Update github actions - #3442
renovate[bot] wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea789882c5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0 | ||
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 |
There was a problem hiding this comment.
On tag releases, this step still requests GoReleaser 2.4.1 on line 49, but goreleaser-action v7.1+ added mandatory release checksum/signature verification and dropped pre-Cosign-v3 GoReleaser versions from its compatibility tests. Because 2.4.1 predates the Cosign v3 release format, the Linux job can fail while installing GoReleaser, which also blocks create-release; update the pinned CLI version to a supported release or retain action v7.0.0. The same incompatible pairing appears in .github/workflows/build.yml.
Useful? React with 👍 / 👎.
This comment has been minimized.
This comment has been minimized.
8672c80 to
35dca37
Compare
35dca37 to
6f4e12a
Compare
6f4e12a to
03a6de6
Compare
This PR contains the following updates:
v1.0.1→v1.0.5v1.0.4→v1.0.5v1.0.0→v1.0.5v6.0.2→v6.1.0v6.3.0→v6.5.0v10.2.0→v10.4.0v7.0.0→v7.0.1v4.32.5→v4.37.9v4.38.02.4.1→v2.18.1v7.0.0→v7.2.3v0.2.20→v0.2.2253d33d2→5ac6001v2.6.1→v2.6.2Release Notes
DataDog/coverage-upload-github-action (DataDog/coverage-upload-github-action)
v1.0.5Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.5
v1.0.4Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.4
v1.0.3Compare Source
What's Changed
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.3
v1.0.2Compare Source
What's Changed
New Contributors
Full Changelog: DataDog/coverage-upload-github-action@v1...v1.0.2
DataDog/dd-octo-sts-action (DataDog/dd-octo-sts-action)
v1.0.5Compare Source
DataDog/dd-sts-action (DataDog/dd-sts-action)
v1.0.5Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.4...v1.0.5
v1.0.4Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.3...v1.0.4
v1.0.3Compare Source
What's Changed
New Contributors
Full Changelog: DataDog/dd-sts-action@v1.0.2...v1.0.3
v1.0.2Compare Source
v1.0.1Compare Source
What's Changed
Full Changelog: DataDog/dd-sts-action@v1.0.0...v1.0.1
actions/checkout (actions/checkout)
v6.1.0Compare Source
v6.0.3Compare Source
actions/setup-go (actions/setup-go)
v6.5.0Compare Source
v6.4.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation update
New Contributors
Full Changelog: actions/setup-go@v6...v6.4.0
actions/stale (actions/stale)
v10.4.0Compare Source
What's Changed
Bug Fix
only-issue-typesvalidation by @trueberryless in #1338Dependency Updates
New Contributors
Full Changelog: actions/stale@v10.3.0...v10.4.0
v10.3.0Compare Source
What's Changed
Bug Fix
Dependency Updates
New Contributors
Full Changelog: actions/stale@v10...v10.3.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
github/codeql-action (github/codeql-action)
v4.37.9Compare Source
v4.37.8Compare Source
No user facing changes.
v4.37.7Compare Source
v4.37.6Compare Source
.github/codeql-config.ymlto align it with the suggested path that is used elsewhere. #4070v4.37.5Compare Source
initAction instead of falling back to downloading the bundle before extracting it. #4061v4.37.4Compare Source
v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
v4.36.2Compare Source
v4.36.1Compare Source
No user facing changes.
v4.36.0Compare Source
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892v4.35.4Compare Source
v4.35.3Compare Source
GETrequests instead ofHEADfor better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853v4.35.2Compare Source
CODEQL_ACTION_CLEANUP_TRAP_CACHESenvironment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing thetrap-caching: falseinput to theinitAction. #3795v4.35.1Compare Source
v4.35.0Compare Source
v4.34.1Compare Source
v4.34.0Compare Source
none. We expect this rollout to be complete by the end of April 2026. #3584v4.33.0Compare Source
Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562
To opt out of this change:
github-codeql-file-coverage-on-prsand the type "True/false", then set this property totruein the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set theCODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as
github-codeql-disable-overlaythat was previously only available on GitHub.com. #3559Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570
v4.32.6Compare Source
goreleaser/goreleaser (goreleaser/goreleaser)
v2.18.1Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
Security updates
628c889: sec(deps): bump golang.org/x/crypto and golang.org/x/mod (#6872) (@caarlos0)Bug fixes
e38e2fd: fix(archive): report stripped binary paths (#6820) (@davicbtoliveira)315a4fd: fix(aursources): clarify error and document source.enabled requirement (#6816) (@0jaspahwa)b7f1239: fix(cask): deprecate url.verified (#6871) (@caarlos0)2c613de: fix(chocolatey): a skipped chocolatey entry stops the ones after it (#6853) (@hktitof)33cc363: fix(client): apply the commit config per command (#6852) (@caarlos0)db7a1e6: fix(client): stop TestGitLabRateLimitRetryAfter racing the clock (#6846) (@caarlos0)c8126af: fix(cmd): drop setup's unused return value (#6845) (@caarlos0)d951018: fix(docker): only use wheels of the configured ids (#6860) (@caarlos0)0a6f83e: fix(git): report repository detection errors (#6869) (@caarlos0)edcfdec: fix(gitlab): own the retries, and honor replace_existing_artifacts (#6843) (@caarlos0)f5edd73: fix(gomod): don't read the module path from stderr (#6864) (@caarlos0)35051e4: fix(sign): warn when the signer writes no file, fail in v3 (#6842) (@caarlos0)e1a1e9c: fix: map every 32-bit ARM variant to Termux's "arm" (#6857) (@dylanpulver)Documentation updates
e5730eb: docs: fix broken commands, dead links, and inaccurate options (#6841) (@caarlos0)Other work
8afe0bb: chore: auto-update generated files (#6811) (@goreleaserbot)c1493d3: chore: auto-update generated files (#6812) (@goreleaserbot)3294442: chore: auto-update generated files (#6861) (@goreleaserbot)6e40871: chore: update to Go 1.27.1 (#6859) (@caarlos0)4181c4f: perf(git): ask git once (#6850) (@caarlos0)dcbe117: perf(node): faster dist extraction, and stop leaking it into TMPDIR (#6844) (@caarlos0)36e43dd: perf: skip needless docker probes; make the ko registry test hermetic (#6827) (@caarlos0)Full Changelog: goreleaser/goreleaser@v2.18.0...v2.18.1
Helping out
This release is only possible thanks to all the support of some awesome people!
Want to be one of them?
You can sponsor, get a Pro License or contribute with code.
Where to go next?
v2.18.0Compare Source
Announcement
Read the official announcement: Announcing GoReleaser v2.18.
Changelog
New Features
601cd87: feat(ko): support templating for local_domain, base_image, and repositories (#6741) (@mrueg)de88f38: feat(winget): support publishing additional locale manifests (#6733) (@MohammedAnasuddinZaid)cefbc6f: feat: add iru custom apps publisher (#6709) (@wimwenigerkind)1d6e7c0: feat: allow PR creation to use a different auth token (#6717) (@emily-curry)4c41ac0: feat: preflight checks (#6704) (@caarlos0)060260a: feat: release summary (#6810) (@caarlos0)82a5aba: feat: update to Go 1.27 (#6802) (@caarlos0)Security updates
b1cafd4: sec(deps): bump go-openapi/spec and go-openapi/validade (#6766) (@caarlos0)Bug fixes
1970443: fix(aur): expand description templates before escaping quotes (#6791) (@VXNCXNX and @caarlos0)a27402d: fix(blob): honor s3_force_path_style without a custom endpoint (#6789) (@VXNCXNX and @caarlos0)db65b99: fix(brew): a formula without a repository stops the ones after it (#6783) (@caarlos0)2b5fb31: fix(build): node windows targets get no .exe extension (#6777) (@VXNCXNX and @vxncxnx)951fc57: fix(cask): a cask without a repository stops the ones after it (#6785) (@caarlos0)54a6c8e: fix(cask): emit Casks that pass brew style (#6752) (@r0h1tb)2d6b235: fix(changelog): a commit matching two include filters is listed twice (#6773) (@VXNCXNX and @caarlos0)c4cc86f: fix(chocolatey): error on multiple archives for the same platform (#6792) (@VXNCXNX)1a246da: fix(config): type retry durations as strings in schema (#6801) (@skatkov)8be344b: fix(docker): add gpg-agent to the image (#6763) (@caarlos0)5282589: fix(dockers/v2): annotation scopes (#6800) (@CraigAstillRVU and @caarlos0)5560bb9: fix(flatpak): a disabled flatpak stops the ones after it (#6781) (@VXNCXNX)b68113a: fix(git): tag templates strip apostrophes from the message (#6779) (@VXNCXNX and @vxncxnx)1bc6ec7: fix(healthcheck): register upx and makeself dependency checkers (#6793) (@VXNCXNX)9d7d49f: fix(krew): a manifest without a name stops the ones after it (#6787) (@caarlos0)4276c51: fix(krew): apply the documented goarm default (#6775) (@VXNCXNX and @vxncxnx)9700230: fix(mcp): mcp.disable is documented but never read (#6795) (@VXNCXNX)1d79a09: fix(milestone): a milestone with close disabled stops the ones after it (#6778) (@VXNCXNX and @vxncxnx)2a0393d: fix(nfpm): don't set deb arch variant for goamd64 v1 (#6765) (@caarlos0)912704c: fix(nfpm): overrides ignore package_name, epoch, release and prerelease (#6782) (@VXNCXNX)3cf25c0: fix(nfpm): record the conventional extension, not the format name (#6776) (@VXNCXNX and @vxncxnx)ad028a3: fix(nix): a skipped nix entry stops the ones after it (#6788) (@VXNCXNX)b787cd2: fix(notarize): cap macOS notarization timeout at 20m (#6758) (@caarlos0)81a5509: fix(sign): artifacts: none masks real signing failures (#6790) (@VXNCXNX)4eb6037: fix(snapcraft): a disabled snap stops the ones after it (#6784) (@caarlos0)d93d0f1: fix(snapcraft): assumes, hooks and plugs are dropped when apps is omitted (#6780) (@VXNCXNX and @vxncxnx)b3bbd53: fix(srpm): make documented rpm fields actually configurable (#6762) (@caarlos0)7304fdb: fix(tmpl): register the documented join template function (#6772) (@VXNCXNX)6f88b00: fix(upload): a misconfigured upload stops the others (#6786) (@caarlos0)67e4c45: fix(winget): a skipped winget entry stops the ones after it (#6797) (@VXNCXNX)92453c1: fix(winget): count arm64 in the duplicate-archive check (#6774) (@VXNCXNX and @caarlos0)9a43dd0: fix(winget): fall back to the default description in additional locales (#6771) (@VXNCXNX)6127e0f: fix: do not panic decoding a commit whose message contains a log marker (#6738) (@arpitjain099)02cfda7: fix: lint (@caarlos0)b990083: fix: surface archive Close errors when writing release archives (#6690) (@SebTardif and @caarlos0)Documentation updates
33a3f22: docs(dockers_v2): clarify that build and push are a single step (#6742) (@caarlos0)1eb0ee9: docs: download SBOMs (#6803) (@caarlos0)16debcb: docs: many fixes (@caarlos0)ff2822a: docs: update dockers_v2 (@caarlos0)686946e: docs: use correct script for debconf (#6759) (@Daniel15)9921479: docs: use formats plural syntax (#6756) (@FelicianoTech)Other work
2b80858: chore: auto-update generated files (#6731) (@goreleaserbot)7df2cd5: chore: auto-update generated files (#6732) (@goreleaserbot)dd08c1f: chore: auto-update generated files ([#6740](https://redConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.