From 7962681a3a24b737efd54856143f3842ca4d4b30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 19:16:26 +0000 Subject: [PATCH] Chore(deps): Bump the actions group across 1 directory with 14 updates Bumps the actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `5` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.12.0` | `4.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `5.4.0` | `7.3.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `3.37.0` | `4.37.3` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.4.0` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5.10.0` | `6.2.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.9.1` | `4.1.2` | | [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) | `4.0.2` | `5.0.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.5.0` | `5.6.0` | | [actions/github-script](https://github.com/actions/github-script) | `8` | `9` | Updates `actions/checkout` from 5 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v5...v7) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `docker/setup-buildx-action` from 3.12.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) Updates `docker/build-push-action` from 5.4.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/ca052bb54ab0790a636c9b5f226502c73d547a25...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) Updates `actions/setup-python` from 5.6.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5.6.0...5fda3b95a4ea91299a34e894583c3862153e4b97) Updates `github/codeql-action/upload-sarif` from 3.37.0 to 4.37.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/02c5e83432fe5497fd85b873b6c9f16a8578e1d9...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) Updates `docker/login-action` from 3.7.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...af1e73f918a031802d376d3c8bbc3fe56130a9b0) Updates `docker/metadata-action` from 5.10.0 to 6.2.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/c299e40c65443455700f0fdfc63efafe5b349051...dc802804100637a589fabce1cb79ff13a1411302) Updates `sigstore/cosign-installer` from 3.9.1 to 4.1.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/398d4b0eeef1380460a10c8013a76f728fb906ac...6f9f17788090df1f26f669e9d70d6ae9567deba6) Updates `peter-evans/dockerhub-description` from 4.0.2 to 5.0.0 - [Release notes](https://github.com/peter-evans/dockerhub-description/releases) - [Commits](https://github.com/peter-evans/dockerhub-description/compare/432a30c9e07499fd01da9f8a49f0faf9e0ca5b77...1b9a80c056b620d92cedb9d9b5a223409c68ddfa) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `actions/github-script` from 8 to 9 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v8...v9) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: peter-evans/dockerhub-description dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 4 +-- .github/workflows/docker-build-test-push.yml | 34 +++++++++---------- .github/workflows/release.yml | 2 +- .../workflows/salesforce-code-analyzer.yml | 8 ++--- .github/workflows/sf-pr-validate.yml | 6 ++-- .github/workflows/sf-release.yml | 12 +++---- 6 files changed, 33 insertions(+), 33 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5cdd71a..c2e4d2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,9 +13,9 @@ jobs: quality: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 20 cache: npm diff --git a/.github/workflows/docker-build-test-push.yml b/.github/workflows/docker-build-test-push.yml index cae3387..4fb1bb1 100644 --- a/.github/workflows/docker-build-test-push.yml +++ b/.github/workflows/docker-build-test-push.yml @@ -69,13 +69,13 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Build Docker image - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} load: true @@ -93,7 +93,7 @@ jobs: run: docker save ${{ inputs.image-name }}:test | gzip > ${{ inputs.image-name }}.tar.gz - name: Upload image artifact - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ inputs.image-name }}-image path: ${{ inputs.image-name }}.tar.gz @@ -110,10 +110,10 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download image artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.image-name }}-image @@ -121,7 +121,7 @@ jobs: run: docker load < ${{ inputs.image-name }}.tar.gz - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} @@ -149,7 +149,7 @@ jobs: output: 'trivy-results.sarif' - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3.37.0 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 if: always() with: sarif_file: 'trivy-results.sarif' @@ -167,12 +167,12 @@ jobs: id-token: write steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # The single-arch tar is consumed by the version report below; the # multi-arch push rebuilds from context (unavoidable for multi-platform). - name: Download image artifact - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.image-name }}-image @@ -180,17 +180,17 @@ jobs: run: docker load < ${{ inputs.image-name }}.tar.gz - name: Set up Docker Buildx - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Log in to Docker Hub - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ inputs.dockerhub-username }} password: ${{ secrets.dockerhub-token }} - name: Extract metadata id: meta - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ inputs.dockerhub-username }}/${{ inputs.image-name }} # Two tags only: the exact release version (v1.2.3 -> 1.2.3) and latest. @@ -201,7 +201,7 @@ jobs: - name: Push multi-platform image id: push - uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ inputs.context }} platforms: ${{ inputs.platforms }} @@ -214,7 +214,7 @@ jobs: provenance: true - name: Install cosign - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 # Keyless signature over the pushed manifest-list digest, recorded in the # Rekor transparency log. Verify with: @@ -253,7 +253,7 @@ jobs: } > "$OUT" - name: Upload version report - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: version-report-${{ inputs.image-name }} path: version-report-${{ inputs.image-name }}.md @@ -267,7 +267,7 @@ jobs: - name: Sync README to Docker Hub if: ${{ inputs.image-description != '' }} continue-on-error: true - uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2 + uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 with: username: ${{ inputs.dockerhub-username }} password: ${{ secrets.dockerhub-token }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e258eb5..35b6705 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,7 +16,7 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create GitHub Release env: diff --git a/.github/workflows/salesforce-code-analyzer.yml b/.github/workflows/salesforce-code-analyzer.yml index 53f3f7c..43d5794 100644 --- a/.github/workflows/salesforce-code-analyzer.yml +++ b/.github/workflows/salesforce-code-analyzer.yml @@ -95,7 +95,7 @@ jobs: actions: read steps: - name: Check out files - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Verify workspace env: @@ -113,18 +113,18 @@ jobs: # PREREQUISITES - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} - name: Setup Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version }} distribution: "zulu" - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ inputs.python-version }} diff --git a/.github/workflows/sf-pr-validate.yml b/.github/workflows/sf-pr-validate.yml index 0a49309..9a8dc91 100644 --- a/.github/workflows/sf-pr-validate.yml +++ b/.github/workflows/sf-pr-validate.yml @@ -35,7 +35,7 @@ jobs: contents: read steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: submodules: ${{ inputs.checkout-submodules }} @@ -71,7 +71,7 @@ jobs: contents: read steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: submodules: ${{ inputs.checkout-submodules }} @@ -131,7 +131,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: scratch-org-tests-${{ github.run_number }} path: scratch-org-tests.txt diff --git a/.github/workflows/sf-release.yml b/.github/workflows/sf-release.yml index 0bf27f3..93e6bfe 100644 --- a/.github/workflows/sf-release.yml +++ b/.github/workflows/sf-release.yml @@ -75,7 +75,7 @@ jobs: tests: ${{ steps.find-tests.outputs.tests }} steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: ${{ inputs.checkout-submodules }} @@ -205,7 +205,7 @@ jobs: - name: Upload validation artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: sf-release-${{ github.run_number }} path: | @@ -236,7 +236,7 @@ jobs: quick-deployed: ${{ steps.deploy.outputs.quick-deployed }} steps: - name: Check out files - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: fetch-depth: 0 submodules: ${{ inputs.checkout-submodules }} @@ -251,7 +251,7 @@ jobs: - name: Find quick-deploy candidate id: candidate if: ${{ !inputs.full-deploy }} - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | core.setOutput('found', 'false'); @@ -299,7 +299,7 @@ jobs: - name: Download validation artifact if: steps.candidate.outputs.found == 'true' continue-on-error: true - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ${{ steps.candidate.outputs.artifact-name }} run-id: ${{ steps.candidate.outputs.run-id }} @@ -517,7 +517,7 @@ jobs: # not used. - name: Upload deploy audit artifact if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: sf-deploy-${{ github.run_number }} path: |