.com/step-security/harden-runner/pull/416
This release includes:

File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

`v2.7.1`

Compare Source

What's Changed

Release v2.7.1 by @varunsh-coder, @h0x0er, @ashishkurmi in https://github.com/step-security/harden-runner/pull/397
This release:

Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot requested review from BethGriggs, nickboldt, kim-tsao and 04kash as code owners December 13, 2024 10:23

renovate bot added the dependencies Pull requests that update a dependency file label Dec 13, 2024

renovate bot force-pushed the renovate/github-actions branch 25 times, most recently from d3066aa to 913770a Compare December 19, 2024 09:16

renovate bot force-pushed the renovate/github-actions branch 10 times, most recently from 7467e78 to 982bf0c Compare December 25, 2024 08:33

renovate bot force-pushed the renovate/github-actions branch 3 times, most recently from f02fb33 to 83a4b0b Compare December 29, 2024 23:14

chore(deps): update github actions

85f3e6b

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/github-actions branch from 83a4b0b to 85f3e6b Compare December 30, 2024 10:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update github actions #174

chore(deps): update github actions #174

renovate bot commented Dec 13, 2024

chore(deps): update github actions #174

Are you sure you want to change the base?

chore(deps): update github actions #174

Conversation

renovate bot commented Dec 13, 2024

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

Configuration