Repository navigation
chore(deps): update github actions patch dependencies - #781
Closed
Nikolaichukr wants to merge 1 commit into
Closed
Nikolaichukr wants to merge 1 commit into
Nikolaichukr wants to merge 1 commit into
Conversation
Nikolaichukr
added
auto-merge
critical
dependencies
Contributor
OPA/conftest tenant-isolation gateResult: passed
|
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Contributor
Mutation test critical Lambda boundariesResult: passed
Coverage: 39.67% (1215/3063 lines) Lowest-covered Lambda files
|
Contributor
Offline IaC contract testsResult: passed
Coverage: 95.18% (1481/1556 lines) Lowest-covered Lambda files
|
Contributor
Automation gate testsResult: passed
Coverage: 88.30% (906/1026 lines) Lowest-covered Lambda files
|
Contributor
Lambda unit testsResult: passed
Coverage: 92.76% (4641/5003 lines) Lowest-covered Lambda files
|
Contributor
OpenTofu module tests (latest-stable)Result: passed OpenTofu version:
|
Contributor
OpenTofu module tests (minimum-supported)Result: passed OpenTofu version:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v7.0.1→v7.0.2v3.0.1→v3.0.2v4.4.0→v4.4.1v4.38.2→v4.38.3v1.2.0→v1.2.2Release Notes
actions/upload-artifact
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
aws-actions/aws-secretsmanager-get-secrets
v3.0.2Compare Source
What's Changed
New Contributors
Full Changelog: aws-actions/aws-secretsmanager-get-secrets@v3.0.1...v3.0.2
docker/setup-buildx-action
v4.4.1Compare Source
Full Changelog: docker/setup-buildx-action@v4.4.0...v4.4.1
github/codeql-action
v4.38.3Compare Source
soldevelo/infrascan
v1.2.2: InfraScan v1.2.2Compare Source
InfraScan 1.2.2 Release Notes
This release contains all changes since
v1.2.1.Highlights
fail-onthresholds that only count what a PR adds:new_high_critical,new_critical,new_any. The existing thresholds count every finding in the repository, so in a repo with even one existing HIGH findingfail-on: high_criticalfails every PR, including ones that don't touch infrastructure. Thenew_*thresholds compare against the baseline (the same comparison the PR comment's "New findings" uses) and fail only on findings the PR introduces. With no baseline — a push to the default branch, or a PR whose base branch couldn't be scanned — they're skipped with a notice in the log instead of treating every existing finding as new. The examples now usenew_high_critical.fail-ondefaults to an explicitneverin the GitHub Action and the Bitbucket pipe (same behaviour as before: no threshold, no failure).docker composedoes.image: prom/prometheus:${PROMETHEUS_VERSION}used to be resolved only from the scanner's own environment, so in CI such images were reported as unscannable. InfraScan now reads the environment, then.env, then the committed.env.example/.env.sample(since.envis usually gitignored), looked for next to the compose file and in parent directories. Supports$VAR,${VAR},${VAR:-default},${VAR-default}. Values are only used to expand image names and are never exported — a placeholder likeSLACK_WEBHOOK_URLin.env.examplehas no effect. An image with a variable that still can't be resolved is reported as not scanned, naming the variable. The file list is configurable withCONTAINER_ENV_FILES/container-env-files(e.g.deploy/versions.env,.env.sample).CONTAINER_SCAN_TIMEOUT/container-scan-timeout, default 300 s (previously a fixed 240 s for Grype and 120 s for Docker Scout). The limit covers the pull and the analysis, and for large images the analysis dominates — e.g.grafana/grafana: ~40 s to pull, ~3 min in Syft's binary cataloger, so it didn't fit in 240 s. A timed-out image is reported as not scanned, with a hint to raise the limit.Fixes
skip-if-no-matchnever skipped a scan. It diffed againstorigin/<base>, whichactions/checkout's default shallow clone doesn't fetch, so the diff was always empty and the scan always ran. The action now fetches the PR's base commit (depth 1) and diffs against it. If that fetch fails, the scan still runs.docs/GITHUB_ACTION.md,docs/PIPELINE_INTEGRATION.md):pushruns only on the default branch (that run saves the baseline PRs compare against; on every branch it duplicated each PR's scan), andcontents: readis included — once a workflow setspermissions:, everything unlisted isnone, andactions/checkoutthen fails on private repositories.Notes
1.2.2..env.example/.env.sampleare picked up automatically. See "Container scanning" in docs/BITBUCKET_PIPELINE.md and the inputs table in docs/GITHUB_ACTION.md.v1.2.1Compare Source
InfraScan 1.2.1 Release Notes
This release contains all changes since
v1.2.0.Highlights
docker-hub-username/docker-hub-passwordinputs (GitHub Action) orDOCKER_HUB_USERNAME/DOCKER_HUB_PASSWORD(Bitbucket pipe). The pipe also getsCONTAINER_SCANNERto force either scanner.container-ignore-images/CONTAINER_IGNORE_IMAGES: a regex of images to skip, e.g.-SNAPSHOT$for images the repo builds itself and only publishes after merge — on a PR the registry only has the previous build, so scanning it is misleading.infrascan-grype-dbcache (added to all examples); when Anchore publishes a newer DB, the pipe replaces the cache through the step's local auth proxy, withBITBUCKET_ACCESS_TOKENas a fallback. Scans always use a current DB either way — the cache only decides whether a download is needed.Fixes
.git). It now reads and fetches the target branch without touching the clone.chmodline scanned no images at all. The pipe now ignores a cache directory it can't write to (with a hint in the log) and downloads the DB as if no cache were declared. Pipelines without any caches work out of the box, just slower.fail-onalso no longer skips saving the baseline or the step summary.directory,scannerandframework, so a PR scan with non-default settings was compared against a differently-scanned baseline and reported false "new" findings. Both scans now use the same settings.docker-compose.yml/Dockerfile(common in a monorepo), every entry looked identical (e.g.docker-compose.yml:7) with no way to tell which service a finding actually belonged to. The step summary's findings/cost-savings tables and the PR comment's "New findings" table now show the full relative path.Notes
1.2.1.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.