Skip to content

chore(deps): update github actions - #47

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

chore(deps): update github actions#47
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
Swatinem/rust-cache (changelog) action digest e18b497 → 6323deb
actions/attest action patch v4.2.1 → v4.2.2
actions/download-artifact (changelog) action digest 3e5f45b → 9000827
actions/setup-node (changelog) action digest 8207627 → 949feb2
actions/upload-artifact (changelog) action digest 043fb46 → cf430e0
actions/upload-artifact action patch v7.0.1 → v7.0.2
anchore/sbom-action action patch v0.24.0 → v0.24.3
docker/build-push-action (changelog) action digest 53b7df9 → c3c9e26
docker/setup-buildx-action (changelog) action digest bb05f3f → f87e599
docker/setup-qemu-action (changelog) action digest 96fe6ef → 9901266
dtolnay/rust-toolchain (changelog) action digest e97e2d8 → e2a55d2
github/codeql-action action minor v4.37.5 → v4.39.0
google/clusterfuzzlite (changelog) action digest 82652fb → 884713a
ossf/scorecard-action action minor v2.4.4 → v2.5.0
sccache uses-with minor v0.17.0 → v0.18.0
taiki-e/install-action (changelog) action digest 67729d5 → 1168f68

Release Notes

actions/attest

v4.2.2

Compare Source

What's Changed

Full Changelog: actions/attest@v4.2.1...v4.2.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed
  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.
New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

anchore/sbom-action

v0.24.3

Compare Source

Added Features
Bug Fixes

(Full Changelog)

v0.24.2

Compare Source

Added Features
Additional Changes

(Full Changelog)

v0.24.1

Compare Source

github/codeql-action

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070
ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

mozilla/sccache (sccache)

v0.18.0

Compare Source

sccache 0.18.0
Summary

sccache 0.18.0 is a broad correctness and coverage release: a lot of compiler flags that used to
force a cache miss are now understood, several cache-key and multi-level storage bugs are fixed,
and the Azure backend gained passwordless authentication.

Highlights:

  • Cache-key correctness: the assembler gcc/clang would actually invoke is now part of the cache
    key, so two toolchains with different binutils can no longer hand each other the wrong object
    file (#​2843). SCCACHE_BASEDIRS now also strips base directories from the compiler arguments,
    so flags like -ffile-prefix-map=/home/user/project=. stop tying an entry to one checkout
    (#​2840).
  • MSVC/clang flag coverage: support for /openmp:llvm, the /fsanitize*, /fsanitize-coverage*
    and /fno-sanitize* families, /feature, arm64EC and fastfail, /d20bforceinline, and a large
    batch of other flags (#​2807, #​2830, #​2831, #​2832), plus more clang CLI options (#​2834). gcc now
    marks flags as TooHard when they would require caching something else (#​2833).
  • CUDA: nvcc dryrun parsing works with CUDA 13.3 (#​2722), escaped quotes in Windows dryrun
    lines are protected before backslash flattening (#​2811), and the
    --diag-error/--diag-suppress/--diag-warn family is accepted (#​2816).
  • Multi-level cache: a chain with any writable level is writable again — a single read-only
    level no longer makes the whole storage read-only (#​2778) — and reads are no longer issued twice
    (#​2835).
  • Azure: Microsoft Entra ID (passwordless) authentication for the Azure Blob backend, for
    storage accounts that disable shared-key access (#​2802).
  • Distributed compilation: rlibs are no longer trimmed from crates that also emit a cdylib,
    which made those jobs fail on the build server (#​2839).
  • Process handling: the jobserver is no longer handed to children that can't use it, which
    restores the posix_spawn fast path for child spawns (#​2827), and daemonization now uses an
    allow-list for inherited file descriptors, fixing make deadlocks caused by leaked jobserver FDs
    (#​2841).
  • MSRV is now 1.91.0 (#​2793).

Welcome to 11 new contributors!

Features
Compiler support
Fixes
Dependencies
Tests & CI
Cleanup
New Contributors

Full Changelog: mozilla/sccache@v0.17.0...v0.18.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/github-actions branch 8 times, most recently from 6d2590f to 82a3df7 Compare September 7, 2026 21:53
@renovate
renovate Bot force-pushed the renovate/github-actions branch 8 times, most recently from 1957847 to 2f0b439 Compare September 16, 2026 01:46
@renovate
renovate Bot force-pushed the renovate/github-actions branch 10 times, most recently from 1823ded to fd861a5 Compare September 23, 2026 08:54
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 5f2be74 to 78e4a5f Compare September 30, 2026 19:03
@renovate
renovate Bot force-pushed the renovate/github-actions branch 11 times, most recently from 39c6761 to f7d6895 Compare October 8, 2026 13:50
@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from afe1e2f to d1226f1 Compare October 13, 2026 12:17
@renovate
renovate Bot force-pushed the renovate/github-actions branch from d1226f1 to baf602d Compare October 15, 2026 12:31

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants