Skip to content

ci: bump the actions group across 1 directory with 10 updates - #25

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-393ca023b6
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-393ca023b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •

Copy link
Copy Markdown

Bumps the actions group with 10 updates in the / directory:

Package From To
actions/checkout 4.4.0 7.0.1
actions/attest-build-provenance 2.4.0 4.2.2
actions/upload-artifact 4.6.2 7.0.1
actions/create-github-app-token 2.2.2 3.2.0
getplumber/plumber 0.4.26 0.5.6
actions/download-artifact 4.3.0 8.0.1
mikepenz/release-changelog-builder-action 5.4.1 6.3.0
softprops/action-gh-release 2.6.2 3.0.3
aquasecurity/trivy-action 0.35.0 0.36.0
gitleaks/gitleaks-action 2.3.9 3.0.0

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/attest-build-provenance from 2.4.0 to 4.2.2

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.2.2

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

v4.1.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0

v4.0.0

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/create-github-app-token from 2.2.2 to 3.2.0

Release notes

Sourced from actions/create-github-app-token's releases.

v3.2.0

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)

v3.1.1

3.1.1 (2026-04-11)

Bug Fixes

  • improve error message when app identifier is empty (#362) (07e2b76), closes #249

v3.1.0

3.1.0 (2026-04-11)

Bug Fixes

  • deps: bump p-retry from 7.1.1 to 8.0.0 (#357) (3bbe07d)

Features

v3.0.0

3.0.0 (2026-03-14)

Bug Fixes

... (truncated)

Changelog

Sourced from actions/create-github-app-token's changelog.

Changelog

3.2.0 (2026-05-12)

Features

  • add support for enterprise-level GitHub Apps (#263) (952a2a7)
  • support full repository names in repositories input (#372) (85eb8dd)

Bug Fixes

  • deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#364) (43e5c34)
  • validate private-key input (#376) (f24bbd8)
Commits
  • bcd2ba4 chore(main): release 3.2.0 (#370)
  • f24bbd8 fix: validate private-key input (#376)
  • 363531b docs: capitalize Git as a proper noun in README (#374)
  • fd28011 docs: update procedure to configure Git (#287)
  • 85eb8dd feat: support full repository names in repositories input (#372)
  • c9aabb8 build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...
  • e02e816 build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)
  • 8d835bf build(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...
  • 952a2a7 feat: add support for enterprise-level GitHub Apps (#263)
  • 43e5c34 fix(deps): bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependenc...
  • Additional commits viewable in compare view

Updates getplumber/plumber from 0.4.26 to 0.5.6

Release notes

Sourced from getplumber/plumber's releases.

v0.5.6

0.5.6 (2026-09-22)

Behaviour change

includesMustNotUseForbiddenVersions.defaultBranchIsForbiddenVersion unset now means true: an include pinned to the project's default branch is reported as ISSUE-404, which is what the control's documentation always promised (the schema default, the Go accessor and the Rego rule agree; plumber init seeds true). Anyone who enabled the control without setting the key sees new ISSUE-404 findings; set the key to false to keep the old behaviour.

Also in this release

  • Every GitLab finding message reads as one sentence with its technical tokens quoted (a corpus lint enforces five wording rules). Two data values move with the wording, neither an identity field: ISSUE-205 and ISSUE-203 report location: root_variables (was global) for the root variables: form, and ISSUE-204 stops publishing scriptBlock.
  • CTRL-102 is displayed as "Container images must not use forbidden reference" (configuration key unchanged).
  • The catalog JSON carries requiresTier on a control and tier on a schema field (premium | ultimate, absent when none).
  • The nine mergeRequestSettingsMustBeCompliant.* field descriptions are removed from the schema docs.

🐛 Bug Fixes

  • catalog: the control catalog names the gitlab tier a control or a field requires (ask 56) (8130a2c)
  • configuration,policies: the default branch is a forbidden include version by default, mr fields lose descriptions (50a60b0)
  • control,configuration: CTRL-102 is named container images must not use forbidden reference, the name copies agree (7ebbb6a)
  • policies: every gitlab finding message reads as one clear sentence with its technical tokens quoted (c298ed0)

✅ Tests

  • policies: every rewritten label and message branch is rendered by the corpus, ISSUE-506 labels are complete (18d0215)
  • policies: the ISSUE-502 and ISSUE-601 message branches are asserted, the lint rejects empty backquotes (9abef9a), closes #484
  • policies: the ISSUE-505 reasons are asserted and every string array in finding data passes the lint (c684a76)
  • policies: the squash clause of ISSUE-506 and every ISSUE-413 detail branch render through the lint (3ec811e)

👷 CI/CD

  • release: pin v0.5.5 refs [skip ci] (d874910)

v0.5.5

0.5.5 (2026-09-22)

🐛 Bug Fixes

  • github: a branch rename redirect is not a branch for ISSUE-402 (ae2d2c2), closes #482 #482
  • gitlab: spec:include input files contribute no jobs to attribution (57d8c82), closes #471 #471

👷 CI/CD

  • release: pin v0.5.4 refs [skip ci] (5dbcedb)

v0.5.4

0.5.4 (2026-09-21)

... (truncated)

Changelog

Sourced from getplumber/plumber's changelog.

0.5.8 (2026-09-23)

🐛 Bug Fixes

  • cmd: the bill mirrors the platform's byte and edge bounds, a bill the platform would refuse is omitted whole (d94a6c0)
  • gitlab,pbom: a component include carries its project, the bill of materials can key the component (34480c8)

✅ Tests

  • cmd: the edge bound is pinned through the services and runner tags terms (review) (7ba89d7)

👷 CI/CD

  • release: pin v0.5.7 refs [skip ci] (0dd46fb)

0.5.7 (2026-09-23)

🐛 Bug Fixes

  • cmd: the bill's bounds are measured on the wire section, an image naming more than 500 jobs omits the bill (91a74d9)
  • cmd: the platform push carries the pipeline bill of materials (bom, schema 1, bounded) (c0f1a21)
  • ir,gitlab,pbom: a job carries its runner tags, the bill of materials names each job's services and tags (1d3c9a6)

👷 CI/CD

  • release: pin v0.5.6 refs [skip ci] (ab18ada)

0.5.6 (2026-09-22)

🐛 Bug Fixes

  • catalog: the control catalog names the gitlab tier a control or a field requires (ask 56) (8130a2c)
  • configuration,policies: the default branch is a forbidden include version by default, mr fields lose descriptions (50a60b0)
  • control,configuration: CTRL-102 is named container images must not use forbidden reference, the name copies agree (7ebbb6a)
  • policies: every gitlab finding message reads as one clear sentence with its technical tokens quoted (c298ed0)

✅ Tests

  • policies: every rewritten label and message branch is rendered by the corpus, ISSUE-506 labels are complete (18d0215)
  • policies: the ISSUE-502 and ISSUE-601 message branches are asserted, the lint rejects empty backquotes (9abef9a), closes #484
  • policies: the ISSUE-505 reasons are asserted and every string array in finding data passes the lint (c684a76)
  • policies: the squash clause of ISSUE-506 and every ISSUE-413 detail branch render through the lint (3ec811e)

... (truncated)

Commits
  • fc8d926 chore(release): 0.5.6 [skip ci]
  • 18d0215 test(policies): every rewritten label and message branch is rendered by the c...
  • c684a76 test(policies): the ISSUE-505 reasons are asserted and every string array in ...
  • 3ec811e test(policies): the squash clause of ISSUE-506 and every ISSUE-413 detail bra...
  • 9abef9a test(policies): the ISSUE-502 and ISSUE-601 message branches are asserted, th...
  • 50a60b0 fix(configuration,policies): the default branch is a forbidden include versio...
  • 8130a2c fix(catalog): the control catalog names the gitlab tier a control or a field ...
  • 7ebbb6a fix(control,configuration): CTRL-102 is named container images must not use f...
  • c298ed0 fix(policies): every gitlab finding message reads as one clear sentence with ...
  • d874910 ci(release): pin v0.5.5 refs [skip ci]
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4.3.0 to 8.0.1

Release notes

Sourced from actions/download-artifact's releases.

v8.0.1

What's Changed

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates mikepenz/release-changelog-builder-action from 5.4.1 to 6.3.0

Release notes

Sourced from mikepenz/release-changelog-builder-action's releases.

v6.3.0

🚀 Features

  • ci: add OpenSSF Scorecard analysis and fix CI badge

💬 Other

  • ci: fix Scorecard Dangerous-Workflow finding (script injection)
  • dev -> main
  • ci: run Scorecard on develop, the default branch

📦 Dependencies

  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.4
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 4823a29
  • chore(deps): update node devdependency non-major updates
  • fix(deps): update dependency https-proxy-agent to v9.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance
  • chore(deps): update actions/checkout action to v7
  • chore(deps): lock file maintenance
  • fix(deps): update dependency semver to v7.8.5
  • chore(deps): update dependency js-yaml to v5
  • chore(deps): lock file maintenance
  • chore(deps): update node devdependency non-major updates
  • chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24-bullseye docker digest to 2449e39
  • chore(deps): update dependency vite to v8.1.0
  • chore(deps): update node devdependency non-major updates
  • chore(deps): lock file maintenance

... (truncated)

Commits
  • cb021f9 Merge pull request #1666 from mikepenz/develop
  • 48658d7 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#1665)
  • 6c6fe84 Merge pull request #1661 from mikepenz/renovate/node-devdependency-non-major-...
  • 27dc4b4 chore: rebuild dist for renovate
  • f911262 chore(deps): update node devdependency non-major updates
  • 217d3c7 Merge pull request #1660 from mikepenz/renovate/js-yaml-5.x
  • a5deb72 chore: rebuild dist for renovate
  • 72b7476 chore: sync js-yaml version between devDependencies and overrides
  • 325c6d9 chore(deps): update dependency js-yaml to v5.3.0

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f53ba93f-32fa-4805-84a1-0f14f7f59488

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-393ca023b6 branch 2 times, most recently from 653759a to 82f4565 Compare September 21, 2026 18:16
Bumps the actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `2.4.0` | `4.2.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.2` | `3.2.0` |
| [getplumber/plumber](https://github.com/getplumber/plumber) | `0.4.26` | `0.5.6` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` |
| [mikepenz/release-changelog-builder-action](https://github.com/mikepenz/release-changelog-builder-action) | `5.4.1` | `6.3.0` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `2.6.2` | `3.0.3` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` |
| [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2.3.9` | `3.0.0` |



Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

Updates `actions/attest-build-provenance` from 2.4.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@e8998f9...4d10147)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...043fb46)

Updates `actions/create-github-app-token` from 2.2.2 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@fee1f7d...bcd2ba4)

Updates `getplumber/plumber` from 0.4.26 to 0.5.6
- [Release notes](https://github.com/getplumber/plumber/releases)
- [Changelog](https://github.com/getplumber/plumber/blob/main/CHANGELOG.md)
- [Commits](getplumber/plumber@7ad9d26...fc8d926)

Updates `actions/download-artifact` from 4.3.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...3e5f45b)

Updates `mikepenz/release-changelog-builder-action` from 5.4.1 to 6.3.0
- [Release notes](https://github.com/mikepenz/release-changelog-builder-action/releases)
- [Commits](mikepenz/release-changelog-builder-action@c9dc836...cb021f9)

Updates `softprops/action-gh-release` from 2.6.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@3bb1273...efb3536)

Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@57a97c7...ed142fd)

Updates `gitleaks/gitleaks-action` from 2.3.9 to 3.0.0
- [Release notes](https://github.com/gitleaks/gitleaks-action/releases)
- [Commits](gitleaks/gitleaks-action@ff98106...e0c47f4)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: getplumber/plumber
  dependency-version: 0.4.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: gitleaks/gitleaks-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: mikepenz/release-changelog-builder-action
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-393ca023b6 branch from 82f4565 to aba8305 Compare September 25, 2026 11:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants