Update github actions - #3442
renovate[bot] wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea789882c5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0 | ||
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 |
There was a problem hiding this comment.
On tag releases, this step still requests GoReleaser 2.4.1 on line 49, but goreleaser-action v7.1+ added mandatory release checksum/signature verification and dropped pre-Cosign-v3 GoReleaser versions from its compatibility tests. Because 2.4.1 predates the Cosign v3 release format, the Linux job can fail while installing GoReleaser, which also blocks create-release; update the pinned CLI version to a supported release or retain action v7.0.0. The same incompatible pairing appears in .github/workflows/build.yml.
Useful? React with 👍 / 👎.
|
🎯 Code Coverage (details) 🔗 Commit SHA: 523dfcf | Docs | View more details | Give us feedback! |
8672c80 to
35dca37
Compare
03a6de6 to
bf30e63
Compare
bf30e63 to
6bd742a
Compare
6bd742a to
523dfcf
Compare
This PR contains the following updates:
v1.0.1→v1.0.5v1.0.4→v1.0.5v1.0.0→v1.0.5v6.0.2→v6.1.0v6.3.0→v6.5.0v10.2.0→v10.4.0v7.0.0→v7.0.1v4.32.5→v4.38.1v4.38.22.4.1→v2.18.2v7.0.0→v7.2.3v0.2.20→v0.2.2253d33d2→5ac6001v2.6.1→v2.6.2Release Notes
DataDog/coverage-upload-github-action (DataDog/coverage-upload-github-action)
v1.0.5Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.5
v1.0.4Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.4
v1.0.3Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.3
v1.0.2Compare Source
What's Changed
New Contributors
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.2
DataDog/dd-octo-sts-action (DataDog/dd-octo-sts-action)
v1.0.5Compare Source
DataDog/dd-sts-action (DataDog/dd-sts-action)
v1.0.5Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.4...v1.0.5
v1.0.4Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.3...v1.0.4
v1.0.3Compare Source
What's Changed
New Contributors
Full Changelog: DataDog/dd-sts-action@v1.0.2...v1.0.3
v1.0.2Compare Source
v1.0.1Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.0...v1.0.1
actions/checkout (actions/checkout)
v6.1.0Compare Source
v6.0.3Compare Source
actions/setup-go (actions/setup-go)
v6.5.0Compare Source
v6.4.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation update
New Contributors
Full Changelog: actions/setup-go@v6...v6.4.0
actions/stale (actions/stale)
v10.4.0Compare Source
What's Changed
Bug Fix
only-issue-typesvalidation by @trueberryless in #1338Dependency Updates
New Contributors
Full Changelog: actions/stale@v10.3.0...v10.4.0
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
github/codeql-action (github/codeql-action)
v4.38.1Compare Source
v4.38.0Compare Source
linux-arm64CodeQL bundle when available. #4072v4.37.9Compare Source
v4.37.8Compare Source
No user facing changes.
v4.37.7Compare Source
v4.37.6Compare Source
.github/codeql-config.ymlto align it with the suggested path that is used elsewhere. #4070v4.37.5Compare Source
initAction instead of falling back to downloading the bundle before extracting it. #4061v4.37.4Compare Source
v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
v4.36.2Compare Source
v4.36.1Compare Source
No user facing changes.
v4.36.0Compare Source
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892v4.35.4Compare Source
v4.35.3Compare Source
GETrequests instead ofHEADfor better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853v4.35.2Compare Source
CODEQL_ACTION_CLEANUP_TRAP_CACHESenvironment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing thetrap-caching: falseinput to theinitAction. #3795v4.35.1Compare Source
v4.35.0Compare Source
v4.34.1Compare Source
v4.34.0Compare Source
none. We expect this rollout to be complete by the end of April 2026. #3584v4.33.0Compare Source
Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562
To opt out of this change:
github-codeql-file-coverage-on-prsand the type "True/false", then set this property totruein the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set theCODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as
github-codeql-disable-overlaythat was previously only available on GitHub.com. #3559Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570
v4.32.6Compare Source
goreleaser/goreleaser (goreleaser/goreleaser)
v2.18.2Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Security updates
8ec05d6: sec(builds): redact secrets from builder subprocess output (@caarlos0)Bug fixes
f285d13: fix(archive,sourcearchive,gio): backups, ZIP metadata, mtime and CPU variants (#7089) (@caarlos0)d4e9f25: fix(aur): several PKGBUILD and SRCINFO generation bugs (#7100) (@caarlos0)b428c4c: fix(aur): tell users how to fix a duplicate architecture (#7141) (@caarlos0)2e991d2: fix(blob): KMS encryption limits and bucket lifetime on error (#7101) (@caarlos0)7ba40dc: fix(blob): stream unencrypted uploads instead of buffering files (#7134) (@raviayadav and @caarlos0)924f5eb: fix(brew,cask): formula escaping, token matching and binary stanzas (#7086) (@caarlos0)7c77e11: fix(build): resolve dependent hook environment entries and hook dir templates (#7078) (@caarlos0)d22c274: fix(builder/go): give a single ellipsis main an exact output path (#7114) (@caarlos0)be63647: fix(builder/go): keep override env entries in a stable order (#7112) (@caarlos0)4a635ab: fix(builder/go): register the generated C header after compiling (#7113) (@caarlos0)34619ef: fix(builder/node,builder/bun): per-target SEA config, prebuild templates and target aliases (#7088) (@caarlos0)c87158e: fix(builder/rust,builder/zig): toolchain context and wrapped binary copying (#7080) (@caarlos0)566bc69: fix(builder/uv,builder/poetry): match built artifact filenames (#7084) (@caarlos0)13ebd4d: fix(builders,partial): canonical artifact architectures and target matching (#7083) (@caarlos0)e1d9f7f: fix(cmd): auto-snapshot ordering, schema error reporting and --output selection (#7103) (@caarlos0)591a0b8: fix(cmd): correct check counting and init gitignore and failure handling (#7081) (@caarlos0)4f4febf: fix(docker): a bare platform means the baseline CPU variant (#7148) (@caarlos0)000ae78: fix(docker): keep arm64 minor variants above the v8 baseline (#7149) (@caarlos0)d2f775e: fix(docker): quote entrypoint paths and forward arguments verbatim (#7073) (@caarlos0)f2b3611: fix(docker): v1 wheel build IDs, push flags and empty manifests (#7077) (@caarlos0)ea7bc7a: fix(docker): v2 build context, annotations and ARM64 handling (#7095) (@caarlos0)a1f860f: fix(env,log): redact secrets across writes and honour force_token (#7104) (@caarlos0)0d4fe16: fix(exec,publish): cancellation, empty commands, SRPM artifacts and upload URLs (#7093) (@caarlos0)eba5886: fix(flatpak,docker): quote install paths and respect project environment (#7085) (@caarlos0)a95c9a0: fix(git): force column.ui=never so tag output is not columnized (#7127) (@KR-Ravindra)2d7ecb2: fix(git): tag not in the local repository is not an error (#7124) (@caarlos0)aebed26: fix(git,changelog): metadata quoting, dirty detection, key cleanup and mailmap (#7102) (@caarlos0)dce409c: fix(gitea,gitlab): pagination, subpath URLs, default branch, links and cancellation (#7097) (@caarlos0)0348bfb: fix(github): UTF-8 safe truncation, draft reuse, asset replacement and token override (#7094) (@caarlos0)0087e68: fix(github): honor short Retry-After delays (#7110) (@0jaspahwa)f45f629: fix(gomod): scope proxying to Go builds and validate the right module (#7096) (@caarlos0)cf292ef: fix(healthcheck): handle blank and space-containing signer commands (#7076) (@caarlos0)edd3fd0: fix(healthcheck): panic on dependency commands that are only shell syntax (#7106) (@caarlos0)43c0c94: fix(ko): repository image names, digest ordering and signing references (#7079) (@caarlos0)6ceb354: fix(mcp): support package transport URLs (#7090) (@caarlos0)acbfcf5: fix(nfpm): per-format Lintian overrides and colliding filenames (#7099) (@caarlos0)752baca: fix(nix): formatter output, string escaping and post_install (#7082) (@caarlos0)05ee35f: fix(nix): template the description only once (#7146) (@caarlos0)a3a8903: fix(project): evaluate name candidates lazily (#7111) (@0jaspahwa)25a52e5: fix(sbom,sign): disambiguate every target variant in default names (#7144) (@caarlos0)c62e59f: fix(scripts): correct pre-commit hook exit status, quoting and restaging (#7074) (@caarlos0)e0418e8: fix(sign,sbom,universalbinary): universal binary signing, per-variant names and duplicate slices (#7091) (@caarlos0)06bf150: fix(slack,smtp,config): cancellation, message escaping and block round-trips (#7092) (@caarlos0)cb8a445: fix(tmpl): deduplicate aggregate errors and stop mutating input (#7075) (@caarlos0)e99a557: fix(winget): do not allow multiple wingets with the same name (#7147) (@caarlos0)52e4c58: fix(winget,krew): manifest validation and executable paths (#7087) (@caarlos0)b15ccce: fix: address regressions since v2.18.1 (#7107) (@caarlos0)ac548c1: refactor: simplify internal code and test setup (#7068) (@caarlos0)Documentation updates
385916d: docs(builder/go): explain that ellipsis discovery uses the host context (#7115) (@caarlos0)e6d5fc5: docs: Add Kronk in USERS.md (#7151) (@gandarez)4faacf5: docs: fix configuration examples and reference mismatches (#7066) (@caarlos0)Other work
7d055fd: chore: auto-update generated files (#7070) (@goreleaserbot)7748fa7: chore: auto-update generated files (#7123) (@goreleaserbot)2ab3100: chore: auto-update generated files (#7129) (@goreleaserbot)46d055b: chore: cc maintainer on winget pull requests (#7071) (@caarlos0)c3afaa0: chore: fix lint on main (#7105) (@caarlos0)7c44449: chore: lint fixes (@caarlos0)Full Changelog: goreleaser/goreleaser@v2.18.1...v2.18.2
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.1Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Security updates
628c889: sec(deps): bump golang.org/x/crypto and golang.org/x/mod (#6872) (@caarlos0)Bug fixes
e38e2fd: fix(archive): report stripped binary paths (#6820) (@davicbtoliveira)315a4fd: fix(aursources): clarify error and document source.enabled requirement (#6816) (@0jaspahwa)b7f1239: fix(cask): deprecate url.verified (#6871) (@caarlos0)2c613de: fix(chocolatey): a skipped chocolatey entry stops the ones after it (#6853) (@hktitof)33cc363: fix(client): apply the commit config per command (#6852) (@caarlos0)db7a1e6: fix(client): stop TestGitLabRateLimitRetryAfter racing the clock (#6846) (@caarlos0)c8126af: fix(cmd): drop setup's unused return value (#6845) (@caarlos0)d951018: fix(docker): only use wheels of the configured ids (#6860) (@caarlos0)0a6f83e: fix(git): report repository detection errors (#6869) (@caarlos0)edcfdec](https://redirect.github.com/goreleaser/goreleaser/commit/edcfdec377860163720d03ac186f5ea5239501Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.