From db5f1ad029fe3b166def8f043f62c3cd167d9137 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Nov 2026 04:50:17 +0000 Subject: [PATCH] build(deps): bump the actions group across 2 directories with 7 updates Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.8.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.3` | `4.39.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.3` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.3` | `4.39.1` | | [docker/docs/.github/workflows/validate-upstream.yml](https://github.com/docker/docs) | `31d174d090fd7111ca2199ed54a3978e0d4ac74d` | `53581df94e05ad4116a8d31e47ea098289fa5498` | | [docker/docker-agent-action/.github/workflows/review-pr.yml](https://github.com/docker/docker-agent-action) | `2.0.9` | `2.1.0` | Bumps the actions group with 1 update in the /.github/actions/setup-buildx directory: [docker/login-action](https://github.com/docker/login-action). Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.8.0 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...53290badfa369cb0bf7ad16342cb62c2fa47ac7b) Updates `github/codeql-action/init` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/autobuild` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `docker/docs/.github/workflows/validate-upstream.yml` from 31d174d090fd7111ca2199ed54a3978e0d4ac74d to 53581df94e05ad4116a8d31e47ea098289fa5498 - [Commits](https://github.com/docker/docs/compare/31d174d090fd7111ca2199ed54a3978e0d4ac74d...53581df94e05ad4116a8d31e47ea098289fa5498) Updates `docker/docker-agent-action/.github/workflows/review-pr.yml` from 2.0.9 to 2.1.0 - [Release notes](https://github.com/docker/docker-agent-action/releases) - [Commits](https://github.com/docker/docker-agent-action/compare/3654ec391b070e247de2e2e3c1ff2519b6378b3a...aaa657c53cc69ed15683cd8a985d86663a0e1594) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) --- updated-dependencies: - dependency-name: zizmorcore/zizmor-action dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/docs/.github/workflows/validate-upstream.yml dependency-version: 53581df94e05ad4116a8d31e47ea098289fa5498 dependency-type: direct:production dependency-group: actions - dependency-name: docker/docker-agent-action/.github/workflows/review-pr.yml dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/actions/setup-buildx/action.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/docs.yml | 2 +- .github/workflows/pr-review.yml | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/actions/setup-buildx/action.yml b/.github/actions/setup-buildx/action.yml index 177e88345..09057cc46 100644 --- a/.github/actions/setup-buildx/action.yml +++ b/.github/actions/setup-buildx/action.yml @@ -63,7 +63,7 @@ runs: connection-id: ${{ inputs.connection-id }} expires-in: 3600 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 with: username: docker password: ${{ steps.oidc.outputs.token }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e2bfdb932..c8300abe1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -137,7 +137,7 @@ jobs: # Static security audit of workflows and composite actions; config in # .github/zizmor.yml. Findings at low severity and above fail the job. - name: zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 with: advanced-security: false annotations: true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 40ce11dd1..768ea902c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -46,16 +46,16 @@ jobs: task: 'false' - name: Initialize CodeQL - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Autobuild if: matrix.build-mode == 'autobuild' - uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - name: Analyze - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index e5eb78255..e615565ab 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -183,6 +183,6 @@ jobs: # this commit and runs htmltest on the output. A no-op until docker/docs # imports github.com/docker/docker-agent (issue #3371, Phase 2.1). upstream: - uses: docker/docs/.github/workflows/validate-upstream.yml@31d174d090fd7111ca2199ed54a3978e0d4ac74d # main + uses: docker/docs/.github/workflows/validate-upstream.yml@53581df94e05ad4116a8d31e47ea098289fa5498 # main with: module-name: docker/docker-agent diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 710fbb63d..ff3ce10dc 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -18,7 +18,7 @@ jobs: if: | github.event_name == 'issue_comment' || github.event.workflow_run.conclusion == 'success' - uses: docker/docker-agent-action/.github/workflows/review-pr.yml@3654ec391b070e247de2e2e3c1ff2519b6378b3a # v2.0.9 + uses: docker/docker-agent-action/.github/workflows/review-pr.yml@aaa657c53cc69ed15683cd8a985d86663a0e1594 # v2.1.0 # Scoped to the job so other jobs in this workflow aren't over-permissioned permissions: contents: read # Read repository files and PR diffs