chore(deps): update github-actions

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	minor	v3.5.3 -> v3.6.0
actions/dependency-review-action	action	minor	v3.0.7 -> v3.1.0
actions/setup-node	action	patch	v3.8.0 -> v3.8.1
actions/upload-artifact	action	patch	v3.1.2 -> v3.1.3
github/codeql-action	action	minor	v2.21.4 -> v2.22.1
ossf/scorecard-action	action	minor	v2.2.0 -> v2.3.0
slsa-framework/slsa-github-generator	action	minor	v1.8.0 -> v1.9.0
slsa-framework/slsa-verifier	action	minor	v2.3.0 -> v2.4.0

---

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

---

Release Notes

actions/checkout (actions/checkout)

v3.6.0

Compare Source

• Fix: Mark test scripts with Bash'isms to be run via Bash
• Add option to fetch tags even if fetch-depth > 0

actions/dependency-review-action (actions/dependency-review-action)

v3.1.0: 3.1.0

Compare Source

What's New

Added support for dependencies submitted through the dependency submission API. This includes two new configuration parameters: retry-on-snapshot-warnings and retry-on-snapshot-warnings-timeout.

What's Changed

• Fix(docs): Correct action input name by @​oerd in https://github.com/actions/dependency-review-action/pull/551

New Contributors

• @​oerd made their first contribution in https://github.com/actions/dependency-review-action/pull/551

Full Changelog: actions/dependency-review-action@v3...v3.1.0

v3.0.8: 3.0.8

Compare Source

What's Changed

Added on-failure option to comment-summary-in-pr setting by @​sgmurphy in https://github.com/actions/dependency-review-action/pull/540

Previous configuration files using true/false for comment-summary-in-pr will be mapped automatically to the new values, but we encourage you to update to always/on-failure/never.

New Contributors

• @​sgmurphy made their first contribution in https://github.com/actions/dependency-review-action/pull/540

Full Changelog: actions/dependency-review-action@v3...v3.0.8

actions/setup-node (actions/setup-node)

v3.8.1

Compare Source

What's Changed

In scope of this release, the filter was removed within the cache-save step by @​dmitry-shibanov in https://github.com/actions/setup-node/pull/831. It is filtered and checked in the toolkit/cache library.

Full Changelog: actions/setup-node@v3...v3.8.1

actions/upload-artifact (actions/upload-artifact)

v3.1.3

Compare Source

What's Changed

• chore(github): remove trailing whitespaces by @​ljmf00 in https://github.com/actions/upload-artifact/pull/313
• Bump @​actions/artifact version to v1.1.2 by @​bethanyj28 in https://github.com/actions/upload-artifact/pull/436

Full Changelog: actions/upload-artifact@v3...v3.1.3

github/codeql-action (github/codeql-action)

v2.22.1

Compare Source

v2.22.0

Compare Source

v2.21.9

Compare Source

v2.21.8

Compare Source

v2.21.7

Compare Source

v2.21.6

Compare Source

v2.21.5

Compare Source

ossf/scorecard-action (ossf/scorecard-action)

v2.3.0

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1270
  • For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
• ✨ Send rekor tlog index to webapp when publishing results by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1169
• 🐛 Prevent url clipping for GHES instances by @​rajbos in https://github.com/ossf/scorecard-action/pull/1225

Documentation

• 📖 Update access rights needed to see the results in code scanning by @​rajbos in https://github.com/ossf/scorecard-action/pull/1229
• 📖 Add package comments. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1221
• 📖 Add SECURITY.md file by @​david-a-wheeler in https://github.com/ossf/scorecard-action/pull/1250
• 📖 Fix typo in token input docs by @​aabouzaid in https://github.com/ossf/scorecard-action/pull/1258

New Contributors

• @​david-a-wheeler made their first contribution in https://github.com/ossf/scorecard-action/pull/1250
• @​aabouzaid made their first contribution in https://github.com/ossf/scorecard-action/pull/1258

Full Changelog: ossf/scorecard-action@v2.2.0...v2.3.0

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

v1.9.0

Compare Source

Release [v1.9.0] includes bug fixes and new features.

See the full change list.

v1.9.0: BYOB framework (beta)

• New: A new framework to turn GitHub Actions into SLSA compliant builders.

v1.9.0: Maven builder (beta)

• New: A Maven builder to build Java projects and publish to Maven central.

v1.9.0: Gradle builder (beta)

• New: A Gradle builder to build Java projects and publish to Maven central.

v1.9.0: JReleaser builder

• New: A JReleaser builder that wraps the official JReleaser Action.

slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)

v2.4.0

Compare Source

Summary

Support for BYOB-based builders released in https://github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.0

What's Changed

• chore: Update SHA256SUM.md for v2.3.0 by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/592
• docs: Make npm package version and name non-optional by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/591
• docs: npm provenance verification from GitHub runner by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/595
• chore(deps): update dependency @​types/node to v18.16.9 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/596
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/597
• chore(deps): update dependency jasmine to v5 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/598
• feat: BYOB verification support by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/604
• feat: Support for v1.0 verification in BYOB by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/609
• feat: Use env variable to retrieve trigger workflow by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/615
• test: Add test data for v1.6.0 by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/612
• fix: Verify the TRW tag is a semver tag by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/619
• chore: Don't be verbose with tests locally by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/620
• fix: use ExternalParameters["source"] for the Source URI for SLSA v1.0 provenance by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/621
• test: re-generate container-based tests by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/627
• fix: revert to using resolvedDepdendencies for source verification by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/629
• refactor: Provenance tests by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/628
• fix(deps): update module github.com/sigstore/rekor to v1.2.0 [security] by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/622
• fix: only allow hashes of 256 bits or more by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/633
• fix: builder ID verification for testing by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/635
• feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/634
• chore: update toc in README.md by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/636
• fix: allow workflow_dispatch to trigger release.yml by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/637
• test: add tests for v1.7.0 builders by @​asraa in https://github.com/slsa-framework/slsa-verifier/pull/638
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/607
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to c623859 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/567
• fix(deps): update github.com/sigstore/protobuf-specs digest to 5ef5406 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/606
• chore(deps): update npm dev by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/608
• chore(deps): update golang:1.19 docker digest to 83f9f84 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/583
• feat: Verify provenance by build type by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/632
• refactor: Use Go 1.20 by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/643
• test: Add more ProvenanceFromEnvelope tests by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/640
• fix: pre-submit: e2e-cli.sh artifact download by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/646
• refactor: Add more git utils by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/645
• refactor: Use full builder id by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/648
• feat: Use tags vX.Y.Z-<language> for JReleaser builders by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/644
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/651
• feat: move maven-plugin from slsa-github-generator by @​AdamKorcz in https://github.com/slsa-framework/slsa-verifier/pull/664
• docs: Fix maven-plugin README by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/671
• feat: Verification for when sha1 is specified in BYOB TRW by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/641
• docs: Add example for maven verification plugin by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/676
• chore: Add Kris to codeowners by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/678
• feat: Print byob builder by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/677
• test: Add test data for v1.8.0 by @​ianlewis in https://github.com/slsa-framework/slsa-verifier/pull/681
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/666
• feat: Non-compulsory BuilderID for BYOB Builders by @​enteraga6 in https://github.com/slsa-framework/slsa-verifier/pull/674
• chore(deps): update golang docker tag to v1.21 by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/687
• chore(deps): update github-actions by @​renovate-bot in https://github.com/slsa-framework/slsa-verifier/pull/686
• feat: GCB refactor for v1.0 support by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/682
• feat: Allow byob builders ref at main for e2e tests by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/689
• feat: Update doc and code for Maven plugin by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/680
• feat: gcb v1.0 support by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/691
• feat: v1.9.0 regression tests by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/696
• fix: release failure by @​laurentsimon in https://github.com/slsa-framework/slsa-verifier/pull/697

New Contributors

• @​AdamKorcz made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/664
• @​enteraga6 made their first contribution in https://github.com/slsa-framework/slsa-verifier/pull/674

Full Changelog: v2.3.0...v2.4.0

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.