From 564b5b6708054c742e1c7c37bdf6e10f0c5574f6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 Jun 2026 04:47:22 +0000 Subject: [PATCH] chore(deps): bump the github-actions group across 1 directory with 2 updates Bumps the github-actions group with 2 updates in the / directory: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32...0f67c3f4856b2e3261c31976d6725780e5e4c373) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/publish-oci-boxes.yml | 10 +++++----- .github/workflows/release-binary.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-oci-boxes.yml b/.github/workflows/publish-oci-boxes.yml index 5fa34b8c..0e8eeac7 100644 --- a/.github/workflows/publish-oci-boxes.yml +++ b/.github/workflows/publish-oci-boxes.yml @@ -91,7 +91,7 @@ jobs: - name: Attest image provenance if: ${{ !inputs.dry_run }} continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/prx/beadsd-box subject-digest: ${{ steps.push.outputs.digest }} @@ -169,7 +169,7 @@ jobs: - name: Attest image provenance if: ${{ !inputs.dry_run }} continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/prx/forge-d-box subject-digest: ${{ steps.push.outputs.digest }} @@ -247,7 +247,7 @@ jobs: - name: Attest image provenance if: ${{ !inputs.dry_run }} continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/prx/concierged-box subject-digest: ${{ steps.push.outputs.digest }} @@ -320,7 +320,7 @@ jobs: - name: Attest image provenance if: ${{ !inputs.dry_run }} continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/prx/dolt-box subject-digest: ${{ steps.push.outputs.digest }} @@ -393,7 +393,7 @@ jobs: - name: Attest image provenance if: ${{ !inputs.dry_run }} continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/prx/nix-builder-box subject-digest: ${{ steps.push.outputs.digest }} diff --git a/.github/workflows/release-binary.yml b/.github/workflows/release-binary.yml index 7961ee7e..acbaf980 100644 --- a/.github/workflows/release-binary.yml +++ b/.github/workflows/release-binary.yml @@ -58,7 +58,7 @@ jobs: # After the binary is built: a failed attestation must not block the release. - name: Attest build provenance continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-path: prx-${{ matrix.target }} @@ -101,7 +101,7 @@ jobs: # The image is already pushed above; a failed attestation must not fail the job. - name: Attest image provenance continue-on-error: true - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.build.outputs.digest }} @@ -131,7 +131,7 @@ jobs: - name: List assets run: ls -l release-assets - name: Create draft release with both assets - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 with: draft: true files: |