From bf0f962651fd8df51b6e3f81cfe194970a093fdf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 22:17:43 +0000 Subject: [PATCH] ci: bump the actions group across 1 directory with 18 updates Bumps the actions group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `7` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `4` | `8` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.28.0` | `0.36.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | | [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) | `3.1.0` | `3.5.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3` | `4` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `6` | `7` | | [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request) | `5` | `6` | | [google-github-actions/auth](https://github.com/google-github-actions/auth) | `2` | `3` | | [google-github-actions/get-gke-credentials](https://github.com/google-github-actions/get-gke-credentials) | `2` | `3` | | [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) | `2` | `3` | | [docker/login-action](https://github.com/docker/login-action) | `3` | `4` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3` | `4` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `5` | `6` | | [google-github-actions/setup-gcloud](https://github.com/google-github-actions/setup-gcloud) | `2` | `3` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) Updates `actions/setup-node` from 4 to 7 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v7) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) Updates `SonarSource/sonarqube-scan-action` from 4 to 8 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/v4...v8) Updates `aquasecurity/trivy-action` from 0.28.0 to 0.36.0 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/0.28.0...v0.36.0) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) Updates `hadolint/hadolint-action` from 3.1.0 to 3.5.0 - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](https://github.com/hadolint/hadolint-action/compare/v3.1.0...v3.5.0) Updates `docker/setup-buildx-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) Updates `docker/build-push-action` from 6 to 7 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) Updates `amannn/action-semantic-pull-request` from 5 to 6 - [Release notes](https://github.com/amannn/action-semantic-pull-request/releases) - [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md) - [Commits](https://github.com/amannn/action-semantic-pull-request/compare/v5...v6) Updates `google-github-actions/auth` from 2 to 3 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/auth/compare/v2...v3) Updates `google-github-actions/get-gke-credentials` from 2 to 3 - [Release notes](https://github.com/google-github-actions/get-gke-credentials/releases) - [Changelog](https://github.com/google-github-actions/get-gke-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/get-gke-credentials/compare/v2...v3) Updates `imranismail/setup-kustomize` from 2 to 3 - [Release notes](https://github.com/imranismail/setup-kustomize/releases) - [Commits](https://github.com/imranismail/setup-kustomize/compare/v2...v3) Updates `docker/login-action` from 3 to 4 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) Updates `docker/setup-qemu-action` from 3 to 4 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/v3...v4) Updates `docker/metadata-action` from 5 to 6 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) Updates `google-github-actions/setup-gcloud` from 2 to 3 - [Release notes](https://github.com/google-github-actions/setup-gcloud/releases) - [Changelog](https://github.com/google-github-actions/setup-gcloud/blob/main/CHANGELOG.md) - [Commits](https://github.com/google-github-actions/setup-gcloud/compare/v2...v3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: aquasecurity/trivy-action dependency-version: 0.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: hadolint/hadolint-action dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: amannn/action-semantic-pull-request dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: google-github-actions/auth dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: google-github-actions/get-gke-credentials dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: imranismail/setup-kustomize dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/setup-qemu-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: google-github-actions/setup-gcloud dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 38 +++++++++---------- .github/workflows/pr-validation.yml | 10 ++--- .github/workflows/reusable-deploy-gke.yml | 8 ++-- .../workflows/reusable-docker-build-push.yml | 20 +++++----- .github/workflows/rollback.yml | 8 ++-- 5 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cad2c51..4fb3546 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,10 +37,10 @@ jobs: working-directory: ${{ env.APP_DIR }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: ${{ env.NODE_VERSION }} cache: npm @@ -56,7 +56,7 @@ jobs: run: npm run test:ci - name: Upload coverage report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: coverage path: ${{ env.APP_DIR }}/coverage/lcov.info @@ -72,18 +72,18 @@ jobs: if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository steps: - name: Checkout (full history for blame/new-code detection) - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Download coverage report - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: coverage path: ${{ env.APP_DIR }}/coverage - name: SonarCloud scan - uses: SonarSource/sonarqube-scan-action@v4 + uses: SonarSource/sonarqube-scan-action@v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: https://sonarcloud.io @@ -104,11 +104,11 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Pass 1: produce SARIF for code scanning regardless of findings. - name: Trivy fs scan (SARIF report) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: fs scan-ref: . @@ -119,14 +119,14 @@ jobs: - name: Upload Trivy fs SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-fs.sarif category: trivy-fs # Pass 2: enforce the policy. Uses the DB cached by pass 1. - name: Trivy fs scan (policy gate) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: fs scan-ref: . @@ -146,10 +146,10 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: hadolint - uses: hadolint/hadolint-action@v3.1.0 + uses: hadolint/hadolint-action@v3.5.0 with: dockerfile: ${{ env.APP_DIR }}/Dockerfile config: .hadolint.yaml @@ -159,7 +159,7 @@ jobs: - name: Upload hadolint SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: hadolint.sarif category: hadolint @@ -174,13 +174,13 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build image (load locally, no push) - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: ${{ env.APP_DIR }} file: ${{ env.APP_DIR }}/Dockerfile @@ -214,7 +214,7 @@ jobs: echo "container smoke test passed" - name: Trivy image scan (SARIF report) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ env.IMAGE_LOCAL }} @@ -225,13 +225,13 @@ jobs: - name: Upload Trivy image SARIF if: always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-image.sarif category: trivy-image - name: Trivy image scan (policy gate) - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ env.IMAGE_LOCAL }} diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml index 48c0e88..271bc09 100644 --- a/.github/workflows/pr-validation.yml +++ b/.github/workflows/pr-validation.yml @@ -26,7 +26,7 @@ jobs: pull-requests: read steps: - name: Validate PR title - uses: amannn/action-semantic-pull-request@v5 + uses: amannn/action-semantic-pull-request@v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: @@ -52,7 +52,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: actionlint uses: raven-actions/actionlint@v2 @@ -69,7 +69,7 @@ jobs: overlay: [uat, prod] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up kubectl uses: azure/setup-kubectl@v4 @@ -101,10 +101,10 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Trivy Kubernetes misconfiguration scan - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: config scan-ref: k8s diff --git a/.github/workflows/reusable-deploy-gke.yml b/.github/workflows/reusable-deploy-gke.yml index 26c15d7..46bf7f1 100644 --- a/.github/workflows/reusable-deploy-gke.yml +++ b/.github/workflows/reusable-deploy-gke.yml @@ -92,7 +92,7 @@ jobs: new_revision: ${{ steps.post.outputs.revision }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Validate digest format run: | @@ -101,13 +101,13 @@ jobs: || { echo "refusing to deploy: '${{ inputs.digest }}' is not an immutable digest"; exit 1; } - name: Authenticate to Google Cloud (OIDC / WIF) - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} - name: Get GKE credentials - uses: google-github-actions/get-gke-credentials@v2 + uses: google-github-actions/get-gke-credentials@v3 with: cluster_name: ${{ inputs.cluster }} location: ${{ inputs.location }} @@ -116,7 +116,7 @@ jobs: # use_connect_gateway: true - name: Set up kustomize - uses: imranismail/setup-kustomize@v2 + uses: imranismail/setup-kustomize@v3 with: kustomize-version: "5.4.3" diff --git a/.github/workflows/reusable-docker-build-push.yml b/.github/workflows/reusable-docker-build-push.yml index 721ca75..119fa04 100644 --- a/.github/workflows/reusable-docker-build-push.yml +++ b/.github/workflows/reusable-docker-build-push.yml @@ -82,7 +82,7 @@ jobs: image_ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Compute image names id: names @@ -106,7 +106,7 @@ jobs: - name: Authenticate to Google Cloud (OIDC / WIF) id: auth - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} @@ -114,7 +114,7 @@ jobs: access_token_lifetime: 1200s - name: Log in to Artifact Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ inputs.registry }} username: oauth2accesstoken @@ -122,14 +122,14 @@ jobs: - name: Set up QEMU if: inputs.platforms != 'linux/amd64' - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Docker metadata (tags and OCI labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ steps.names.outputs.image }} # Tagging strategy (see docs/image-tagging-strategy.md): @@ -154,7 +154,7 @@ jobs: - name: Build and push id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: ${{ inputs.context }} file: ${{ inputs.dockerfile }} @@ -174,7 +174,7 @@ jobs: - name: Trivy scan of pushed image (SARIF report) if: inputs.scan_pushed_image - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} @@ -189,14 +189,14 @@ jobs: - name: Upload Trivy SARIF if: inputs.scan_pushed_image && always() - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-pushed-image.sarif category: trivy-pushed-image - name: Trivy scan of pushed image (policy gate) if: inputs.scan_pushed_image - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: image image-ref: ${{ steps.names.outputs.image }}@${{ steps.build.outputs.digest }} diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml index ef192a5..ded1f54 100644 --- a/.github/workflows/rollback.yml +++ b/.github/workflows/rollback.yml @@ -50,7 +50,7 @@ jobs: IMAGE_NAME: sample-service steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Resolve environment settings id: env @@ -70,16 +70,16 @@ jobs: echo "image=${{ vars.ARTIFACT_REGISTRY_HOST || 'asia-south1-docker.pkg.dev' }}/${{ secrets.GCP_PROJECT_ID }}/${{ vars.ARTIFACT_REGISTRY_REPO || 'apps' }}/${IMAGE_NAME}" >> "$GITHUB_OUTPUT" - name: Authenticate to Google Cloud (OIDC / WIF) - uses: google-github-actions/auth@v2 + uses: google-github-actions/auth@v3 with: workload_identity_provider: ${{ secrets.WIF_PROVIDER }} service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }} - name: Set up gcloud - uses: google-github-actions/setup-gcloud@v2 + uses: google-github-actions/setup-gcloud@v3 - name: Get GKE credentials - uses: google-github-actions/get-gke-credentials@v2 + uses: google-github-actions/get-gke-credentials@v3 with: cluster_name: ${{ steps.env.outputs.cluster }} location: ${{ vars.GKE_LOCATION }}