bump cosign to v2.2.0 #142
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
cpanato
commented
Sep 1, 2023
cpanato
commented
- bump cosign to v2.2.0
Signed-off-by: cpanato <ctadeu@gmail.com>
bobcallaway
approved these changes
Sep 1, 2023
scottames
pushed a commit
to scottames/ublue
that referenced
this pull request
Sep 16, 2023
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [sigstore/cosign-installer](https://togithub.com/sigstore/cosign-installer) | action | patch | `v3.1.1` -> `v3.1.2` | --- ### Release Notes <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v3.1.2`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.2) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.1...v3.1.2) ##### What's Changed - Fix build and push step Readme missing id by [@​hbenali](https://togithub.com/hbenali) in [sigstore/cosign-installer#138 - bump cosign to v2.2.0 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#142 ##### New Contributors - [@​hbenali](https://togithub.com/hbenali) made their first contribution in [sigstore/cosign-installer#138 **Full Changelog**: sigstore/cosign-installer@v3...v3.1.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 4pm on friday" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/scottames/ublue). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi42OC4xIiwidXBkYXRlZEluVmVyIjoiMzYuNjguMSIsInRhcmdldEJyYW5jaCI6ImxpdmUifQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ianlewis
pushed a commit
to slsa-framework/slsa-github-generator
that referenced
this pull request
Oct 23, 2023
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | actions/checkout | action | digest | `96f5310` -> `b4ffde6` | | [actions/checkout](https://togithub.com/actions/checkout) | action | minor | `v4.0.0` -> `v4.1.1` | | [actions/setup-go](https://togithub.com/actions/setup-go) | action | minor | `v4.0.1` -> `v4.1.0` | | [actions/setup-java](https://togithub.com/actions/setup-java) | action | minor | `v3.12.0` -> `v3.13.0` | | [actions/setup-node](https://togithub.com/actions/setup-node) | action | minor | `v3.7.0` -> `v3.8.1` | | [actions/setup-node](https://togithub.com/actions/setup-node) | action | digest | `e33196f` -> `5e21ff4` | | [actions/upload-artifact](https://togithub.com/actions/upload-artifact) | action | patch | `v3.1.2` -> `v3.1.3` | | [github/codeql-action](https://togithub.com/github/codeql-action) | action | minor | `v2.21.2` -> `v2.22.4` | | [gradle/gradle-build-action](https://togithub.com/gradle/gradle-build-action) | action | minor | `v2.7.0` -> `v2.9.0` | | [ossf/scorecard-action](https://togithub.com/ossf/scorecard-action) | action | minor | `v2.2.0` -> `v2.3.0` | | [sigstore/cosign-installer](https://togithub.com/sigstore/cosign-installer) | action | patch | `v3.1.1` -> `v3.1.2` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v4.1.1`](https://togithub.com/actions/checkout/releases/tag/v4.1.1) [Compare Source](https://togithub.com/actions/checkout/compare/v4.1.0...v4.1.1) ##### What's Changed - Update CODEOWNERS to Launch team by [@​joshmgross](https://togithub.com/joshmgross) in [actions/checkout#1510 - Correct link to GitHub Docs by [@​peterbe](https://togithub.com/peterbe) in [actions/checkout#1511 - Link to release page from what's new section by [@​cory-miller](https://togithub.com/cory-miller) in [actions/checkout#1514 ##### New Contributors - [@​joshmgross](https://togithub.com/joshmgross) made their first contribution in [actions/checkout#1510 - [@​peterbe](https://togithub.com/peterbe) made their first contribution in [actions/checkout#1511 **Full Changelog**: actions/checkout@v4...v4.1.1 ### [`v4.1.0`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v410) [Compare Source](https://togithub.com/actions/checkout/compare/v4.0.0...v4.1.0) - [Add support for partial checkout filters](https://togithub.com/actions/checkout/pull/1396) </details> <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v4.1.0`](https://togithub.com/actions/setup-go/releases/tag/v4.1.0) [Compare Source](https://togithub.com/actions/setup-go/compare/v4.0.1...v4.1.0) #### What's Changed In scope of this release, slow installation on Windows was fixed by [@​dsame](https://togithub.com/dsame) in [actions/setup-go#393 and OS version was added to `primaryKey` for Ubuntu runners to avoid conflicts ([actions/setup-go#383) This release also includes the following changes: - Remove implicit dependencies by [@​nikolai-laevskii](https://togithub.com/nikolai-laevskii) in [actions/setup-go#378 - Update action.yml by [@​mkelly](https://togithub.com/mkelly) in [actions/setup-go#379 - Added a description that go-version should be specified as a string type by [@​n3xem](https://togithub.com/n3xem) in [actions/setup-go#367 - Add note about YAML parsing versions by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-go#382 - Automatic update of configuration files from 05/23/2023 by [@​github-actions](https://togithub.com/github-actions) in [actions/setup-go#377 - Bump tough-cookie and [@​azure/ms-rest-js](https://togithub.com/azure/ms-rest-js) by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-go#392 - Bump word-wrap from 1.2.3 to 1.2.4 by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-go#397 - Bump semver from 6.3.0 to 6.3.1 by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-go#396 #### New Contributors - [@​mkelly](https://togithub.com/mkelly) made their first contribution in [actions/setup-go#379 - [@​n3xem](https://togithub.com/n3xem) made their first contribution in [actions/setup-go#367 **Full Changelog**: actions/setup-go@v4...v4.1.0 </details> <details> <summary>actions/setup-java (actions/setup-java)</summary> ### [`v3.13.0`](https://togithub.com/actions/setup-java/releases/tag/v3.13.0) [Compare Source](https://togithub.com/actions/setup-java/compare/v3.12.0...v3.13.0) ##### What's changed In the scope of this release, support for Dragonwell JDK was added by [@​Accelerator1996](https://togithub.com/Accelerator1996) in [actions/setup-java#532 ```yaml steps: - name: Checkout uses: actions/checkout@v3 - name: Setup-java uses: actions/setup-java@v3 with: distribution: 'dragonwell' java-version: '17' ``` Several inaccuracies were also fixed: - Fix XML namespaces wrongly using https by [@​gnodet](https://togithub.com/gnodet) in [actions/setup-java#503 - Fix typo and remove unintentional(?) word by [@​CyberFlameGO](https://togithub.com/CyberFlameGO) in [actions/setup-java#518 - Fix usage link within the README.md file by [@​dassiorleando](https://togithub.com/dassiorleando) in [actions/setup-java#525 ##### New Contributors - [@​CyberFlameGO](https://togithub.com/CyberFlameGO) made their first contribution in [actions/setup-java#518 - [@​dassiorleando](https://togithub.com/dassiorleando) made their first contribution in [actions/setup-java#525 - [@​gnodet](https://togithub.com/gnodet) made their first contribution in [actions/setup-java#503 - [@​Accelerator1996](https://togithub.com/Accelerator1996) made their first contribution in [actions/setup-java#532 **Full Changelog**: actions/setup-java@v3...v3.13.0 </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v3.8.1`](https://togithub.com/actions/setup-node/releases/tag/v3.8.1) [Compare Source](https://togithub.com/actions/setup-node/compare/v3.8.0...v3.8.1) #### What's Changed In scope of this release, the filter was removed within the cache-save step by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#831. It is filtered and checked in the toolkit/cache library. **Full Changelog**: actions/setup-node@v3...v3.8.1 ### [`v3.8.0`](https://togithub.com/actions/setup-node/releases/tag/v3.8.0) [Compare Source](https://togithub.com/actions/setup-node/compare/v3.7.0...v3.8.0) ##### What's Changed ##### Bug fixes: - Add check for existing paths by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#803 - Resolve SymbolicLink by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#809 - Change passing logic for cache input by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#816 - Fix armv7 cache issue by [@​louislam](https://togithub.com/louislam) in [actions/setup-node#794 - Update check-dist workflow name by [@​sinchang](https://togithub.com/sinchang) in [actions/setup-node#710 ##### Feature implementations: - feat: handling the case where "node" is used for tool-versions file. by [@​xytis](https://togithub.com/xytis) in [actions/setup-node#812 ##### Documentation changes: - Refer to semver package name in README.md by [@​olleolleolle](https://togithub.com/olleolleolle) in [actions/setup-node#808 ##### Update dependencies: - Update toolkit cache to fix zstd by [@​dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#804 - Bump tough-cookie and [@​azure/ms-rest-js](https://togithub.com/azure/ms-rest-js) by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-node#802 - Bump semver from 6.1.2 to 6.3.1 by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-node#807 - Bump word-wrap from 1.2.3 to 1.2.4 by [@​dependabot](https://togithub.com/dependabot) in [actions/setup-node#815 ##### New Contributors - [@​olleolleolle](https://togithub.com/olleolleolle) made their first contribution in [actions/setup-node#808 - [@​louislam](https://togithub.com/louislam) made their first contribution in [actions/setup-node#794 - [@​sinchang](https://togithub.com/sinchang) made their first contribution in [actions/setup-node#710 - [@​xytis](https://togithub.com/xytis) made their first contribution in [actions/setup-node#812 **Full Changelog**: actions/setup-node@v3...v3.8.0 </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v3.1.3`](https://togithub.com/actions/upload-artifact/releases/tag/v3.1.3) [Compare Source](https://togithub.com/actions/upload-artifact/compare/v3.1.2...v3.1.3) #### What's Changed - chore(github): remove trailing whitespaces by [@​ljmf00](https://togithub.com/ljmf00) in [actions/upload-artifact#313 - Bump [@​actions/artifact](https://togithub.com/actions/artifact) version to v1.1.2 by [@​bethanyj28](https://togithub.com/bethanyj28) in [actions/upload-artifact#436 **Full Changelog**: actions/upload-artifact@v3...v3.1.3 </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v2.22.4`](https://togithub.com/github/codeql-action/compare/v2.22.3...v2.22.4) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.3...v2.22.4) ### [`v2.22.3`](https://togithub.com/github/codeql-action/compare/v2.22.2...v2.22.3) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.2...v2.22.3) ### [`v2.22.2`](https://togithub.com/github/codeql-action/compare/v2.22.1...v2.22.2) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.1...v2.22.2) ### [`v2.22.1`](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) ### [`v2.22.0`](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) ### [`v2.21.9`](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) ### [`v2.21.8`](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) ### [`v2.21.7`](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) ### [`v2.21.6`](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) ### [`v2.21.5`](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) ### [`v2.21.4`](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.3...v2.21.4) ### [`v2.21.3`](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.2...v2.21.3) </details> <details> <summary>gradle/gradle-build-action (gradle/gradle-build-action)</summary> ### [`v2.9.0`](https://togithub.com/gradle/gradle-build-action/releases/tag/v2.9.0) [Compare Source](https://togithub.com/gradle/gradle-build-action/compare/v2.8.1...v2.9.0) The GitHub [dependency-review-action](https://togithub.com/actions/dependency-review-action) helps you understand dependency changes (and the security impact of these changes) for a pull request. This release updates the GItHub Dependency Graph support to be compatible with the `dependency-review-action`. See [the documentation](https://togithub.com/gradle/gradle-build-action#integrating-the-dependency-review-action) for detailed examples. ##### Changelog - \[FIX] Use correct SHA for `pull-request` events [#​882](https://togithub.com/gradle/gradle-build-action/issues/882) - \[FIX] Avoid generating dependency graph during cache cleanup [#​905](https://togithub.com/gradle/gradle-build-action/issues/905) - \[NEW] Improve warning on failure to submit dependency graph - \[NEW] Compatibility with GitHub `dependency-review-action` [#​879](https://togithub.com/gradle/gradle-build-action/issues/879) **Full-changelog**: gradle/gradle-build-action@v2.8.1...v2.9.0 ### [`v2.8.1`](https://togithub.com/gradle/gradle-build-action/releases/tag/v2.8.1) [Compare Source](https://togithub.com/gradle/gradle-build-action/compare/v2.8.0...v2.8.1) Fixes an issue that prevented Dependency Graph submission when running on GitHub Enterprise Server. ##### Fixes - Incorrect endpoint used to submit Dependency Graph on GitHub Enterprise [#​885](https://togithub.com/gradle/gradle-build-action/issues/885) ##### Changelog ### [`v2.8.0`](https://togithub.com/gradle/gradle-build-action/releases/tag/v2.8.0) [Compare Source](https://togithub.com/gradle/gradle-build-action/compare/v2.7.1...v2.8.0) The `v2.8.0` release of the `gradle-build-action` introduces an easy mechanism to connect to Gradle Enterprise, as well improved support for self-hosted GitHub Actions runners. ##### Automatic injection of Gradle Enterprise connectivity It is now possible to connect a Gradle build to Gradle Enterprise without changing any of the Gradle project sources. This is achieved through Gradle Enterprise injection, where an init-script will apply the Gradle Enterprise plugin and associated configuration. This feature can be useful to easily trial Gradle Enterprise on a project, or to centralize Gradle Enterprise configuration for all GitHub Actions workflows in an organization. See [Gradle Enterprise injection in the README](https://togithub.com/gradle/gradle-build-action/blob/v2.8.0/README.md#gradle-enterprise-plugin-injection) for more info. ##### Restore Gradle User Home when directory already exists Previously, the Gradle User Home would not be restored if the directory already exists. This wasn't normally an issue with GitHub-hosted runners, but limited the usefulness of the action for persistent, self-hosted runners. This behaviour has been improved in this release: - The Job Summary now includes a useful error message when Gradle User Home was not restored because the directory already exists. - The action can now be configured to restore the Gradle User Home when the directory already exists, overwriting existing content with content from the GitHub Actions cache. See https://github.com/gradle/gradle-build-action#overwriting-an-existing-gradle-user-home for more details. ##### Changes **Issues fixed**: https://github.com/gradle/gradle-build-action/issues?q=milestone%3A2.8.0+is%3Aclosed **Full changelog**: gradle/gradle-build-action@v2.7.1...v2.8.0 ### [`v2.7.1`](https://togithub.com/gradle/gradle-build-action/releases/tag/v2.7.1) [Compare Source](https://togithub.com/gradle/gradle-build-action/compare/v2.7.0...v2.7.1) This release contains no code changes, only dependency updates and documentation improvements. ##### Changelog </details> <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.3.0`](https://togithub.com/ossf/scorecard-action/releases/tag/v2.3.0) [Compare Source](https://togithub.com/ossf/scorecard-action/compare/v2.2.0...v2.3.0) #### What's Changed - 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by [@​spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1270 - For a full changelist of what this includes, see the [v4.12.0](https://togithub.com/ossf/scorecard/releases/tag/v4.12.0) and [v4.13.0](https://togithub.com/ossf/scorecard/releases/tag/v4.13.0) release notes - ✨ Send rekor tlog index to webapp when publishing results by [@​spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1169 - 🐛 Prevent url clipping for GHES instances by [@​rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1225 ##### Documentation - 📖 Update access rights needed to see the results in code scanning by [@​rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1229 - 📖 Add package comments. by [@​spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1221 - 📖 Add SECURITY.md file by [@​david-a-wheeler](https://togithub.com/david-a-wheeler) in [ossf/scorecard-action#1250 - 📖 Fix typo in token input docs by [@​aabouzaid](https://togithub.com/aabouzaid) in [ossf/scorecard-action#1258 #### New Contributors - [@​david-a-wheeler](https://togithub.com/david-a-wheeler) made their first contribution in [ossf/scorecard-action#1250 - [@​aabouzaid](https://togithub.com/aabouzaid) made their first contribution in [ossf/scorecard-action#1258 **Full Changelog**: ossf/scorecard-action@v2.2.0...v2.3.0 </details> <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v3.1.2`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.2) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.1...v3.1.2) #### What's Changed - Fix build and push step Readme missing id by [@​hbenali](https://togithub.com/hbenali) in [sigstore/cosign-installer#138 - bump cosign to v2.2.0 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#142 #### New Contributors - [@​hbenali](https://togithub.com/hbenali) made their first contribution in [sigstore/cosign-installer#138 **Full Changelog**: sigstore/cosign-installer@v3...v3.1.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-github-generator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44LjEiLCJ1cGRhdGVkSW5WZXIiOiIzNy4xOS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Signed-off-by: Mend Renovate <bot@renovateapp.com>
Racer159
pushed a commit
to defenseunicorns/zarf
that referenced
this pull request
Dec 19, 2023
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [sigstore/cosign-installer](https://togithub.com/sigstore/cosign-installer) | action | major | `v2.8.1` -> `v3.3.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v3.3.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.3.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.2.0...v3.3.0) #### What's Changed - Bump actions/setup-go from 4.1.0 to 5.0.0 by [@​dependabot](https://togithub.com/dependabot) in [sigstore/cosign-installer#152 - update action to use latest cosign v2.2.2 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#153 **Full Changelog**: sigstore/cosign-installer@v3.2.0...v3.3.0 ### [`v3.2.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.2.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.2...v3.2.0) **Note: This release comes with a fix for CVE-2023-46737 described in this [Github Security Advisory](https://togithub.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9). Please upgrade to this release ASAP** see https://github.com/sigstore/cosign/releases/tag/v2.2.1 #### What's Changed - Support the runner context of gitea act by [@​josedev-union](https://togithub.com/josedev-union) in [sigstore/cosign-installer#147 - bump cosign to v2.2.1 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#148 - test with latest go version by [@​bobcallaway](https://togithub.com/bobcallaway) in [sigstore/cosign-installer#150 #### New Contributors - [@​josedev-union](https://togithub.com/josedev-union) made their first contribution in [sigstore/cosign-installer#147 **Full Changelog**: sigstore/cosign-installer@v3...v3.2.0 ### [`v3.1.2`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.2) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.1...v3.1.2) #### What's Changed - Fix build and push step Readme missing id by [@​hbenali](https://togithub.com/hbenali) in [sigstore/cosign-installer#138 - bump cosign to v2.2.0 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#142 #### New Contributors - [@​hbenali](https://togithub.com/hbenali) made their first contribution in [sigstore/cosign-installer#138 **Full Changelog**: sigstore/cosign-installer@v3...v3.1.2 ### [`v3.1.1`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.1) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.0...v3.1.1) #### What's Changed - default cosign to v2.1.1 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#137 **Full Changelog**: sigstore/cosign-installer@v3.1.0...v3.1.1 ### [`v3.1.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.5...v3.1.0) #### What's Changed - update job to use latest action release by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#130 - Update action example for keyless signing as xarg is not required by [@​jbtrystram](https://togithub.com/jbtrystram) in [sigstore/cosign-installer#132 - update examples by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#133 - bump cosign to default to release v2.1.0 and update docs by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#136 #### New Contributors - [@​jbtrystram](https://togithub.com/jbtrystram) made their first contribution in [sigstore/cosign-installer#132 **Full Changelog**: sigstore/cosign-installer@v3.0.5...v3.1.0 ### [`v3.0.5`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.5) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.4...v3.0.5) #### What's Changed - download cosign releases from GitHub rather than GCS by [@​bobcallaway](https://togithub.com/bobcallaway) in [sigstore/cosign-installer#126 **Full Changelog**: sigstore/cosign-installer@v3.0.4...v3.0.5 ### [`v3.0.4`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.4) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.3...v3.0.4) - Include fix for [sigstore/cosign-installer#124 - changes download URL for `cosign` binary to github.com instead of GCS ### [`v3.0.3`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.3) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.2...v3.0.3) ##### What's Changed - bump to cosign v2.0.2 by [@​bobcallaway](https://togithub.com/bobcallaway) in [sigstore/cosign-installer#119 - changes download URL for `cosign` binary to github.com instead of GCS **Full Changelog**: sigstore/cosign-installer@v3.0.2...v3.0.3 ### [`v3.0.2`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.2) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.1...v3.0.2) ##### What's Changed - add --yes to example workflow by [@​sebhoss](https://togithub.com/sebhoss) in [sigstore/cosign-installer#110 - Fix aarch64 action run by [@​ananos](https://togithub.com/ananos) in [sigstore/cosign-installer#113 - Bump actions/checkout from 3.3.0 to 3.4.0 by [@​dependabot](https://togithub.com/dependabot) in [sigstore/cosign-installer#115 - Bump actions/setup-go from 3.5.0 to 4.0.0 by [@​dependabot](https://togithub.com/dependabot) in [sigstore/cosign-installer#114 - Bump actions/checkout from 3.4.0 to 3.5.0 by [@​dependabot](https://togithub.com/dependabot) in [sigstore/cosign-installer#116 - default cosign to v2.0.1 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#117 - changes download URL for `cosign` binary to github.com instead of GCS ##### New Contributors - [@​sebhoss](https://togithub.com/sebhoss) made their first contribution in [sigstore/cosign-installer#110 - [@​ananos](https://togithub.com/ananos) made their first contribution in [sigstore/cosign-installer#113 **Full Changelog**: sigstore/cosign-installer@v3...v3.0.2 ### [`v3.0.1`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.1) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.0.0...v3.0.1) ##### What's Changed - make cosign v2.0.0 default version by [@​developer-guy](https://togithub.com/developer-guy) in [sigstore/cosign-installer#109 - changes download URL for `cosign` binary to github.com instead of GCS **Full Changelog**: sigstore/cosign-installer@v3.0.0...v3.0.1 ### [`v3.0.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.0.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v2.8.1...v3.0.0) ##### Breaking change Cosign v2 has some breaking changes. Please check those: https://blog.sigstore.dev/cosign-2-0-released/ ##### What's Changed - test: add logs when downloading the public keys by [@​hectorj2f](https://togithub.com/hectorj2f) in [sigstore/cosign-installer#106 - Add support to install v2 and any other cosign release candidate by [@​hectorj2f](https://togithub.com/hectorj2f) in [sigstore/cosign-installer#105 - v2.0.0 release by [@​sabre1041](https://togithub.com/sabre1041) in [sigstore/cosign-installer#108 - changes download URL for `cosign` binary to github.com instead of GCS ##### New Contributors - [@​hectorj2f](https://togithub.com/hectorj2f) made their first contribution in [sigstore/cosign-installer#106 - [@​sabre1041](https://togithub.com/sabre1041) made their first contribution in [sigstore/cosign-installer#108 **Full Changelog**: sigstore/cosign-installer@v2...v3.0.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/defenseunicorns/zarf). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xNTMuMiIsInVwZGF0ZWRJblZlciI6IjM3Ljg3LjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
JoelDewey
pushed a commit
to JoelDewey/rhel-wireguard
that referenced
this pull request
Jan 23, 2024
](https://renovatebot.com){kind=link}
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | action | minor | `v3.1.1` -> `v3.3.0` | --- ### Release Notes <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v3.3.0`](https://github.com/sigstore/cosign-installer/releases/tag/v3.3.0) [Compare Source](sigstore/cosign-installer@v3.2.0...v3.3.0) #### What's Changed - Bump actions/setup-go from 4.1.0 to 5.0.0 by [@​dependabot](https://github.com/dependabot) in sigstore/cosign-installer#152 - update action to use latest cosign v2.2.2 by [@​cpanato](https://github.com/cpanato) in sigstore/cosign-installer#153 **Full Changelog**: sigstore/cosign-installer@v3.2.0...v3.3.0 ### [`v3.2.0`](https://github.com/sigstore/cosign-installer/releases/tag/v3.2.0) [Compare Source](sigstore/cosign-installer@v3.1.2...v3.2.0) **Note: This release comes with a fix for CVE-2023-46737 described in this [Github Security Advisory](GHSA-vfp6-jrw2-99g9). Please upgrade to this release ASAP** see https://github.com/sigstore/cosign/releases/tag/v2.2.1 #### What's Changed - Support the runner context of gitea act by [@​josedev-union](https://github.com/josedev-union) in sigstore/cosign-installer#147 - bump cosign to v2.2.1 by [@​cpanato](https://github.com/cpanato) in sigstore/cosign-installer#148 - test with latest go version by [@​bobcallaway](https://github.com/bobcallaway) in sigstore/cosign-installer#150 #### New Contributors - [@​josedev-union](https://github.com/josedev-union) made their first contribution in sigstore/cosign-installer#147 **Full Changelog**: sigstore/cosign-installer@v3...v3.2.0 ### [`v3.1.2`](https://github.com/sigstore/cosign-installer/releases/tag/v3.1.2) [Compare Source](sigstore/cosign-installer@v3.1.1...v3.1.2) #### What's Changed - Fix build and push step Readme missing id by [@​hbenali](https://github.com/hbenali) in sigstore/cosign-installer#138 - bump cosign to v2.2.0 by [@​cpanato](https://github.com/cpanato) in sigstore/cosign-installer#142 #### New Contributors - [@​hbenali](https://github.com/hbenali) made their first contribution in sigstore/cosign-installer#138 **Full Changelog**: sigstore/cosign-installer@v3...v3.1.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNDEuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE0MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Reviewed-on: https://gitea.int.magicalinternetbox.net/joel/rhel-wireguard/pulls/9 Co-authored-by: Renovate Bot <renovatebot-gitea@talktojoel.me> Co-committed-by: Renovate Bot <renovatebot-gitea@talktojoel.me>
charithe
pushed a commit
to cerbos/cerbos
that referenced
this pull request
Feb 5, 2024
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [bufbuild/buf-setup-action](https://togithub.com/bufbuild/buf-setup-action) | action | minor | `v1.28.1` -> `v1.29.0` | | [google-github-actions/setup-gcloud](https://togithub.com/google-github-actions/setup-gcloud) | action | minor | `v2.0.1` -> `v2.1.0` | | [sigstore/cosign-installer](https://togithub.com/sigstore/cosign-installer) | action | minor | `v3.1.1` -> `v3.4.0` | --- ### Release Notes <details> <summary>bufbuild/buf-setup-action (bufbuild/buf-setup-action)</summary> ### [`v1.29.0`](https://togithub.com/bufbuild/buf-setup-action/releases/tag/v1.29.0) [Compare Source](https://togithub.com/bufbuild/buf-setup-action/compare/v1.28.1...v1.29.0) Release v1.29.0 </details> <details> <summary>google-github-actions/setup-gcloud (google-github-actions/setup-gcloud)</summary> ### [`v2.1.0`](https://togithub.com/google-github-actions/setup-gcloud/releases/tag/v2.1.0) [Compare Source](https://togithub.com/google-github-actions/setup-gcloud/compare/v2.0.1...v2.1.0) ##### What's Changed - Update deps by [@​sethvargo](https://togithub.com/sethvargo) in [google-github-actions/setup-gcloud#677 - Release: v2.1.0 by [@​google-github-actions-bot](https://togithub.com/google-github-actions-bot) in [google-github-actions/setup-gcloud#678 **Full Changelog**: google-github-actions/setup-gcloud@v2...v2.1.0 </details> <details> <summary>sigstore/cosign-installer (sigstore/cosign-installer)</summary> ### [`v3.4.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.4.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.3.0...v3.4.0) #### What's Changed - Use examples that work with multiple tags by [@​jkreileder](https://togithub.com/jkreileder) in [sigstore/cosign-installer#155 - default cosign install to release v2.2.3 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#156 #### New Contributors - [@​jkreileder](https://togithub.com/jkreileder) made their first contribution in [sigstore/cosign-installer#155 **Full Changelog**: sigstore/cosign-installer@v3...v3.4.0 ### [`v3.3.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.3.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.2.0...v3.3.0) #### What's Changed - Bump actions/setup-go from 4.1.0 to 5.0.0 by [@​dependabot](https://togithub.com/dependabot) in [sigstore/cosign-installer#152 - update action to use latest cosign v2.2.2 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#153 **Full Changelog**: sigstore/cosign-installer@v3.2.0...v3.3.0 ### [`v3.2.0`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.2.0) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.2...v3.2.0) **Note: This release comes with a fix for CVE-2023-46737 described in this [Github Security Advisory](https://togithub.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9). Please upgrade to this release ASAP** see https://github.com/sigstore/cosign/releases/tag/v2.2.1 #### What's Changed - Support the runner context of gitea act by [@​josedev-union](https://togithub.com/josedev-union) in [sigstore/cosign-installer#147 - bump cosign to v2.2.1 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#148 - test with latest go version by [@​bobcallaway](https://togithub.com/bobcallaway) in [sigstore/cosign-installer#150 #### New Contributors - [@​josedev-union](https://togithub.com/josedev-union) made their first contribution in [sigstore/cosign-installer#147 **Full Changelog**: sigstore/cosign-installer@v3...v3.2.0 ### [`v3.1.2`](https://togithub.com/sigstore/cosign-installer/releases/tag/v3.1.2) [Compare Source](https://togithub.com/sigstore/cosign-installer/compare/v3.1.1...v3.1.2) #### What's Changed - Fix build and push step Readme missing id by [@​hbenali](https://togithub.com/hbenali) in [sigstore/cosign-installer#138 - bump cosign to v2.2.0 by [@​cpanato](https://togithub.com/cpanato) in [sigstore/cosign-installer#142 #### New Contributors - [@​hbenali](https://togithub.com/hbenali) made their first contribution in [sigstore/cosign-installer#138 **Full Changelog**: sigstore/cosign-installer@v3...v3.1.2 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/cerbos/cerbos). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xNzAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjE3MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.