Skip to content

chore(deps): update github actions monthly minor/patch#172

Merged
renovate[bot] merged 1 commit intomainfrom
renovate/github-actions-monthly-minorpatch
Jan 1, 2026
Merged

chore(deps): update github actions monthly minor/patch#172
renovate[bot] merged 1 commit intomainfrom
renovate/github-actions-monthly-minorpatch

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 1, 2026

This PR contains the following updates:

Package Type Update Change
actions/attest-build-provenance action minor v3.0.0v3.1.0
actions/checkout action patch v6.0.0v6.0.1
anchore/sbom-action action minor v0.20.10v0.21.0
docker/setup-buildx-action action minor v3.11.1v3.12.0
github/codeql-action action patch v4.31.6v4.31.9
rhysd/actionlint docker patch 1.7.01.7.10
tj-actions/changed-files action patch v47.0.0v47.0.1

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v3.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

actions/checkout (actions/checkout)

v6.0.1

Compare Source

anchore/sbom-action (anchore/sbom-action)

v0.21.0

Compare Source

v0.20.11

Compare Source

Changes in v0.20.11

docker/setup-buildx-action (docker/setup-buildx-action)

v3.12.0

Compare Source

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

github/codeql-action (github/codeql-action)

v4.31.9

Compare Source

v4.31.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025
  • Update default CodeQL bundle version to 2.23.8. #​3354

See the full CHANGELOG.md for more information.

v4.31.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.7 - 05 Dec 2025
  • Update default CodeQL bundle version to 2.23.7. #​3343

See the full CHANGELOG.md for more information.

tj-actions/changed-files (tj-actions/changed-files)

v47.0.1

Compare Source

What's Changed

Full Changelog: tj-actions/changed-files@v47...v47.0.1


Configuration

📅 Schedule: Branch creation - "on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jan 1, 2026
@github-actions
Copy link

github-actions bot commented Jan 1, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/attest-build-provenance 00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 UnknownUnknown
actions/actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/anchore/sbom-action a930d0ac434e3182448fe678398ba5713717112a 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 9binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Vulnerabilities⚠️ 28 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
actions/docker/setup-buildx-action 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f 🟢 4.5
Details
CheckScoreReason
Maintained🟢 54 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 2Found 2/7 approved changesets -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Vulnerabilities⚠️ 010 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
actions/actions/attest-build-provenance 00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 UnknownUnknown
actions/actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/anchore/sbom-action a930d0ac434e3182448fe678398ba5713717112a 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 9binaries present in source code
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Vulnerabilities⚠️ 28 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
actions/docker/setup-buildx-action 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f 🟢 4.5
Details
CheckScoreReason
Maintained🟢 54 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 5
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 2Found 2/7 approved changesets -- score normalized to 2
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Vulnerabilities⚠️ 010 existing vulnerabilities detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
actions/actions/checkout 8e8c483db84b4bee98b60c0593521ed34d9990e8 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits

Scanned Files

  • .github/workflows/drush-alias-image.yaml
  • .github/workflows/logs-dispatcher-image.yaml
  • .github/workflows/release-tracker.yaml

@renovate renovate bot merged commit c9d0dce into main Jan 1, 2026
14 checks passed
@renovate renovate bot deleted the renovate/github-actions-monthly-minorpatch branch January 1, 2026 10:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants