chore(ci): bump the actions group across 1 directory with 2 updates - #157
dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Manual review required. This Dependabot PR bumps a |
PR Checks Summary
✅ All checks passed! Ready for review. |
Security Scan Results: PASSED
|
|
Holding this one. Its green checks do not cover the change.
So I dispatched both manually against this branch. Both failed, at the Runs: 33084779404 (Build Capacitor), 33084782035 (Build React Native). Cause: the step passes This is not a reason to revert the bump; the workflows are wired wrong and v6 surfaced it. A fix is in progress that moves Worth noting for its own sake: these two workflows have never run on |
Bumps the actions group with 2 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `actions/setup-java` from 5 to 6 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5...v6) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.97.1 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@bcfcf73...20652fb) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
2660619 to
9773121
Compare
|
Manual review required. This Dependabot PR bumps a |
Security Scan Results: PASSED
|
* chore(ci): bump the actions group with 2 updates Bumps the actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `actions/setup-java` from 5 to 6 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5...v6) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.97.1 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@bcfcf73...20652fb) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> * fix(ci): move setup-java after android project generation actions/setup-java@v5 only warned when cache: gradle found no gradle files to key on; @v6 hard-fails the job instead. build-capacitor.yml, build-react-native.yml, and deploy-mobile-android.yml all ran Setup Java before the step that generates the native android/ project (via cap add/cap sync or RN's install), so no gradle files existed yet at that point. android/ is gitignored, never committed, so this always happened on a fresh checkout. Move Setup Java to run after the android project exists, matching the pattern already used in ci.yml. Also add cache-dependency-path so the gradle cache keys correctly once the files are present. These workflows are workflow_dispatch-only (or tag-triggered for deploy-mobile-android), so PR checks never exercise them and #157's green PR checks did not catch this. Verified by dispatching build-capacitor.yml and build-react-native.yml directly against this branch. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
@dependabot rebase |
|
Superseded — every version this proposes is already on Verified by diffing the branch against current main:
Both landed via #159, which had to touch the same files to fix the ordering bug this bump exposed. The only remaining delta is a Worth recording, because the green tick here was misleading#157's checks were green while the change was broken. Every job that actually runs Dispatching those workflows manually against this branch failed immediately, at the
#159 fixed it properly by moving The trufflehog half was fine throughout — |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps the actions group with 2 updates in the / directory: actions/setup-java and trufflesecurity/trufflehog.
Updates
actions/setup-javafrom 5 to 6Release notes
Sourced from actions/setup-java's releases.
... (truncated)
Commits
dd06d9cPrepare documentation for v6 release (#1253)59b3450chore(deps): combine open Dependabot npm updates (#1252)b96213dSet default signature verification for supported distributions (#1246)1dbac3cdocs: expose contributing guide to GitHub (#1245)11741d6ci: constrain cache e2e job modes (#1244)ff99aa1Fix Oracle macOS E2E version (#1243)416c6d1Add Red Hat Build of OpenJDK support (#1241)5f75b27Add Maven dependency-resolution repositories (#1240)a42a52cAdd multiple Maven server credentials (#1239)fb4abd7test: cover JDK 26 from SDKMAN (#1238)Updates
trufflesecurity/trufflehogfrom 3.97.0 to 3.97.1Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
20652fbCarry GitHub App installation ID on repo units (#5215)3ab759fRefine SECURITY.md (#5216)2cdb97d[SCAN-101] s3 source accept persisted unit envelopes in UnmarshalSourceUnit (...4ec7749preallocate bindings capacity in dockerhub and groq, with unit tests (#5213)9610306Doubled timeout, as MongoDB secrets are repeatedly hitting this and failing t...9d3f5d1[SCAN-1020] neon scram pgx (#5217)925c1d0fix(detectors/docker): don't greedy match in keyPat (#5214)e12da3cdocs: add generic config-secret custom detector example (#5195)bcbcab2Fix GHEC with Data Residency (*.ghe.com) base URL (#4777)bc3a3aeUpdate module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (#5196)