🌱 Bump github/codeql-action from 2.2.4 to 2.2.6 #2741
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
requested review from
azeemshaikh38,
justaugustus,
laurentsimon and
naveensrinivasan
as code owners
dependabot
bot
added
the
dependencies
dependabot
bot
added
the
github_actions
dependabot
bot
force-pushed
the
dependabot/github_actions/github/codeql-action-2.2.6
branch
from
35b00d4
to
4117aad
Compare
|
@dependabot rebase |
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.2.4 to 2.2.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@17573ee...16964e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
spencerschrock
approved these changes
Mar 14, 2023
dependabot
bot
force-pushed
the
dependabot/github_actions/github/codeql-action-2.2.6
branch
from
4117aad
to
17c7958
Compare
|
@dependabot squash and merge |
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## main #2741 +/- ##
=======================================
Coverage 49.91% 49.91%
=======================================
Files 156 156
Lines 11669 11669
=======================================
Hits 5825 5825
Misses 5490 5490
Partials 354 354 |
dependabot
bot
deleted the
dependabot/github_actions/github/codeql-action-2.2.6
branch
azeemshaikh38
added a commit
to azeemshaikh38/scorecard
that referenced
this pull request
Mar 14, 2023
commit 00da7a8be965c09d044f978d6b9eafee1350bd30
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date: Tue Mar 14 23:07:19 2023 +0000
Pr comments
commit 1127dd9
Merge: 274448f 23bd295
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date: Wed Mar 15 04:23:32 2023 +0530
Merge branch 'main' into go-git
commit 274448f
Author: Azeem Shaikh <azeemshaikh38@gmail.com>
Date: Tue Mar 14 22:52:30 2023 +0000
Initial implementation of go-git client
Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com>
commit 23bd295
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue Mar 14 20:28:41 2023 +0000
:seedling: Bump github/codeql-action from 2.2.4 to 2.2.6 (ossf#2741)
commit fc026ef
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue Mar 14 17:04:31 2023 +0000
:seedling: Bump github.com/google/ko from 0.12.0 to 0.13.0 in /tools (ossf#2742)
commit 2e04214
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue Mar 14 14:02:34 2023 +0000
:seedling: Bump tj-actions/changed-files from 35.6.2 to 35.7.0
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 35.6.2 to 35.7.0.
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](tj-actions/changed-files@5ce975c...bd376fb)
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
commit e36b590
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue Mar 14 08:59:20 2023 -0500
:seedling: Bump actions/cache from 3.3.0 to 3.3.1 (ossf#2740)
Bumps [actions/cache](https://github.com/actions/cache) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@940f3d7...88522ab)
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
commit 6ff94eb
Author: Gabriela Gutierrez <gabigutierrez@google.com>
Date: Mon Mar 13 19:42:37 2023 +0000
:bug: Handle editable pip installs (ossf#2731)
* fix: Handle editable pip install
Editable pip installs (-e) should be considered secure if the package is installed from a local source or a remote source (VCS install) but pinned by commit hash. To keep the behaviour we have for normal pip installs, we need to guarantee the package dependencies are pinned by hash too. For normal pip installs, we verify that by using --require-hashes flag. Unfortunately, --require-hashes flag is not compatible with editable installs, so we use --no-deps flag to verify the dependencies are not installed since we can't verify if they are pinned.
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Editable pip install in GHA
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Editable pip install in Dockerfile
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Editable pip install in shell script
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* fix: Code complexity increase
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* fix: Simplify boolean return
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* docs: Add pip editable install references in comments
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* fix: Handle multiple packages in editable pip install
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Multi editable pip install in GHA
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Multi editable pip install in Dockerfile
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
* test: Multi editable pip install in shell script
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
---------
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
commit 110e352
Author: raghavkaul <8695110+raghavkaul@users.noreply.github.com>
Date: Mon Mar 13 11:13:50 2023 -0400
✨ Gitlab support: RepoClient (ossf#2655)
* Add make targets and E2E test target for GitLab only
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add GitLab support to RepoClient
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Build
* Make target for e2e-gitlab-token
* Only run Gitlab tests in CI that don't require a token
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add tests
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Remove spurious printf
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* 🐛 Check OSS Fuzz build file for Fuzzing check (ossf#2719)
* Check OSS-Fuzz using project list
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Use clients.RepoClient interface to perform the new OSS Fuzz check
Signed-off-by: Spencer Schrock <sschrock@google.com>
* wip: add eager client for better repeated lookup of projects
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Split lazy and eager behavior into different implementations.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add tests and benchmarks
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Switch to always parsing JSON to determine if a project is present. The other approach of looking for a substring match would lead to false positives.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add eager constructor to surface status file errors sooner.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Switch existing users to new OSS Fuzz client
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Mark old method as deprecated in the godoc
Signed-off-by: Spencer Schrock <sschrock@google.com>
* remove unused comment.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Use new OSS Fuzz client in e2e test.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fix typo.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Fix potential path bug with test server.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Force include the two JSON files which were being ignored by .gitignore
Signed-off-by: Spencer Schrock <sschrock@google.com>
* trim the status json file
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Co-authored-by: Spencer Schrock <sschrock@google.com>
commit 5625dda
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat Mar 11 17:14:42 2023 +0000
:seedling: Bump github.com/onsi/ginkgo/v2 from 2.8.3 to 2.9.0 in /tools
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.8.3 to 2.9.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.8.3...v2.9.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
commit d591e38
Author: Spencer Schrock <sschrock@google.com>
Date: Fri Mar 10 16:02:05 2023 -0800
🌱 Add RepoClient re-use E2E tests. (ossf#2625)
* Add e2e test for re-used repoclient.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Improve diff logging
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Skip scorecard e2e test during unit tests.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Fix linter.
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
commit a7e81bb
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri Mar 10 08:20:28 2023 -0600
:seedling: Bump actions/cache from 3.2.6 to 3.3.0 (ossf#2738)
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@69d9d44...940f3d7)
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps github/codeql-action from 2.2.4 to 2.2.6.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
16964e9Merge pull request #1570 from github/update-v2.2.6-e12a2ecd474cbab4Update changelog for v2.2.6e12a2ecMerge pull request #1561 from github/dbartol/bundle-2.12.4d47d4c8Merge branch 'main' into dbartol/bundle-2.12.4f13b180Merge pull request #1567 from github/aeisenberg/config-parsing-ghesa3cf964Addsecurity-experimentaltocodeql-config.yml(#1566)0c27d0dAdd default values to feature flagse4b846cMerge pull request #1564 from github/aeisenberg/qlconfig-filec310f09Fix name of qlconfig file argument4366485Avoid passing an undefined qlconfig argYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot will merge this PR once CI passes on it, as requested by @spencerschrock.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)