mirror of
https://github.com/fluxcd/flux2.git
synced 2026-02-13 11:17:30 +00:00
1993737b6d
Bumps the ci group with 5 updates: | Package | From | To | | --- | --- | --- | | [fluxcd/pkg](https://github.com/fluxcd/pkg) | `1.22.0` | `1.23.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `5.0.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.30.5` | `4.31.2` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.6` | `0.20.9` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.10.0` | `4.0.0` | Updates `fluxcd/pkg` from 1.22.0 to 1.23.0 - [Commits](bf02f0a2d6...413a95f34f) Updates `actions/upload-artifact` from 4.6.2 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](ea165f8d65...330a01c490) Updates `github/codeql-action` from 3.30.5 to 4.31.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](3599b3baa1...0499de31b9) Updates `anchore/sbom-action` from 0.20.6 to 0.20.9 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](f8bdd1d8ac...8e94d75ddd) Updates `sigstore/cosign-installer` from 3.10.0 to 4.0.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](d7543c93d8...faadad0cce) --- updated-dependencies: - dependency-name: fluxcd/pkg dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: github/codeql-action dependency-version: 4.31.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: anchore/sbom-action dependency-version: 0.20.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: sigstore/cosign-installer dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>
39 lines
1.1 KiB
YAML
39 lines
1.1 KiB
YAML
name: ossf
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
# Weekly on Saturdays.
|
|
- cron: '30 1 * * 6'
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
scorecard:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
id-token: write
|
|
actions: read
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
- name: Run analysis
|
|
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
with:
|
|
results_file: results.sarif
|
|
results_format: sarif
|
|
repo_token: ${{ secrets.GITHUB_TOKEN }}
|
|
publish_results: true
|
|
- name: Upload artifact
|
|
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
|
|
with:
|
|
name: SARIF file
|
|
path: results.sarif
|
|
retention-days: 5
|
|
- name: Upload SARIF results
|
|
uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
|
|
with:
|
|
sarif_file: results.sarif
|