chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 #3517

dependabot · 2024-02-05T16:04:16Z

Bumps codecov/codecov-action from 3.1.5 to 4.0.1.

Release notes

Sourced from codecov/codecov-action's releases.

v4.0.1

What's Changed

Update README.md by @thomasrockhu-codecov in codecov/codecov-action#1243

Add all args by @thomasrockhu-codecov in codecov/codecov-action#1245

fix: show both token uses in readme by @thomasrockhu-codecov in codecov/codecov-action#1250

Full Changelog: codecov/codecov-action@v4.0.0...v4.0.1

v4.0.0

v4 of the Codecov Action uses the CLI as the underlying upload. The CLI has helped to power new features including local upload, the global upload token, and new upcoming features.

Breaking Changes

The Codecov Action runs as a node20 action due to node16 deprecation. See this post from GitHub on how to migrate.

Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token). This doc shows instructions on how to add the Codecov token.

OS platforms have been added, though some may not be automatically detected. To see a list of platforms, see our CLI download page

Various arguments to the Action have been changed. Please be aware that the arguments match with the CLI's needs

v3 versions and below will not have access to CLI features (e.g. global upload token, ATS).

What's Changed

build(deps): bump openpgp from 5.8.0 to 5.9.0 by @dependabot in codecov/codecov-action#985

build(deps): bump actions/checkout from 3.0.0 to 3.5.3 by @dependabot in codecov/codecov-action#1000

build(deps): bump ossf/scorecard-action from 2.1.3 to 2.2.0 by @dependabot in codecov/codecov-action#1006

build(deps): bump tough-cookie from 4.0.0 to 4.1.3 by @dependabot in codecov/codecov-action#1013

build(deps-dev): bump word-wrap from 1.2.3 to 1.2.4 by @dependabot in codecov/codecov-action#1024

build(deps): bump node-fetch from 3.3.1 to 3.3.2 by @dependabot in codecov/codecov-action#1031

build(deps-dev): bump @types/node from 20.1.4 to 20.4.5 by @dependabot in codecov/codecov-action#1032

build(deps): bump github/codeql-action from 1.0.26 to 2.21.2 by @dependabot in codecov/codecov-action#1033

build commit,report and upload args based on codecovcli by @dana-yaish in codecov/codecov-action#943

build(deps-dev): bump @types/node from 20.4.5 to 20.5.3 by @dependabot in codecov/codecov-action#1055

build(deps): bump github/codeql-action from 2.21.2 to 2.21.4 by @dependabot in codecov/codecov-action#1051

build(deps-dev): bump @types/node from 20.5.3 to 20.5.4 by @dependabot in codecov/codecov-action#1058

chore(deps): update outdated deps by @thomasrockhu-codecov in codecov/codecov-action#1059

build(deps-dev): bump @types/node from 20.5.4 to 20.5.6 by @dependabot in codecov/codecov-action#1060

build(deps-dev): bump @typescript-eslint/parser from 6.4.1 to 6.5.0 by @dependabot in codecov/codecov-action#1065

build(deps-dev): bump @typescript-eslint/eslint-plugin from 6.4.1 to 6.5.0 by @dependabot in codecov/codecov-action#1064

build(deps): bump actions/checkout from 3.5.3 to 3.6.0 by @dependabot in codecov/codecov-action#1063

build(deps-dev): bump eslint from 8.47.0 to 8.48.0 by @dependabot in codecov/codecov-action#1061

build(deps-dev): bump @types/node from 20.5.6 to 20.5.7 by @dependabot in codecov/codecov-action#1062

build(deps): bump openpgp from 5.9.0 to 5.10.1 by @dependabot in codecov/codecov-action#1066

build(deps-dev): bump @types/node from 20.5.7 to 20.5.9 by @dependabot in codecov/codecov-action#1070

build(deps): bump github/codeql-action from 2.21.4 to 2.21.5 by @dependabot in codecov/codecov-action#1069

build(deps-dev): bump @typescript-eslint/eslint-plugin from 6.5.0 to 6.6.0 by @dependabot in codecov/codecov-action#1072

Update README.md by @thomasrockhu-codecov in codecov/codecov-action#1073

build(deps-dev): bump @typescript-eslint/parser from 6.5.0 to 6.6.0 by @dependabot in codecov/codecov-action#1071

build(deps-dev): bump @vercel/ncc from 0.36.1 to 0.38.0 by @dependabot in codecov/codecov-action#1074

build(deps): bump @actions/core from 1.10.0 to 1.10.1 by @dependabot in codecov/codecov-action#1081

build(deps-dev): bump @typescript-eslint/eslint-plugin from 6.6.0 to 6.7.0 by @dependabot in codecov/codecov-action#1080

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

4.0.0-beta.2

Fixes

#1085 not adding -n if empty to do-upload command

4.0.0-beta.1

v4 represents a move from the universal uploader to the Codecov CLI. Although this will unlock new features for our users, the CLI is not yet at feature parity with the universal uploader.

Breaking Changes

No current support for aarch64 and alpine architectures.

Tokenless uploading is unsuported

Various arguments to the Action have been removed

3.1.4

Fixes

#967 Fix typo in README.md

#971 fix: add back in working dir

#969 fix: CLI option names for uploader

Dependencies

#970 build(deps-dev): bump @types/node from 18.15.12 to 18.16.3

#979 build(deps-dev): bump @types/node from 20.1.0 to 20.1.2

#981 build(deps-dev): bump @types/node from 20.1.2 to 20.1.4

3.1.3

Fixes

#960 fix: allow for aarch64 build

Dependencies

#957 build(deps-dev): bump jest-junit from 15.0.0 to 16.0.0

#958 build(deps): bump openpgp from 5.7.0 to 5.8.0

#959 build(deps-dev): bump @types/node from 18.15.10 to 18.15.12

3.1.2

Fixes

#718 Update README.md

#851 Remove unsupported path_to_write_report argument

#898 codeql-analysis.yml

#901 Update README to contain correct information - inputs and negate feature

#955 fix: add in all the extra arguments for uploader

Dependencies

#819 build(deps): bump openpgp from 5.4.0 to 5.5.0

#835 build(deps): bump node-fetch from 3.2.4 to 3.2.10

#840 build(deps): bump ossf/scorecard-action from 1.1.1 to 2.0.4

#841 build(deps): bump @actions/core from 1.9.1 to 1.10.0

#843 build(deps): bump @actions/github from 5.0.3 to 5.1.1

#869 build(deps): bump node-fetch from 3.2.10 to 3.3.0

#872 build(deps-dev): bump jest-junit from 13.2.0 to 15.0.0

#879 build(deps): bump decode-uri-component from 0.2.0 to 0.2.2

... (truncated)

Commits

e0b68c6 fix: show both token uses in readme (#1250)
1f9f557 Add all args (#1245)
09686fc Update README.md (#1243)
f30e495 fix: update action.yml (#1240)
a7b945c fix: allow for other archs (#1239)
98ab2c5 Update package.json (#1238)
43235cc Update README.md (#1237)
0cf8684 chore(ci): bump to node20 (#1236)
8e1e730 build(deps-dev): bump @typescript-eslint/eslint-plugin from 6.19.1 to 6.20.0 ...
61293af build(deps-dev): bump @typescript-eslint/parser from 6.19.1 to 6.20.0 (#1235)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.1.5 to 4.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@4fe8c5f...e0b68c6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…e#3517) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.1.5 to 4.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@4fe8c5f...e0b68c6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com>

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com> add tests Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> add e2e test for pkcs11 token signing (sigstore#3495) * added e2e test for pkcs11 token signing Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> add license Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> small fix Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> update shebang portable with cross platform Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> enable exit on error and xtrace mode Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> cleanup container Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> pkcs11 test with upcoming changes Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> run pkcs11 e2e test in a separate workflow Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> add pkcs11 test in separate workflow Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> * set shell to bash Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> * set shell options Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> --------- Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the actions group with 1 update (sigstore#3516) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@9614fae...e1523de) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 (sigstore#3517) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.1.5 to 4.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@4fe8c5f...e0b68c6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump go.step.sm/crypto from 0.42.1 to 0.43.0 (sigstore#3519) Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the gomod group with 1 update (sigstore#3518) Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Update codeql-analysis.yml (sigstore#3524) Signed-off-by: Hayden B <hblauzvern@google.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> ErrNoSignaturesFound should be used when there is no signature attached to an image. (sigstore#3526) * ErrNoSignaturesFound should be used when there is no signature attached to an image. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> * Change error message. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> * Add error type tests. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> --------- Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Make E2E tests hermetic (sigstore#3499) * Set rekor URL for online and offline tests Some tests were setting the REKOR_URL environment variable to try to test offline verification. This variable is no longer read so it was not doing anything. This change removes the variable and instead sets RekorURL in the command to either the local rekor instance (so that the public instance is not used) or to a bad url with Offline set to true so that offline verification is truly tested. This change also removes the COSIGN_EXPERIMENTAL variable which is no longer used, and replaces os.Setenv with testing.Setenv which localizes the environment setting to the scope of the test and removes the need for a cleanup function. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> * Fix cleanup in E2E script Calling trap multiple times replaces the last signal handler rather than appending to it. This change ensures that the most recent trap includes all previous traps so that all cleanups are executed. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> * Move verify tests from shell script to Go suite Move the `cosign dockerfile verify` and `cosign manifest verify` tests out of the shell script and into the e2e Go test suite file with all the other tests. This makes them consistent to manage. The initialization of fulcio roots in other tests pollutes the trust root in the new tests, so a reset is added to the fulcioroots package for testing only. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> * Use local services for verify tests Update TestDockerfileVerify and TestManifestVerify to sign ephemeral images within the tests so that the signatures can be created with and verified from the locally running Fulcio and Rekor instances instead of verifying images with the public Rekor instance, so that the tests no longer depend on external services. The images are signed using --identity-token to avoid changing the nature of the verification tests, which were originally written to be keyless. A mock OIDC server is provisioned to provide the token and enable verification. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> * Set rekor env variable in Go test suite Move the setting of SIGSTORE_REKOR_PUBLIC_KEY from the e2e shell script to the Go test suite, so that only the tests that need it have it set and the shell script is doing less setup. Also remove unnecessary instances of os.RemoveAll for temporary directories that the Go testing framework will automatically clean up. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> --------- Signed-off-by: Colleen Murphy <colleenmurphy@google.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Correct help text of verify-attestation policy argument (sigstore#3527) Signed-off-by: michaelvl <mvl.gh@network42.dk> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Don't ignore transparency log in tests if possible (sigstore#3528) Update the e2e tests to default to setting IgnoreTlog to false where possible. In some cases, where the IgnoreTlog functionality is being explicitly tested, continue to set it to true. Since the transparency log isn't being ignored, the signing commands need to upload it and need the rekor public key and URL in order to do so. Removes one redundant test. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the gomod group with 1 update (sigstore#3530) Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.7.0 to 0.7.1 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump golang.org/x/crypto from 0.18.0 to 0.19.0 (sigstore#3531) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.18.0 to 0.19.0. - [Commits](golang/crypto@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump golang.org/x/oauth2 from 0.16.0 to 0.17.0 (sigstore#3532) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.16.0 to 0.17.0. - [Commits](golang/oauth2@v0.16.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the actions group with 3 updates (sigstore#3535) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [mikefarah/yq](https://github.com/mikefarah/yq). Updates `google-github-actions/auth` from 2.1.0 to 2.1.1 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@5a50e58...a6e2e39) Updates `actions/upload-artifact` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@26f96df...5d5d22a) Updates `mikefarah/yq` from 4.40.5 to 4.40.7 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@dd64899...bb66c9c) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump github.com/google/go-containerregistry (sigstore#3521) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (sigstore#3536) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3a91952...3cfe3a4) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump github.com/xanzy/go-gitlab from 0.96.0 to 0.97.0 (sigstore#3522) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.96.0 to 0.97.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.96.0...v0.97.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump google.golang.org/api from 0.160.0 to 0.164.0 (sigstore#3538) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.160.0 to 0.164.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.160.0...v0.164.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> use go1.21.7 as go-version in actions/setup-go (sigstore#3540) * use go1.21 as go-version in actions/setup-go Signed-off-by: Dmitry S <dsavints@gmail.com> * e2e-tests.yml - remove unused GO_VERSION env var Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 (sigstore#3537) * chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 Updates the requirements on [github/codeql-action](https://github.com/github/codeql-action) to permit the latest version. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/commits/65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update scorecard-action.yml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> fix semgrep issues for dgryski.semgrep-go ruleset (sigstore#3541) * fix semgrep issues dgryski.semgrep-go ruleset Signed-off-by: Dmitry S <dsavints@gmail.com> * golangci-lint: check error value of out.Write() Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump google.golang.org/api from 0.164.0 to 0.165.0 (sigstore#3545) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.164.0 to 0.165.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.164.0...v0.165.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the actions group with 1 update (sigstore#3546) Bumps the actions group with 1 update: [mikefarah/yq](https://github.com/mikefarah/yq). Updates `mikefarah/yq` from 4.40.7 to 4.41.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@bb66c9c...0476945) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the gomod group with 2 updates (sigstore#3543) Bumps the gomod group with 2 updates: [github.com/sigstore/timestamp-authority](https://github.com/sigstore/timestamp-authority) and [go.step.sm/crypto](https://github.com/smallstep/crypto). Updates `github.com/sigstore/timestamp-authority` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/sigstore/timestamp-authority/releases) - [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md) - [Commits](sigstore/timestamp-authority@v1.2.1...v1.2.2) Updates `go.step.sm/crypto` from 0.43.0 to 0.43.1 - [Release notes](https://github.com/smallstep/crypto/releases) - [Commits](smallstep/crypto@v0.43.0...v0.43.1) --- updated-dependencies: - dependency-name: github.com/sigstore/timestamp-authority dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod - dependency-name: go.step.sm/crypto dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> fix 'go vet -tags e2e ./...' (sigstore#3550) * fix 'go vet -tags e2e ./...' Signed-off-by: Dmitry S <dsavints@gmail.com> * fix typo in 'concatenating' Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump github.com/xanzy/go-gitlab from 0.97.0 to 0.98.0 (sigstore#3556) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.97.0 to 0.98.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.97.0...v0.98.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump google.golang.org/api from 0.165.0 to 0.167.0 (sigstore#3557) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.165.0 to 0.167.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.165.0...v0.167.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> remove unused rootPool var (sigstore#3559) Signed-off-by: Dmitry S <dsavints@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Bump sigstore/sigstore to v1.8.2 (sigstore#3561) Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> Correct help text of triangulate cmd (sigstore#3551) Signed-off-by: michaelvl <mvl.gh@network42.dk> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump imranismail/setup-kustomize from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198 (sigstore#3554) * chore(deps): bump imranismail/setup-kustomize Bumps [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198. - [Release notes](https://github.com/imranismail/setup-kustomize/releases) - [Commits](imranismail/setup-kustomize@a76db1c...f6959cf) --- updated-dependencies: - dependency-name: imranismail/setup-kustomize dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update kind-e2e-insecure-registry.yaml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the actions group with 3 updates (sigstore#3564) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `google-github-actions/auth` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@a6e2e39...55bd3a7) Updates `mikefarah/yq` from 4.41.1 to 4.42.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0476945...9adde1a) Updates `codecov/codecov-action` from 4.0.1 to 4.1.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e0b68c6...54bcd87) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> add flag for fulcio auth flow and client creds Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> chore(deps): bump the actions group with 1 update (sigstore#3516) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@9614fae...e1523de) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Update codeql-analysis.yml (sigstore#3524) Signed-off-by: Hayden B <hblauzvern@google.com> ErrNoSignaturesFound should be used when there is no signature attached to an image. (sigstore#3526) * ErrNoSignaturesFound should be used when there is no signature attached to an image. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> * Change error message. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> * Add error type tests. Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> --------- Signed-off-by: zhaoyonghe <yonghe.zhao@yahoo.com> Correct help text of verify-attestation policy argument (sigstore#3527) Signed-off-by: michaelvl <mvl.gh@network42.dk> Don't ignore transparency log in tests if possible (sigstore#3528) Update the e2e tests to default to setting IgnoreTlog to false where possible. In some cases, where the IgnoreTlog functionality is being explicitly tested, continue to set it to true. Since the transparency log isn't being ignored, the signing commands need to upload it and need the rekor public key and URL in order to do so. Removes one redundant test. Signed-off-by: Colleen Murphy <colleenmurphy@google.com> chore(deps): bump the gomod group with 1 update (sigstore#3530) Bumps the gomod group with 1 update: cuelang.org/go. Updates `cuelang.org/go` from 0.7.0 to 0.7.1 --- updated-dependencies: - dependency-name: cuelang.org/go dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump github.com/google/go-containerregistry (sigstore#3521) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.18.0 to 0.19.0. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](google/go-containerregistry@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 (sigstore#3536) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3a91952...3cfe3a4) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> use go1.21.7 as go-version in actions/setup-go (sigstore#3540) * use go1.21 as go-version in actions/setup-go Signed-off-by: Dmitry S <dsavints@gmail.com> * e2e-tests.yml - remove unused GO_VERSION env var Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 (sigstore#3537) * chore(deps): update github/codeql-action requirement to 65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 Updates the requirements on [github/codeql-action](https://github.com/github/codeql-action) to permit the latest version. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/commits/65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update scorecard-action.yml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> fix semgrep issues for dgryski.semgrep-go ruleset (sigstore#3541) * fix semgrep issues dgryski.semgrep-go ruleset Signed-off-by: Dmitry S <dsavints@gmail.com> * golangci-lint: check error value of out.Write() Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> fix 'go vet -tags e2e ./...' (sigstore#3550) * fix 'go vet -tags e2e ./...' Signed-off-by: Dmitry S <dsavints@gmail.com> * fix typo in 'concatenating' Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com> chore(deps): bump github.com/xanzy/go-gitlab from 0.97.0 to 0.98.0 (sigstore#3556) Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.97.0 to 0.98.0. - [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go) - [Commits](xanzy/go-gitlab@v0.97.0...v0.98.0) --- updated-dependencies: - dependency-name: github.com/xanzy/go-gitlab dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> remove unused rootPool var (sigstore#3559) Signed-off-by: Dmitry S <dsavints@gmail.com> Bump sigstore/sigstore to v1.8.2 (sigstore#3561) Correct help text of triangulate cmd (sigstore#3551) Signed-off-by: michaelvl <mvl.gh@network42.dk> chore(deps): bump imranismail/setup-kustomize from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198 (sigstore#3554) * chore(deps): bump imranismail/setup-kustomize Bumps [imranismail/setup-kustomize](https://github.com/imranismail/setup-kustomize) from a76db1c6419124d51470b1e388c4b29476f495f1 to f6959cf94216d4be0182d7c78b39f14d0c8bb198. - [Release notes](https://github.com/imranismail/setup-kustomize/releases) - [Commits](imranismail/setup-kustomize@a76db1c...f6959cf) --- updated-dependencies: - dependency-name: imranismail/setup-kustomize dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update kind-e2e-insecure-registry.yaml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> chore(deps): bump the actions group with 3 updates (sigstore#3564) Bumps the actions group with 3 updates: [google-github-actions/auth](https://github.com/google-github-actions/auth), [mikefarah/yq](https://github.com/mikefarah/yq) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `google-github-actions/auth` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/google-github-actions/auth/releases) - [Changelog](https://github.com/google-github-actions/auth/blob/main/CHANGELOG.md) - [Commits](google-github-actions/auth@a6e2e39...55bd3a7) Updates `mikefarah/yq` from 4.41.1 to 4.42.1 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@0476945...9adde1a) Updates `codecov/codecov-action` from 4.0.1 to 4.1.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@e0b68c6...54bcd87) --- updated-dependencies: - dependency-name: google-github-actions/auth dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> re-add missing from rebase Signed-off-by: Noah Kreiger <noahkreiger@gmail.com> add to doc Signed-off-by: Noah Kreiger <noahkreiger@gmail.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Feb 5, 2024

hectorj2f approved these changes Feb 5, 2024

View reviewed changes

hectorj2f enabled auto-merge (squash) February 5, 2024 16:16

cpanato approved these changes Feb 5, 2024

View reviewed changes

hectorj2f merged commit cb9ad53 into main Feb 5, 2024
29 checks passed

hectorj2f deleted the dependabot/github_actions/codecov/codecov-action-4.0.1 branch February 5, 2024 16:23

github-actions bot added this to the v2.3.0 milestone Feb 5, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 #3517

chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 #3517

dependabot bot commented on behalf of github Feb 5, 2024

chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 #3517

chore(deps): bump codecov/codecov-action from 3.1.5 to 4.0.1 #3517

Conversation

dependabot bot commented on behalf of github Feb 5, 2024

v4.0.1

What's Changed

v4.0.0

Breaking Changes

What's Changed

4.0.0-beta.2

Fixes

4.0.0-beta.1

Breaking Changes

3.1.4

Fixes

Dependencies

3.1.3

Fixes

Dependencies

3.1.2

Fixes

Dependencies