ci(deps): bump the github-actions-minor-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #29 · shiftleftcyber/secure-sbom-action

dependabot · 2026-07-15T13:18:33Z

Bumps the github-actions-minor-patch group with 9 updates in the / directory:

Package	From	To
actions/setup-go	`6.4.0`	`6.5.0`
actions/cache	`5.0.5`	`5.1.0`
golangci/golangci-lint-action	`9.2.1`	`9.3.0`
actions/setup-python	`6.2.0`	`6.3.0`
relizaio/rearm-actions/setup-cli	`1.6.1`	`1.7.0`
relizaio/rearm-actions/initialize	`1.6.1`	`1.7.0`
relizaio/rearm-actions/sbom-sign-scan	`1.6.1`	`1.7.0`
relizaio/rearm-actions/finalize	`1.6.1`	`1.7.0`
docker/login-action	`4.2.0`	`4.4.0`

Updates actions/setup-go from 6.4.0 to 6.5.0

Release notes

Sourced from actions/setup-go's releases.

v6.5.0

What's Changed

Dependency update

Upgrade actions dependencies by @priyagupta108 with @Copilot in actions/setup-go#744

Upgrade @types/node and typescript-eslint dependencies to resolve npm audit findings by @HarithaVattikuti in actions/setup-go#755

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-go#758

Upgrade version to 6.5.0 in package.json and package-lock.json by @HarithaVattikuti in actions/setup-go#762

New Contributors

@priyagupta108 with @Copilot made their first contribution in actions/setup-go#744

@jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
e91cc3b Bump @actions/cache to 5.1.0, log cache write denied (#758)
4a2405e chore: update @types/node and @typescript-eslint dependencies to latest versi...
78961f6 chore: update @actions dependencies and refresh license cache (#744)
See full diff in compare view

Updates actions/cache from 5.0.5 to 5.1.0

Release notes

Sourced from actions/cache's releases.

v5.1.0

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in actions/cache#1775

Full Changelog: actions/cache@v5...v5.1.0

Commits

caa2961 Merge pull request #1775 from jasongin/readonly-cache-v5
00c2da9 Bump @actions/cache to v5.1.0 - handle read-only cache access
See full diff in compare view

Updates golangci/golangci-lint-action from 9.2.1 to 9.3.0

Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.3.0

What's Changed

Changes

feat: add no-run-logs-group as experimental option by @ldez in golangci/golangci-lint-action#1403

Dependencies

build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-actions group by @dependabot[bot] in golangci/golangci-lint-action#1395

build(deps): bump tmp from 0.2.5 to 0.2.6 by @dependabot[bot] in golangci/golangci-lint-action#1397

build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-actions group by @dependabot[bot] in golangci/golangci-lint-action#1398

build(deps): bump tmp from 0.2.6 to 0.2.7 by @dependabot[bot] in golangci/golangci-lint-action#1399

build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in golangci/golangci-lint-action#1400

Full Changelog: golangci/golangci-lint-action@v9.2.1...v9.3.0

Commits

ba0d7d2 chore: prepare release v9.3.0
efd0857 feat: add no-run-logs-group as experimental option (#1403)
ed485de build(deps): bump undici from 6.24.0 to 6.27.0
8872e8d build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (#1400)
b163415 build(deps): bump tmp from 0.2.6 to 0.2.7 (#1399)
e52a9f8 build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
8182aa3 build(deps): bump tmp from 0.2.5 to 0.2.6 (#1397)
5403a41 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-ac...
See full diff in compare view

Updates actions/setup-python from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-python's releases.

v6.3.0

What's Changed

Enhancement

Add RHEL support and include Linux distro in cache keys by @priyagupta108 in actions/setup-python#1323

Fix pip cache error handling on Windows by @priyagupta108 in actions/setup-python#1040

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-python#1281

Upgrade actions dependencies by @gowridurgad with @Copilot in actions/setup-python#1303

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-python#1324

Upgrade dependency versions and test workflow configuration by @HarithaVattikuti in actions/setup-python#1322

Documentation

Update advanced-usage.md by @Dunky-Z in actions/setup-python#811

New Contributors

@gowridurgad with @Copilot made their first contribution in actions/setup-python#1303

@jasongin made their first contribution in actions/setup-python#1324

@Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

ece7cb0 Fix pip cache error handling on Windows. (#1040)
1d18d7a Update advanced-usage.md (#811)
d2b357a Update dependency versions and test workflow configuration (#1322)
8f639b1 Merge pull request #1324 from jasongin/update-actions-cache-5.1.0
6731c2b Resolve high-severity audit issues
0cb1a84 Add RHEL support and include Linux distro in cache keys (#1323)
dc6eab6 Update dist
6f4b74b Strict equality
fa8bde1 Bump @actions/cache to 5.1.0, log cache write denied
c8813ba Upgrade @actions dependencies and update licenses (#1303)
Additional commits viewable in compare view

Updates relizaio/rearm-actions/setup-cli from 1.6.1 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/setup-cli's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.
# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256
Fixes:

This release addresses zizmor findings around possible unsafe inputs.

Commits

dac3e77 fix: proper variable expanding following hardening
7768d9b docs: describe possible breaking changes on input
9dceef7 feat: handle possible unsafe inputs
ea942d9 docs: correct type on add multi-release
See full diff in compare view

Updates relizaio/rearm-actions/initialize from 1.6.1 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/initialize's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.
# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256
Fixes:

This release addresses zizmor findings around possible unsafe inputs.

Commits

dac3e77 fix: proper variable expanding following hardening
7768d9b docs: describe possible breaking changes on input
9dceef7 feat: handle possible unsafe inputs
ea942d9 docs: correct type on add multi-release
See full diff in compare view

Updates relizaio/rearm-actions/sbom-sign-scan from 1.6.1 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/sbom-sign-scan's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.
# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256
Fixes:

This release addresses zizmor findings around possible unsafe inputs.

Commits

dac3e77 fix: proper variable expanding following hardening
7768d9b docs: describe possible breaking changes on input
9dceef7 feat: handle possible unsafe inputs
ea942d9 docs: correct type on add multi-release
See full diff in compare view

Updates relizaio/rearm-actions/finalize from 1.6.1 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/finalize's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.
# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256
Fixes:

This release addresses zizmor findings around possible unsafe inputs.

Commits

dac3e77 fix: proper variable expanding following hardening
7768d9b docs: describe possible breaking changes on input
9dceef7 feat: handle possible unsafe inputs
ea942d9 docs: correct type on add multi-release
See full diff in compare view

Updates docker/login-action from 4.2.0 to 4.4.0

Release notes

Sourced from docker/login-action's releases.

v4.4.0

Skip empty registry-auth secret mask by @crazy-max in docker/login-action#1035

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1077.0 docker/login-action#1034

Full Changelog: docker/login-action@v4.3.0...v4.4.0

v4.3.0

Preserve names in esbuild bundle by @crazy-max in docker/login-action#1022

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1076.0 docker/login-action#999 docker/login-action#1030

Bump @docker/actions-toolkit from 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027

Bump @sigstore/core from 3.1.0 to 3.2.1 in docker/login-action#1023

Bump @sigstore/verify from 3.1.0 to 3.1.1 in docker/login-action#1029

Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017

Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028

Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031

Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002

Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020

Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019

Full Changelog: docker/login-action@v4.2.0...v4.3.0

Commits

af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
da722bd [dependabot skip] chore: update generated content
2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
c455755 chore: update generated content
4835190 skip empty registry-auth secret mask
992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
9d49d6a build(deps): bump docker/bake-action/subaction/matrix
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 9 updates Bumps the github-actions-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-go](https://github.com/actions/setup-go) | `6.4.0` | `6.5.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `5.1.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.1` | `9.3.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | | [relizaio/rearm-actions/setup-cli](https://github.com/relizaio/rearm-actions) | `1.6.1` | `1.7.0` | | [relizaio/rearm-actions/initialize](https://github.com/relizaio/rearm-actions) | `1.6.1` | `1.7.0` | | [relizaio/rearm-actions/sbom-sign-scan](https://github.com/relizaio/rearm-actions) | `1.6.1` | `1.7.0` | | [relizaio/rearm-actions/finalize](https://github.com/relizaio/rearm-actions) | `1.6.1` | `1.7.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4a36011...924ae3a) Updates `actions/cache` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@27d5ce7...caa2961) Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@82606bf...ba0d7d2) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...ece7cb0) Updates `relizaio/rearm-actions/setup-cli` from 1.6.1 to 1.7.0 - [Release notes](https://github.com/relizaio/rearm-actions/releases) - [Commits](relizaio/rearm-actions@411386f...dac3e77) Updates `relizaio/rearm-actions/initialize` from 1.6.1 to 1.7.0 - [Release notes](https://github.com/relizaio/rearm-actions/releases) - [Commits](relizaio/rearm-actions@411386f...dac3e77) Updates `relizaio/rearm-actions/sbom-sign-scan` from 1.6.1 to 1.7.0 - [Release notes](https://github.com/relizaio/rearm-actions/releases) - [Commits](relizaio/rearm-actions@411386f...dac3e77) Updates `relizaio/rearm-actions/finalize` from 1.6.1 to 1.7.0 - [Release notes](https://github.com/relizaio/rearm-actions/releases) - [Commits](relizaio/rearm-actions@411386f...dac3e77) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...af1e73f) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: actions/cache dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: relizaio/rearm-actions/setup-cli dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: relizaio/rearm-actions/initialize dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: relizaio/rearm-actions/sbom-sign-scan dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: relizaio/rearm-actions/finalize dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-15T13:18:34Z

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(deps): bump the github-actions-minor-patch group across 1 directory with 9 updates#29

ci(deps): bump the github-actions-minor-patch group across 1 directory with 9 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-minor-patch-882fe02800

dependabot Bot commented on behalf of github Jul 15, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.5.0

What's Changed

Dependency update

New Contributors

v5.1.0

What's Changed

v9.3.0

What's Changed

Changes

Dependencies

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

1.7.0

Input Value Requirements

1.7.0

Input Value Requirements

1.7.0

Input Value Requirements

1.7.0

Input Value Requirements

v4.4.0

v4.3.0

Uh oh!

dependabot Bot commented on behalf of github Jul 15, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 15, 2026 •

edited

Loading