ci: bump the actions group across 1 directory with 12 updates by dependabot[bot] · Pull Request #7 · attested-delivery/attested-delivery.github.io

dependabot · 2026-07-02T15:24:44Z

Updates the requirements on actions/checkout, actions/attest-build-provenance, actions/upload-artifact, attested-delivery/.github/.github/workflows/reusable-zap.yml, attested-delivery/.github/.github/workflows/reusable-attest-scan.yml, attested-delivery/.github/.github/workflows/pin-check.yml, actions/setup-node, actions/configure-pages, actions/deploy-pages, attested-delivery/.github/.github/workflows/reusable-sca-osv.yml, attested-delivery/.github/.github/workflows/reusable-scorecard.yml and attested-delivery/.github/.github/workflows/reusable-trivy.yml to permit the latest version.
Updates actions/checkout from 4.2.2 to 7.0.0

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Update all references from v5 and v4 to v6 by @ericsciple in actions/checkout#2314

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

Clarify v6 README by @ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

v6.0.0

What's Changed

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

Persist creds to a separate file by @ericsciple in actions/checkout#2286

v6-beta by @ericsciple in actions/checkout#2298

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

... (truncated)

Commits

9c091bb update error wording (#2467)
1044a6d getting ready for checkout v7 release (#2464)
f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
d914b26 upgrade module to esm and update dependencies (#2463)
537c7ef Bump @actions/core and @actions/tool-cache and Remove uuid (#2459)
130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
0f9f3aa Bump actions/publish-immutable-action (#2458)
f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
df4cb1c Update changelog for v6.0.3 (#2446)
Additional commits viewable in compare view

Updates actions/attest-build-provenance from 4.1.0 to 4.1.1

Release notes

Sourced from actions/attest-build-provenance's releases.

v4.1.1

[!NOTE] As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Update actions/attest to v4.1.1 by @bdehamer in actions/attest-build-provenance#858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

Commits

0f67c3f Bump actions/checkout from 6.0.3 to 7.0.0 (#857)
21b787d Update actions/attest to v4.1.1 (#858)
f14352a add dependabot cooldown (#851)
2c04a00 Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)
10334b5 remove badges from README (#840)
c5efebd remove prober workflows (#837)
See full diff in compare view

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Add proxy integration test by @Link- in actions/upload-artifact#754

Upgrade the module to ESM and bump dependencies by @danwkennedy in actions/upload-artifact#762

Support direct file uploads by @danwkennedy in actions/upload-artifact#764

New Contributors

@Link- made their first contribution in actions/upload-artifact#754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Upload Artifact Node 24 support by @salmanmkc in actions/upload-artifact#719

fix: update @actions/artifact for Node.js 24 punycode deprecation by @salmanmkc in actions/upload-artifact#744

prepare release v6.0.0 for Node.js 24 support by @salmanmkc in actions/upload-artifact#745

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
bbbca2d Support direct file uploads (#764)
589182c Upgrade the module to ESM and bump dependencies (#762)
47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
02a8460 Add proxy integration test
b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
e516bc8 docs: correct description of Node.js 24 support in README
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/reusable-zap.yml from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

ee1f93b fix(reusable-trivy): authenticate to GHCR before scanning image-ref (#33)
f0c5cba fix(sign-and-attest): disable release-asset upload on image SBOM step (#32)
ca91728 ci: run catalog-updater engine unit tests + lint on change (#26)
508aa7a fix(catalog-update): capture attestation evidence (--format json) (#25)
b951e1b fix(catalog-update): repin targets the entry by its own top-level name (#24)
36cdbd7 fix(catalog-update): resolve repo from url (git-subdir/url sources) (#23)
4d9150c feat(release): attest releases (SLSA provenance + CycloneDX SBOM) (#22)
f211de9 docs: add ecosystem documentation hub index (#21)
4b398a9 fix(catalog-update): use client-id (app-id is deprecated) (#19)
ed65666 fix(catalog-update): App id from org variable, key from org secret (#18)
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/reusable-attest-scan.yml from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

ee1f93b fix(reusable-trivy): authenticate to GHCR before scanning image-ref (#33)
f0c5cba fix(sign-and-attest): disable release-asset upload on image SBOM step (#32)
ca91728 ci: run catalog-updater engine unit tests + lint on change (#26)
508aa7a fix(catalog-update): capture attestation evidence (--format json) (#25)
b951e1b fix(catalog-update): repin targets the entry by its own top-level name (#24)
36cdbd7 fix(catalog-update): resolve repo from url (git-subdir/url sources) (#23)
4d9150c feat(release): attest releases (SLSA provenance + CycloneDX SBOM) (#22)
f211de9 docs: add ecosystem documentation hub index (#21)
4b398a9 fix(catalog-update): use client-id (app-id is deprecated) (#19)
ed65666 fix(catalog-update): App id from org variable, key from org secret (#18)
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/pin-check.yml to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

See full diff in compare view

Updates actions/setup-node from 4.4.0 to 6.4.0

Release notes

Sourced from actions/setup-node's releases.

v6.4.0

What's Changed

Dependency updates:

Upgrade @actions dependencies by @Copilot in actions/setup-node#1525

Update Node.js versions in versions.yml and bump package to v6.4.0 by @priya-kinthali in actions/setup-node#1533

New Contributors

@Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in actions/setup-node#1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in actions/setup-node#1491

Replace uuid with crypto.randomUUID() by @trivikr in actions/setup-node#1378

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-node#1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in actions/setup-node#1467

Scope test lockfiles by package manager and update cache tests by @gowridurgad in actions/setup-node#1495

New Contributors

@susnux made their first contribution in actions/setup-node#1283

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

What's Changed

Documentation

Documentation update related to absence of Lockfile by @mahabaleshwars in actions/setup-node#1454

Correct mirror option typos by @MikeMcC399 in actions/setup-node#1442

Readme update on checkout version v6 by @deining in actions/setup-node#1446

Readme typo fixes @munyari in actions/setup-node#1226

Advanced document update on checkout version v6 by @aparnajyothi-y in actions/setup-node#1468

Dependency updates:

Upgrade @actions/cache to v5.0.1 by @salmanmkc in actions/setup-node#1449

New Contributors

@mahabaleshwars made their first contribution in actions/setup-node#1454

@MikeMcC399 made their first contribution in actions/setup-node#1442

@deining made their first contribution in actions/setup-node#1446

... (truncated)

Commits

48b55a0 Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)
ab72c7e Upgrade @actions dependencies (#1525)
53b8394 Bump minimatch from 3.1.2 to 3.1.5 (#1498)
54045ab Scope test lockfiles by package manager and update cache tests (#1495)
c882bff Replace uuid with crypto.randomUUID() (#1378)
774c1d6 feat(node-version-file): support parsing devEngines field (#1283)
efcb663 fix: remove hardcoded bearer (#1467)
d02c89d Fix npm audit issues (#1491)
6044e13 Docs: bump actions/checkout from v5 to v6 (#1468)
8e49463 Fix README typo (#1226)
Additional commits viewable in compare view

Updates actions/configure-pages from 5.0.0 to 6.0.0

Release notes

Sourced from actions/configure-pages's releases.

v6.0.0

Changelog

upgrade to node 24 @salmanmkc (#186)

Upgrade IA Publish @Jcambass (#165)

Add workflow file for publishing releases to immutable action package @Jcambass (#163)

pin draft release version @YiMysty (#162)

Bump espree from 9.6.1 to 10.1.0 @dependabot (#160)

Bump eslint-config-prettier from 8.8.0 to 9.1.0 @dependabot (#143)

Be more friendly to Dependabot @yoannchaudet (#158)

Bump eslint-plugin-github from 4.10.2 to 5.0.1 @dependabot (#154)

Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group @dependabot (#156)

Bump undici from 5.28.3 to 5.28.4 @dependabot (#145)

See details of all code changes since previous release.

Commits

45bfe01 Merge pull request #186 from salmanmkc/node24
d8770c2 Update Node version from 20 to 24 in action.yml
cb8a1a3 upgrade to node 24
d560657 Merge pull request #165 from actions/Jcambass-patch-1
35e0ac4 Upgrade IA Publish
1dfbcbf Merge pull request #163 from actions/Jcambass-patch-1
2f4f988 Add workflow file for publishing releases to immutable action package
0d7570c Merge pull request #162 from actions/pin-draft-release-verssion
3ea1966 pin draft release version
aabcbc4 Merge pull request #160 from actions/dependabot/npm_and_yarn/espree-10.1.0
Additional commits viewable in compare view

Updates actions/deploy-pages from 4.0.5 to 5.0.0

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.0

Changelog

Update Node.js version to 24.x @salmanmkc (#404)

Add workflow file for publishing releases to immutable action package @Jcambass (#374)

Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @dependabot (#360)

Make the rebuild dist workflow work nicer with Dependabot @yoannchaudet (#361)

Bump the non-breaking-changes group across 1 directory with 3 updates @dependabot (#358)

Delete repeated sentence @garethsb (#359)

Update README.md @tsusdere (#348)

Bump the non-breaking-changes group with 4 updates @dependabot (#341)

Remove error message for file permissions @TooManyBees (#340)

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

cd2ce8f Merge pull request #404 from salmanmkc/node24
bbe2a95 Update Node.js version to 24.x
854d7aa Merge pull request #374 from actions/Jcambass-patch-1
306bb81 Add workflow file for publishing releases to immutable action package
b742728 Merge pull request #360 from actions/dependabot/npm_and_yarn/npm_and_yarn-513...
7273294 Bump braces in the npm_and_yarn group across 1 directory
963791f Merge pull request #361 from actions/dependabot-friendly
51bb29d Make the rebuild dist workflow safer for Dependabot
89f3d10 Merge pull request #358 from actions/dependabot/npm_and_yarn/non-breaking-cha...
bce7355 Merge branch 'main' into dependabot/npm_and_yarn/non-breaking-changes-99c12deb21
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/reusable-sca-osv.yml from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

ee1f93b fix(reusable-trivy): authenticate to GHCR before scanning image-ref (#33)
f0c5cba fix(sign-and-attest): disable release-asset upload on image SBOM step (#32)
ca91728 ci: run catalog-updater engine unit tests + lint on change (#26)
508aa7a fix(catalog-update): capture attestation evidence (--format json) (#25)
b951e1b fix(catalog-update): repin targets the entry by its own top-level name (#24)
36cdbd7 fix(catalog-update): resolve repo from url (git-subdir/url sources) (#23)
4d9150c feat(release): attest releases (SLSA provenance + CycloneDX SBOM) (#22)
f211de9 docs: add ecosystem documentation hub index (#21)
4b398a9 fix(catalog-update): use client-id (app-id is deprecated) (#19)
ed65666 fix(catalog-update): App id from org variable, key from org secret (#18)
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/reusable-scorecard.yml from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

ee1f93b fix(reusable-trivy): authenticate to GHCR before scanning image-ref (#33)
f0c5cba fix(sign-and-attest): disable release-asset upload on image SBOM step (#32)
ca91728 ci: run catalog-updater engine unit tests + lint on change (#26)
508aa7a fix(catalog-update): capture attestation evidence (--format json) (#25)
b951e1b fix(catalog-update): repin targets the entry by its own top-level name (#24)
36cdbd7 fix(catalog-update): resolve repo from url (git-subdir/url sources) (#23)
4d9150c feat(release): attest releases (SLSA provenance + CycloneDX SBOM) (#22)
f211de9 docs: add ecosystem documentation hub index (#21)
4b398a9 fix(catalog-update): use client-id (app-id is deprecated) (#19)
ed65666 fix(catalog-update): App id from org variable, key from org secret (#18)
Additional commits viewable in compare view

Updates attested-delivery/.github/.github/workflows/reusable-trivy.yml from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492

Commits

ee1f93b fix(reusable-trivy): authenticate to GHCR before scanning image-ref (#33)
f0c5cba fix(sign-and-attest): disable release-asset upload on image SBOM step (#32)
ca91728 ci: run catalog-updater engine unit tests + lint on change (#26)
508aa7a fix(catalog-update): capture attestation evidence (--format json) (#25)
b951e1b fix(catalog-update): repin targets the entry by its own top-level name (#24)
36cdbd7 fix(catalog-update): resolve repo from url (git-subdir/url sources) (#23)
4d9150c feat(release): attest releases (SLSA provenance + CycloneDX SBOM) (#22)
f211de9 docs: add ecosystem documentation hub index (#21)
4b398a9 fix(catalog-update): use client-id (app-id is deprecated) (#19)
ed65666 fix(catalog-update): App id from org variable, key from org secret (#18)
Additional commits viewable in compare view

Updates the requirements on [actions/checkout](https://github.com/actions/checkout), [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance), [actions/upload-artifact](https://github.com/actions/upload-artifact), [attested-delivery/.github/.github/workflows/reusable-zap.yml](https://github.com/attested-delivery/.github), [attested-delivery/.github/.github/workflows/reusable-attest-scan.yml](https://github.com/attested-delivery/.github), [attested-delivery/.github/.github/workflows/pin-check.yml](https://github.com/attested-delivery/.github), [actions/setup-node](https://github.com/actions/setup-node), [actions/configure-pages](https://github.com/actions/configure-pages), [actions/deploy-pages](https://github.com/actions/deploy-pages), [attested-delivery/.github/.github/workflows/reusable-sca-osv.yml](https://github.com/attested-delivery/.github), [attested-delivery/.github/.github/workflows/reusable-scorecard.yml](https://github.com/attested-delivery/.github) and [attested-delivery/.github/.github/workflows/reusable-trivy.yml](https://github.com/attested-delivery/.github) to permit the latest version. Updates `actions/checkout` from 4.2.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@11bd719...9c091bb) Updates `actions/attest-build-provenance` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...0f67c3f) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `attested-delivery/.github/.github/workflows/reusable-zap.yml` from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](attested-delivery/.github@698148e...ee1f93b) Updates `attested-delivery/.github/.github/workflows/reusable-attest-scan.yml` from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](attested-delivery/.github@698148e...ee1f93b) Updates `attested-delivery/.github/.github/workflows/pin-check.yml` to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](https://github.com/attested-delivery/.github/commits/ee1f93b566abc109efa0588d3d5308b4dd4a7492) Updates `actions/setup-node` from 4.4.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@49933ea...48b55a0) Updates `actions/configure-pages` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/configure-pages/releases) - [Commits](actions/configure-pages@983d773...45bfe01) Updates `actions/deploy-pages` from 4.0.5 to 5.0.0 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](actions/deploy-pages@d6db901...cd2ce8f) Updates `attested-delivery/.github/.github/workflows/reusable-sca-osv.yml` from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](attested-delivery/.github@698148e...ee1f93b) Updates `attested-delivery/.github/.github/workflows/reusable-scorecard.yml` from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](attested-delivery/.github@698148e...ee1f93b) Updates `attested-delivery/.github/.github/workflows/reusable-trivy.yml` from 698148e12da113cfeeef8742c31ae93657959e67 to ee1f93b566abc109efa0588d3d5308b4dd4a7492 - [Release notes](https://github.com/attested-delivery/.github/releases) - [Commits](attested-delivery/.github@698148e...ee1f93b) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/configure-pages dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/deploy-pages dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/pin-check.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-attest-scan.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-sca-osv.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-scorecard.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-trivy.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions - dependency-name: attested-delivery/.github/.github/workflows/reusable-zap.yml dependency-version: ca91728c87beb08742325b4ed4d06fcfb261435b dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 2, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-5e343cbac5 branch from 1525f74 to 751a0b2 Compare July 15, 2026 16:52

zircote merged commit 19310d8 into main Jul 15, 2026
9 checks passed

dependabot Bot deleted the dependabot/github_actions/actions-5e343cbac5 branch July 15, 2026 17:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: bump the actions group across 1 directory with 12 updates - #7

ci: bump the actions group across 1 directory with 12 updates#7
zircote merged 1 commit into
mainfrom
dependabot/github_actions/actions-5e343cbac5

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

v6.0.1

What's Changed

v6.0.0

What's Changed

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.1.1

What's Changed

v7.0.1

What's Changed

v7.0.0

v7 What's new

Direct Uploads

ESM

What's Changed

New Contributors

v6.0.0

v6 - What's new

Node.js 24

What's Changed

v5.0.0

What's Changed

v6.4.0

What's Changed

Dependency updates:

New Contributors

v6.3.0

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

v6.2.0

What's Changed

Documentation

Dependency updates:

New Contributors

v6.0.0

Changelog

v5.0.0

Changelog

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 2, 2026 •

edited

Loading