From 7ea62eb2ccdc7b711af0fe0309e74d68cd9c208a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 12:00:59 +0000 Subject: [PATCH] ci: bump the actions-minor-patch group across 2 directories with 3 updates Bumps the actions-minor-patch group with 3 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action), [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) and [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action). Bumps the actions-minor-patch group with 1 update in the /.github/actions/docs-toolchain directory: [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `taiki-e/install-action` from 2.87.21 to 2.87.24 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/4cef1412cce204788f482e778a0b9187f9626a29...e407f7bafb71fd004bc5c2da3032e5470cbb6ef0) Updates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) Updates `SonarSource/sonarqube-scan-action` from 8.2.2 to 8.3.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/ba9859eae8dd6bd29e412f25ddbbef3d032000f4...d209202bc7d53ff1cc128f7f907dac145c9d6ae9) Updates `taiki-e/install-action` from 2.87.21 to 2.87.24 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/4cef1412cce204788f482e778a0b9187f9626a29...e407f7bafb71fd004bc5c2da3032e5470cbb6ef0) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: taiki-e/install-action dependency-version: 2.87.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/actions/docs-toolchain/action.yml | 2 +- .github/workflows/ci.yml | 14 +++++++------- .github/workflows/fuzz.yml | 2 +- .github/workflows/release-build.yml | 6 +++--- .github/workflows/release-image.yml | 2 +- .github/workflows/sonar.yml | 4 ++-- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/actions/docs-toolchain/action.yml b/.github/actions/docs-toolchain/action.yml index a3a25bb1..23597eda 100644 --- a/.github/actions/docs-toolchain/action.yml +++ b/.github/actions/docs-toolchain/action.yml @@ -23,6 +23,6 @@ runs: steps: # taiki-e/install-action fetches each tool's upstream release binary and # verifies its checksum, so no `cargo install` compile is needed. - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: mdbook@${{ inputs.mdbook-version }},mdbook-toc@${{ inputs.mdbook-toc-version }},mdbook-mermaid@${{ inputs.mdbook-mermaid-version }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5bcd3ce1..8e194037 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,7 +50,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: zizmor@1.30.1 - name: Audit .github/workflows @@ -128,7 +128,7 @@ jobs: # The upstream RELEASE binary, pinned by version — not the runner's distro # package, which moves under us at every runner-image refresh. Fetched by # the same SHA-pinned installer, which verifies the checksum. - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: shellcheck@0.11.0 - name: Every tracked shell program is clean at severity=style @@ -351,7 +351,7 @@ jobs: with: persist-credentials: false - uses: ./.github/actions/setup-rust - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-nextest - run: cargo nextest run --workspace --locked --no-tests=pass @@ -390,7 +390,7 @@ jobs: with: persist-credentials: false - uses: ./.github/actions/setup-rust - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-deny # Reads the same RustSec advisory DB as cargo-audit and adds @@ -503,7 +503,7 @@ jobs: cache-key: viewer - name: Add the WebAssembly target run: rustup target add wasm32-unknown-unknown - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: trunk@0.21.14, cargo-nextest # leptosfmt is not in install-action's manifest, so install-action would @@ -589,7 +589,7 @@ jobs: # are linked against musl, as release-build.yml links the ones it ships. - name: Install musl tooling run: sudo apt-get update && sudo apt-get install -y musl-tools - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: trunk@0.21.14, cargo-nextest - name: The journeys hold the same formatting and lint bar @@ -764,7 +764,7 @@ jobs: with: persist-credentials: false - uses: ./.github/actions/setup-rust - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-hack # The Cargo book's named tool for verifying the declared rust-version diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index cf843edf..006fcb45 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -53,7 +53,7 @@ jobs: with: toolchain: nightly cache-key: fuzz - - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-fuzz@0.13.2 - name: Run the target over its seeds diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index 8c5ad135..55b04a8b 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -95,7 +95,7 @@ jobs: # architecture costs a few minutes and adds no attestation subject: the # bundle rides inside the binary the existing lane already signs. - name: Install Trunk - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: trunk@0.21.14 - name: Add the WebAssembly target @@ -115,7 +115,7 @@ jobs: # syft/trivy/grype/osv-scanner even when the release page's SBOM never # travelled with it (https://github.com/rust-secure-code/cargo-auditable). - name: Install cargo-auditable - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-auditable@0.7.5 @@ -168,7 +168,7 @@ jobs: # actionable. Generated from the release commit's own Cargo.lock with # `--locked`, so it describes the graph that was actually built. - name: Install cargo-cyclonedx - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-cyclonedx - name: Generate the dependency SBOM diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml index 46f52fc3..5076a19e 100644 --- a/.github/workflows/release-image.yml +++ b/.github/workflows/release-image.yml @@ -182,7 +182,7 @@ jobs: # syft reads the dependency list cargo-auditable embedded in the binary, # so the SBOM names the crates, not only the two files in the image. - name: Install syft - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: Generate one SBOM per platform env: TAG: ${{ inputs.tag }} diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 425d55ea..83d05fd8 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -104,7 +104,7 @@ jobs: cache-save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install cargo-llvm-cov + cargo-nextest if: ${{ hashFiles('Cargo.toml') != '' }} - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21 + uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2.87.24 with: tool: cargo-llvm-cov,cargo-nextest - name: Instrumented tests → lcov @@ -123,7 +123,7 @@ jobs: v="$(grep -m1 '^version = ' Cargo.toml | cut -d'"' -f2)" echo "sonar.projectVersion=$v" >> sonar-project.properties - - uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2 + - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}