KEMBAR78
Bump actions/attest-build-provenance from 2.1.0 to 2.2.0 by dependabot[bot] · Pull Request #10300 · cli/cli · GitHub
Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 23, 2025

Bumps actions/attest-build-provenance from 2.1.0 to 2.2.0.

Release notes

Sourced from actions/attest-build-provenance's releases.

v2.2.0

What's Changed

Full Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0

Commits
  • 520d128 bump actions/attest from v2.1.0 to v2.2.0 (#449)
  • 5d2ced9 Add example of upload-artifaction integration (#450)
  • 3c016c1 bump actions/attest from v2.1.0 to v2.2.0 (#449)
  • e06bbaf Bump the npm-development group with 3 updates (#447)
  • 47c6e87 Bump the npm-development group with 4 updates (#444)
  • c083b46 Bump the npm-development group with 2 updates (#438)
  • 1b4b366 Bump typescript-eslint in the npm-development group (#434)
  • 963f8a0 Bump the npm-development group with 2 updates (#429)
  • 4ecada3 Bump the npm-development group across 1 directory with 3 updates (#422)
  • f4b7552 bump eslint from 8.57.1 to 9.16.0 (#418)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@7668571...520d128)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team as a code owner January 23, 2025 14:53
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jan 23, 2025
@dependabot dependabot bot requested a review from BagToad January 23, 2025 14:53
@williammartin williammartin merged commit c33275a into trunk Jan 24, 2025
@williammartin williammartin deleted the dependabot/github_actions/actions/attest-build-provenance-2.2.0 branch January 24, 2025 10:59
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Feb 4, 2025
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.65.0` -> `v2.66.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.66.1`](https://github.com/cli/cli/releases/tag/v2.66.1): GitHub CLI 2.66.1

[Compare Source](cli/cli@v2.66.0...v2.66.1)

#### Hotfix: `gh pr view` fails with provided URL

This addresses a regression in `gh pr view` was reported in [#&#8203;10352](cli/cli#10352). This regression was due to a change in `v2.66.0` that no longer allowed `gh pr` subcommands to execute properly outside of a git repo.

#### What's Changed

-   Hotfix: `gh pr view` fails with provided URL by [@&#8203;jtmcg](https://github.com/jtmcg) in cli/cli#10354

**Full Changelog**: cli/cli@v2.66.0...v2.66.1

### [`v2.66.0`](https://github.com/cli/cli/releases/tag/v2.66.0): GitHub CLI 2.66.0

[Compare Source](cli/cli@v2.65.0...v2.66.0)

#### `gh pr view` and `gh pr status` now respect common triangular workflow configurations

Previously, `gh pr view` and `gh pr status` would fail for pull request's (MR) open in triangular workflows. This was due to `gh` being unable to identify the MR's corresponding remote and branch refs on GitHub.

Now, `gh pr view` and `gh pr status` should successfully identify the MR's refs when the following common git configurations are used:

-   [`branch.<branchName>.pushremote`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-branchltnamegtpushRemote) is set
-   [`remote.pushDefault`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-remotepushDefault) is set

Branch specific configuration, the former, supersedes repo specific configuration, the latter.

Additionally, if the [`@{push}` revision syntax](https://git-scm.com/docs/gitrevisions#Documentation/gitrevisions.txt-emltbranchnamegtpushemegemmasterpushemempushem) for git resolves for a branch, `gh pr view` and `gh pr status` should work regardless of additional config settings.

For more information, see

-   cli/cli#9363
-   cli/cli#9364
-   cli/cli#9365
-   cli/cli#9374

#### `gh secret list`, `gh secret set`, and `gh secret delete` now require repository selection when multiple `git` remotes are present

Previously, `gh secret list`, `gh secret set`, and `gh secret delete` would determine which remote to target for interacting with GitHub Actions secrets.  Remotes marked as default using `gh repo set-default` or through other `gh` commands had higher priority when figuring out which repository to interact with.  This could have unexpected outcomes when using `gh secret` commands with forked repositories as the upstream repository would generally be selected.

Now, `gh secret` commands require users to disambiguate which repository should be the target if multiple remotes are present and the `-R, --repo` flag is not provided.

For more information, see cli/cli#4688

#### Extension update notices now notify once every 24 hours per extension and can be disabled

Previously, the GitHub CLI would notify users about newer versions every time an extension was executed.  This did not match GitHub CLI notices, which only notified users once every 24 hours and could be disabled through an environment variable.

Now, extension update notices will behave similar to GitHub CLI notices.  To disable extension update notices, set the `GH_NO_EXTENSION_UPDATE_NOTIFIER` environment variable.

For more information, see cli/cli#9925

#### What's Changed

##### ✨ Features

-   Draft for discussing testing around extension update checking behavior by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#9985
-   Make extension update check non-blocking by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#10239
-   Ensure extension update notices only notify once within 24 hours, provide ability to disable all extension update notices by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#9934
-   feat: make the extension upgrade fancier by [@&#8203;nobe4](https://github.com/nobe4) in cli/cli#10194
-   fix: padded display by [@&#8203;nobe4](https://github.com/nobe4) in cli/cli#10216
-   Update `gh attestation` attestation bundle fetching logic by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10185
-   Require repo disambiguation for secret commands by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10209
-   show error message for rerun workflow older than a month ago by [@&#8203;iamrajhans](https://github.com/iamrajhans) in cli/cli#10227
-   Update `gh attestation verify` table output by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10104
-   Enable MSI building for Windows arm64 by [@&#8203;dennisameling](https://github.com/dennisameling) in cli/cli#10297
-   feat: Add support for creating autolink references by [@&#8203;hoffm](https://github.com/hoffm) in cli/cli#10180
-   Find MRs using `@{push}` by [@&#8203;Frederick888](https://github.com/Frederick888) in cli/cli#9208
-   feat: Add support for viewing autolink references by [@&#8203;hoffm](https://github.com/hoffm) in cli/cli#10324
-   Update `gh attestation` bundle fetching logic by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10339

##### 🐛 Fixes

-   gh gist delete: prompt for gist id by [@&#8203;danochoa](https://github.com/danochoa) in cli/cli#10154
-   Better handling for waiting for codespaces to become ready by [@&#8203;cmbrose](https://github.com/cmbrose) in cli/cli#10198
-   Fix: `gh gist view` and `gh gist edit` prompts with no TTY by [@&#8203;mateusmarquezini](https://github.com/mateusmarquezini) in cli/cli#10048
-   Remove naked return values from `ReadBranchConfig` and `prSelectorForCurrentBranch` by [@&#8203;jtmcg](https://github.com/jtmcg) in cli/cli#10197
-   Add job to deployment workflow to validate the tag name for a given release by [@&#8203;jtmcg](https://github.com/jtmcg) in cli/cli#10121
-   \[gh run list] Stop progress indicator on failure from `--workflow` flag by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10323
-   Update deployment.yml by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#10340

##### 📚 Docs & Chores

-   Add affected version heading to bug report issue form by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10269
-   chore: fix some comments by [@&#8203;petercover](https://github.com/petercover) in cli/cli#10296
-   Update triage.md to reflect FR experiment outcome by [@&#8203;jtmcg](https://github.com/jtmcg) in cli/cli#10196
-   Clear up --with-token fine grained PAT usage by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10186
-   Correct help documentation around template use in `gh issue create` by [@&#8203;andyfeller](https://github.com/andyfeller) in cli/cli#10208
-   chore: fix some function names in comment by [@&#8203;zhuhaicity](https://github.com/zhuhaicity) in cli/cli#10225
-   Tiny typo fix by [@&#8203;robmorgan](https://github.com/robmorgan) in cli/cli#10265
-   add install instructions for Manjaro Linux by [@&#8203;AMS21](https://github.com/AMS21) in cli/cli#10236
-   Update test to be compatible with latest Glamour v0.8.0 by [@&#8203;ottok](https://github.com/ottok) in cli/cli#10151
-   Add more `gh attestation verify` integration tests by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10102

##### :dependabot: Dependencies

-   Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10215
-   Bump github.com/sigstore/protobuf-specs from 0.3.2 to 0.3.3 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10214
-   Bump github.com/gabriel-vasile/mimetype from 1.4.7 to 1.4.8 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10184
-   Bump google.golang.org/protobuf from 1.36.2 to 1.36.3 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10250
-   Bump golangci-linter and address failures to prepare for Go 1.24 strictness by [@&#8203;mikelolasagasti](https://github.com/mikelolasagasti) in cli/cli#10279
-   Bump github.com/google/go-containerregistry from 0.20.2 to 0.20.3 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10257
-   Bump actions/attest-build-provenance from 2.1.0 to 2.2.0 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10300
-   Bump google.golang.org/protobuf from 1.36.3 to 1.36.4 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10306
-   Upgrade sigstore-go to v0.7.0: fixes [#&#8203;10114](cli/cli#10114) formatting issue by [@&#8203;codysoyland](https://github.com/codysoyland) in cli/cli#10309
-   Bump github.com/in-toto/attestation from 1.1.0 to 1.1.1 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10319

#### New Contributors

Big thank you to our many new *and* longtime contributors making this release happen!! ❤️ ✨

-   [@&#8203;zhuhaicity](https://github.com/zhuhaicity) made their first contribution in cli/cli#10225
-   [@&#8203;danochoa](https://github.com/danochoa) made their first contribution in cli/cli#10154
-   [@&#8203;robmorgan](https://github.com/robmorgan) made their first contribution in cli/cli#10265
-   [@&#8203;iamrajhans](https://github.com/iamrajhans) made their first contribution in cli/cli#10227
-   [@&#8203;AMS21](https://github.com/AMS21) made their first contribution in cli/cli#10236
-   [@&#8203;petercover](https://github.com/petercover) made their first contribution in cli/cli#10296
-   [@&#8203;ottok](https://github.com/ottok) made their first contribution in cli/cli#10151
-   [@&#8203;dennisameling](https://github.com/dennisameling) made their first contribution in cli/cli#10297
-   [@&#8203;iamazeem](https://github.com/iamazeem) made their first contribution in cli/cli#10323
-   [@&#8203;Frederick888](https://github.com/Frederick888) made their first contribution in cli/cli#9208

**Full Changelog**: cli/cli@v2.65.0...v2.66.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNDMuMCIsInVwZGF0ZWRJblZlciI6IjM5LjE0Ni40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant