build(deps): Bump the ci group with 4 updates by dependabot[bot] · Pull Request #1555 · getsops/sops

dependabot · 2024-07-08T09:35:23Z

Bumps the ci group with 4 updates: actions/upload-artifact, actions/download-artifact, docker/setup-qemu-action and docker/setup-buildx-action.

Updates actions/upload-artifact from 4.3.3 to 4.3.4

Release notes

Sourced from actions/upload-artifact's releases.

v4.3.4

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in actions/upload-artifact#584

Full Changelog: actions/upload-artifact@v4.3.3...v4.3.4

Commits

0b2256b Merge pull request #584 from actions/robherley/bump-pkgs
488dcef licensed cache
04c51f5 ncc
32a9e27 bump @actions/artifact and npm audit
552bf37 new version
79616d2 Merge pull request #565 from actions/eggyhead/use-artifact-v2.1.6
See full diff in compare view

Updates actions/download-artifact from 4.1.7 to 4.1.8

Release notes

Sourced from actions/download-artifact's releases.

v4.1.8

What's Changed

Update @actions/artifact version, bump dependencies by @robherley in actions/download-artifact#341

Full Changelog: actions/download-artifact@v4...v4.1.8

Commits

fa0a91b Merge pull request #341 from actions/robherley/bump-pkgs
b54d088 Update @actions/artifact version, bump dependencies
See full diff in compare view

Updates docker/setup-qemu-action from 3.0.0 to 3.1.0

Release notes

Sourced from docker/setup-qemu-action's releases.

v3.1.0

Set docker.io domain for default binfmt image by @crazy-max in docker/setup-qemu-action#151

Throw error message instead of exit code by @crazy-max in docker/setup-qemu-action#129

build(deps): bump @docker/actions-toolkit from 0.12.0 to 0.31.0 in docker/setup-qemu-action#115 docker/setup-qemu-action#128 docker/setup-qemu-action#131 docker/setup-qemu-action#134 docker/setup-qemu-action#149

build(deps): bump @babel/traverse from 7.20.13 to 7.23.2 in docker/setup-qemu-action#109

build(deps): bump braces from 3.0.2 to 3.0.3 in docker/setup-qemu-action#142

build(deps): bump undici from 5.28.2 to 5.28.4 in docker/setup-qemu-action#118 docker/setup-qemu-action#127

Full Changelog: docker/setup-qemu-action@v3.0.0...v3.1.0

Commits

5927c83 Merge pull request #149 from docker/dependabot/npm_and_yarn/docker/actions-to...
32ea29b chore: update generated content
92ac892 build(deps): bump @docker/actions-toolkit from 0.23.0 to 0.31.0
dcf3f67 Merge pull request #151 from crazy-max/default-image
b34393b Merge pull request #141 from docker/dependabot/github_actions/docker/bake-act...
ca1bf68 Merge pull request #142 from docker/dependabot/npm_and_yarn/braces-3.0.3
599f288 chore: update generated content
af38981 set docker.io domain for default binfmt image
9d4d56c build(deps): bump braces from 3.0.2 to 3.0.3
a05dd92 build(deps): bump docker/bake-action from 4 to 5
Additional commits viewable in compare view

Updates docker/setup-buildx-action from 3.3.0 to 3.4.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v3.4.0

Throw error message instead of exit code by @crazy-max in docker/setup-buildx-action#315

Bump @docker/actions-toolkit from 0.20.0 to 0.31.0 in docker/setup-buildx-action#321 docker/setup-buildx-action#338

Bump braces from 3.0.2 to 3.0.3 in docker/setup-buildx-action#329

Bump undici from 5.28.3 to 5.28.4 in docker/setup-buildx-action#312

Bump uuid from 9.0.1 to 10.0.0 in docker/setup-buildx-action#326

Full Changelog: docker/setup-buildx-action@v3.3.0...v3.4.0

Commits

4fd8129 Merge pull request #312 from docker/dependabot/npm_and_yarn/undici-5.28.4
3386dc4 chore: update generated content
d191aef build(deps): bump undici from 5.28.3 to 5.28.4
f686054 Merge pull request #338 from docker/dependabot/npm_and_yarn/docker/actions-to...
7854785 chore: update generated content
830928c fix builder type path
26d2aec build(deps): bump @docker/actions-toolkit from 0.23.0 to 0.31.0
ab17e3e Merge pull request #339 from crazy-max/missing-types-jsyaml
d79cb80 missing types for js-yaml
13cf788 Merge pull request #326 from docker/dependabot/npm_and_yarn/uuid-10.0.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ci group with 4 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact), [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) and [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `actions/upload-artifact` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@6546280...0b2256b) Updates `actions/download-artifact` from 4.1.7 to 4.1.8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@65a9edc...fa0a91b) Updates `docker/setup-qemu-action` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@6882732...5927c83) Updates `docker/setup-buildx-action` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@d70bba7...4fd8129) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: actions/download-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: docker/setup-qemu-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [getsops/sops](https://github.com/getsops/sops) | patch | `v3.9.0` -> `v3.9.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>getsops/sops (getsops/sops)</summary> ### [`v3.9.1`](https://github.com/getsops/sops/releases/tag/v3.9.1) [Compare Source](getsops/sops@v3.9.0...v3.9.1) #### Installation To install `sops`, download one of the pre-built binaries provided for your platform from the artifacts attached to this release. For instance, if you are using Linux on an AMD64 architecture: ```shell ### Download the binary curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.linux.amd64 ### Move the binary in to your PATH mv sops-v3.9.1.linux.amd64 /usr/local/bin/sops ### Make the binary executable chmod +x /usr/local/bin/sops ``` ##### Verify checksums file signature The checksums file provided within the artifacts attached to this release is signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of this file, run the following commands: ```shell ### Download the checksums file, certificate and signature curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.txt curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.pem curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.checksums.sig ### Verify the checksums file cosign verify-blob sops-v3.9.1.checksums.txt \ --certificate sops-v3.9.1.checksums.pem \ --signature sops-v3.9.1.checksums.sig \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com ``` ##### Verify binary integrity To verify the integrity of the downloaded binary, you can utilize the checksums file after having validated its signature: ```shell ### Verify the binary using the checksums file sha256sum -c sops-v3.9.1.checksums.txt --ignore-missing ``` ##### Verify artifact provenance The [SLSA provenance](https://slsa.dev/provenance/v0.2) of the binaries, packages, and SBOMs can be found within the artifacts associated with this release. It is presented through an [in-toto](https://in-toto.io/) link metadata file named `sops-v3.9.1.intoto.jsonl`. To verify the provenance of an artifact, you can utilize the [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier#artifacts) tool: ```shell ### Download the metadata file curl -LO https://github.com/getsops/sops/releases/download/v3.9.1/sops-v3.9.1.intoto.jsonl ### Verify the provenance of the artifact slsa-verifier verify-artifact <artifact> \ --provenance-path sops-v3.9.1.intoto.jsonl \ --source-uri github.com/getsops/sops \ --source-tag v3.9.1 ``` #### Container Images The `sops` binaries are also available as container images, based on Debian (slim) and Alpine Linux. The Debian-based container images include any dependencies which may be required to make use of certain key services, such as GnuPG, AWS KMS, Azure Key Vault, and Google Cloud KMS. The Alpine-based container images are smaller in size, but do not include these dependencies. These container images are available for the following architectures: `linux/amd64` and `linux/arm64`. ##### GitHub Container Registry - `ghcr.io/getsops/sops:v3.9.1` - `ghcr.io/getsops/sops:v3.9.1-alpine` ##### Quay.io - `quay.io/getsops/sops:v3.9.1` - `quay.io/getsops/sops:v3.9.1-alpine` ##### Verify container image signature The container images are signed using [Cosign](https://docs.sigstore.dev/cosign/overview/) with GitHub OIDC. To validate the signature of an image, run the following command: ```shell cosign verify ghcr.io/getsops/sops:v3.9.1 \ --certificate-identity-regexp=https://github.com/getsops \ --certificate-oidc-issuer=https://token.actions.githubusercontent.com \ -o text ``` ##### Verify container image provenance The container images include [SLSA provenance](https://slsa.dev/provenance/v0.2) attestations. For more information around the verification of this, please refer to the [`slsa-verifier` documentation](https://github.com/slsa-framework/slsa-verifier#containers). #### Software Bill of Materials The Software Bill of Materials (SBOM) for each binary is accessible within the artifacts enclosed with this release. It is presented as an [SPDX](https://spdx.dev/) JSON file, formatted as `<binary>.spdx.sbom.json`. #### What's Changed - Explicitly mark goreleaser's version, to avoid confusion with the Go version by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1548 - build(deps): Bump the go group with 8 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1550 - build(deps): Bump github/codeql-action from 3.25.10 to 3.25.11 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1551 - Fix the URL used for determining the latest SOPS version by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1553 - build(deps): Bump the ci group with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1555 - build(deps): Bump the go group with 11 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1554 - build(deps): Bump the go group with 10 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1558 - build(deps): Bump the ci group with 3 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1559 - build(deps): Bump the go group with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1562 - build(deps): Bump the ci group across 1 directory with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1564 - build(deps): Bump the go group with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1565 - build(deps): Bump github/codeql-action from 3.25.13 to 3.25.15 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1566 - build(deps): Bump github.com/docker/docker from 27.0.1+incompatible to 27.1.0+incompatible by [@dependabot](https://github.com/dependabot) in getsops/sops#1568 - build(deps): Bump the go group with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1575 - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1574 - build(deps): Bump github.com/docker/docker from 27.1.0+incompatible to 27.1.1+incompatible by [@dependabot](https://github.com/dependabot) in getsops/sops#1581 - build(deps): Bump the ci group with 3 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1584 - Note on the name of the configuration file by [@ErraticMaker](https://github.com/ErraticMaker) in getsops/sops#1569 - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1586 - build(deps): Bump the go group across 1 directory with 15 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1589 - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1590 - build(deps): Bump the go group with 7 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1593 - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1592 - tests: ignore env var SOPS_AGE_KEY_FILE by [@duthils](https://github.com/duthils) in getsops/sops#1595 - build(deps): Bump the go group with 12 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1602 - build(deps): Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 by [@dependabot](https://github.com/dependabot) in getsops/sops#1603 - updatekeys subcommand: actually use option `--shamir-secret-sharing-threshold` by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1608 - Added example of having age recipients in .sops.yaml by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1607 - GitHub Actions linter for Rust formatting by [@duthils](https://github.com/duthils) in getsops/sops#1604 - github actions: set rust version globally by [@duthils](https://github.com/duthils) in getsops/sops#1612 - Fix `--config` being ignored by `loadConfig` by [@lopter](https://github.com/lopter) in getsops/sops#1613 - build(deps): Bump the go group with 4 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1618 - build(deps): Bump github/codeql-action from 3.26.6 to 3.26.7 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1619 - unit tests: add coverage for unset by [@duthils](https://github.com/duthils) in getsops/sops#1617 - sops_test: homogenize use of asserts by [@duthils](https://github.com/duthils) in getsops/sops#1622 - sops_test: add more tests on errors by [@duthils](https://github.com/duthils) in getsops/sops#1624 - Add 'check' task to CI that makes sure everything is green by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1621 - build(deps): Bump the go group with 10 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1629 - build(deps): Bump github/codeql-action from 3.26.7 to 3.26.8 in the ci group by [@dependabot](https://github.com/dependabot) in getsops/sops#1628 - refactor: specify missing file in error message by [@t3hmrman](https://github.com/t3hmrman) in getsops/sops#1625 - CI: Build with Go 1.22 and 1.23; update Vault to 1.14 by [@reneleonhardt](https://github.com/reneleonhardt) in getsops/sops#1531 - Allow edit subcommand to create files by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1596 - Build release with Go 1.22.x by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1615 - GHA: fix checkout action version by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1630 - Do not encrypt if a key group is empty, or there are no key groups by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1600 - updatekeys subcommand: show changes in shamir_threshold by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1609 - Dependabot: fix config for Docker, add config for Rust/Cargo by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1632 - build(deps): Bump the ci group with 2 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1634 - build(deps): Bump the go group with 7 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1635 - Add Cargo.lock for better reproducability of functional tests by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1637 - build(deps): Bump the go group with 7 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1639 - build(deps): Bump the rust group in /functional-tests with 5 updates by [@dependabot](https://github.com/dependabot) in getsops/sops#1638 - Update all go deps with 'go get -t -u ./...' by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1640 - Do not ignore errors when trying to parse a config file by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1614 - Release 3.9.1 by [@felixfontein](https://github.com/felixfontein) in getsops/sops#1642 #### New Contributors - [@ErraticMaker](https://github.com/ErraticMaker) made their first contribution in getsops/sops#1569 - [@lopter](https://github.com/lopter) made their first contribution in getsops/sops#1613 - [@t3hmrman](https://github.com/t3hmrman) made their first contribution in getsops/sops#1625 - [@reneleonhardt](https://github.com/reneleonhardt) made their first contribution in getsops/sops#1531 **Full Changelog**: getsops/sops@v3.9.0...v3.9.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

dependabot bot added area/CI dependencies Pull requests that update a dependency file labels Jul 8, 2024

felixfontein approved these changes Jul 8, 2024

View reviewed changes

felixfontein merged commit 7ec09e5 into main Jul 8, 2024

felixfontein deleted the dependabot/github_actions/ci-c4ae240025 branch July 8, 2024 14:01

BrewTestBot mentioned this pull request Oct 4, 2024

sops 3.9.1 Homebrew/homebrew-core#192798

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): Bump the ci group with 4 updates#1555

build(deps): Bump the ci group with 4 updates#1555
felixfontein merged 1 commit intomainfrom
dependabot/github_actions/ci-c4ae240025

dependabot bot commented on behalf of github Jul 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Jul 8, 2024

v4.3.4

What's Changed

v4.1.8

What's Changed

v3.1.0

v3.4.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant