chore(deps): update github-actions #2850

renovate-bot · 2023-10-14T00:55:34Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	digest	`96f5310` -> `b4ffde6`
actions/checkout	action	minor	`v4.0.0` -> `v4.1.1`
actions/setup-go	action	minor	`v4.0.1` -> `v4.1.0`
actions/setup-java	action	minor	`v3.12.0` -> `v3.13.0`
actions/setup-node	action	minor	`v3.7.0` -> `v3.8.1`
actions/setup-node	action	digest	`e33196f` -> `5e21ff4`
actions/upload-artifact	action	patch	`v3.1.2` -> `v3.1.3`
github/codeql-action	action	minor	`v2.21.2` -> `v2.22.4`
gradle/gradle-build-action	action	minor	`v2.7.0` -> `v2.9.0`
ossf/scorecard-action	action	minor	`v2.2.0` -> `v2.3.0`
sigstore/cosign-installer	action	patch	`v3.1.1` -> `v3.1.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout (actions/checkout)

actions/setup-go (actions/setup-go)

`v4.1.0`

Compare Source

What's Changed

In scope of this release, slow installation on Windows was fixed by @dsame in https://github.com/actions/setup-go/pull/393 and OS version was added to primaryKey for Ubuntu runners to avoid conflicts (https://github.com/actions/setup-go/pull/383)

This release also includes the following changes:

Remove implicit dependencies by @nikolai-laevskii in https://github.com/actions/setup-go/pull/378
Update action.yml by @mkelly in https://github.com/actions/setup-go/pull/379
Added a description that go-version should be specified as a string type by @n3xem in https://github.com/actions/setup-go/pull/367
Add note about YAML parsing versions by @dmitry-shibanov in https://github.com/actions/setup-go/pull/382
Automatic update of configuration files from 05/23/2023 by @github-actions in https://github.com/actions/setup-go/pull/377
Bump tough-cookie and @azure/ms-rest-js by @dependabot in https://github.com/actions/setup-go/pull/392
Bump word-wrap from 1.2.3 to 1.2.4 by @dependabot in https://github.com/actions/setup-go/pull/397
Bump semver from 6.3.0 to 6.3.1 by @dependabot in https://github.com/actions/setup-go/pull/396

New Contributors

@mkelly made their first contribution in https://github.com/actions/setup-go/pull/379
@n3xem made their first contribution in https://github.com/actions/setup-go/pull/367

Full Changelog: actions/setup-go@v4...v4.1.0

actions/setup-java (actions/setup-java)

`v3.13.0`

Compare Source

What's changed

In the scope of this release, support for Dragonwell JDK was added by @Accelerator1996 in https://github.com/actions/setup-java/pull/532

steps:
 - name: Checkout
   uses: actions/checkout@v3
 - name: Setup-java
   uses: actions/setup-java@v3
   with:
     distribution: 'dragonwell'
     java-version: '17'

Several inaccuracies were also fixed:

Fix XML namespaces wrongly using https by @gnodet in https://github.com/actions/setup-java/pull/503
Fix typo and remove unintentional(?) word by @CyberFlameGO in https://github.com/actions/setup-java/pull/518
Fix usage link within the README.md file by @dassiorleando in https://github.com/actions/setup-java/pull/525

New Contributors

@CyberFlameGO made their first contribution in https://github.com/actions/setup-java/pull/518
@dassiorleando made their first contribution in https://github.com/actions/setup-java/pull/525
@gnodet made their first contribution in https://github.com/actions/setup-java/pull/503
@Accelerator1996 made their first contribution in https://github.com/actions/setup-java/pull/532

Full Changelog: actions/setup-java@v3...v3.13.0

actions/setup-node (actions/setup-node)

`v3.8.1`

Compare Source

What's Changed

In scope of this release, the filter was removed within the cache-save step by @dmitry-shibanov in https://github.com/actions/setup-node/pull/831. It is filtered and checked in the toolkit/cache library.

Full Changelog: actions/setup-node@v3...v3.8.1

`v3.8.0`

Compare Source

What's Changed

Bug fixes:

Add check for existing paths by @dmitry-shibanov in https://github.com/actions/setup-node/pull/803
Resolve SymbolicLink by @dmitry-shibanov in https://github.com/actions/setup-node/pull/809
Change passing logic for cache input by @dmitry-shibanov in https://github.com/actions/setup-node/pull/816
Fix armv7 cache issue by @louislam in https://github.com/actions/setup-node/pull/794
Update check-dist workflow name by @sinchang in https://github.com/actions/setup-node/pull/710

Feature implementations:

feat: handling the case where "node" is used for tool-versions file. by @xytis in https://github.com/actions/setup-node/pull/812

Documentation changes:

Refer to semver package name in README.md by @olleolleolle in https://github.com/actions/setup-node/pull/808

Update dependencies:

Update toolkit cache to fix zstd by @dmitry-shibanov in https://github.com/actions/setup-node/pull/804
Bump tough-cookie and @azure/ms-rest-js by @dependabot in https://github.com/actions/setup-node/pull/802
Bump semver from 6.1.2 to 6.3.1 by @dependabot in https://github.com/actions/setup-node/pull/807
Bump word-wrap from 1.2.3 to 1.2.4 by @dependabot in https://github.com/actions/setup-node/pull/815

New Contributors

@olleolleolle made their first contribution in https://github.com/actions/setup-node/pull/808
@louislam made their first contribution in https://github.com/actions/setup-node/pull/794
@sinchang made their first contribution in https://github.com/actions/setup-node/pull/710
@xytis made their first contribution in https://github.com/actions/setup-node/pull/812

Full Changelog: actions/setup-node@v3...v3.8.0

actions/upload-artifact (actions/upload-artifact)

`v3.1.3`

Compare Source

What's Changed

chore(github): remove trailing whitespaces by @ljmf00 in https://github.com/actions/upload-artifact/pull/313
Bump @actions/artifact version to v1.1.2 by @bethanyj28 in https://github.com/actions/upload-artifact/pull/436

Full Changelog: actions/upload-artifact@v3...v3.1.3

github/codeql-action (github/codeql-action)

`v2.22.4`

Compare Source

`v2.22.3`

Compare Source

`v2.22.2`

Compare Source

`v2.22.1`

Compare Source

`v2.22.0`

Compare Source

`v2.21.9`

Compare Source

`v2.21.8`

Compare Source

`v2.21.7`

Compare Source

`v2.21.6`

Compare Source

`v2.21.5`

Compare Source

`v2.21.4`

Compare Source

`v2.21.3`

Compare Source

gradle/gradle-build-action (gradle/gradle-build-action)

`v2.9.0`

Compare Source

The GitHub dependency-review-action helps you understand dependency changes (and the security impact of these changes) for a pull request. This release updates the GItHub Dependency Graph support to be compatible with the dependency-review-action.

See the documentation for detailed examples.

Changelog

[FIX] Use correct SHA for pull-request events #882
[FIX] Avoid generating dependency graph during cache cleanup #905
[NEW] Improve warning on failure to submit dependency graph
[NEW] Compatibility with GitHub dependency-review-action #879

Full-changelog: gradle/gradle-build-action@v2.8.1...v2.9.0

`v2.8.1`

Compare Source

Fixes an issue that prevented Dependency Graph submission when running on GitHub Enterprise Server.

Fixes

Incorrect endpoint used to submit Dependency Graph on GitHub Enterprise #885

Changelog

`v2.8.0`

Compare Source

The v2.8.0 release of the gradle-build-action introduces an easy mechanism to connect to Gradle Enterprise, as well improved support for self-hosted GitHub Actions runners.

Automatic injection of Gradle Enterprise connectivity

It is now possible to connect a Gradle build to Gradle Enterprise without changing any of the Gradle project sources. This is achieved through Gradle Enterprise injection, where an init-script will apply the Gradle Enterprise plugin and associated configuration.

This feature can be useful to easily trial Gradle Enterprise on a project, or to centralize Gradle Enterprise configuration for all GitHub Actions workflows in an organization.

See Gradle Enterprise injection in the README for more info.

Restore Gradle User Home when directory already exists

Previously, the Gradle User Home would not be restored if the directory already exists. This wasn't normally an issue with GitHub-hosted runners, but limited the usefulness of the action for persistent, self-hosted runners.

This behaviour has been improved in this release:

The Job Summary now includes a useful error message when Gradle User Home was not restored because the directory already exists.
The action can now be configured to restore the Gradle User Home when the directory already exists, overwriting existing content with content from the GitHub Actions cache. See https://github.com/gradle/gradle-build-action#overwriting-an-existing-gradle-user-home for more details.