Bump the github-actions-updates group with 4 updates - #35
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps the github-actions-updates group with 4 updates: [lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml](https://github.com/lfreleng-actions/github2gerrit-action), [step-security/harden-runner](https://github.com/step-security/harden-runner), [lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml](https://github.com/lfreleng-actions/security-workflows) and [lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml](https://github.com/lfit/releng-reusable-workflows). Updates `lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml` from 2.0.0 to 2.1.0 - [Release notes](https://github.com/lfreleng-actions/github2gerrit-action/releases) - [Commits](lfreleng-actions/github2gerrit-action@f44ab26...3d548cc) Updates `step-security/harden-runner` from 2.21.0 to 2.21.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@05e3151...e14015d) Updates `lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml` from 0.3.0 to 0.5.1 - [Release notes](https://github.com/lfreleng-actions/security-workflows/releases) - [Commits](lfreleng-actions/security-workflows@5882f13...b2d87d2) Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.10.2 to 0.10.3 - [Release notes](https://github.com/lfit/releng-reusable-workflows/releases) - [Commits](lfit/releng-reusable-workflows@dd7e7f1...87eacd1) --- updated-dependencies: - dependency-name: lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-updates - dependency-name: step-security/harden-runner dependency-version: 2.21.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-updates - dependency-name: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml dependency-version: 0.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-updates - dependency-name: lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml dependency-version: 0.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
PR: #35 Note: This metadata is also included in the Gerrit commit message for reconciliation. |
|
Change raised in Gerrit by GitHub2Gerrit: https://gerrit.onap.org/r/c/policy/api/+/147320 |
onap-github
pushed a commit
that referenced
this pull request
Sep 3, 2026
Bumps the github-actions-updates group with 4 updates: lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml, step-security/harden-runner, lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml. Updates `lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml` from 2.0.0 to 2.1.0 ## Release notes Sourced from lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml's releases. v2.1.0 ✨ New Features ✨ Feat: Gate fork PR transfer on maintainer approval @ModeSevenIndustrialSolutions (#390) 🐛 Bug Fixes 🐛 Fix: Authorise @github2gerrit comment directives @ModeSevenIndustrialSolutions (#389) 🔧 Maintenance 🔧 Chore: pre-commit autoupdate @pre-commit-ci[bot] (#388) Links Submit bugs/feature requests ## Commits 3d548cc Merge pull request #390 from modeseven-lfreleng-actions/feat/fork-approval-gate bfdb90e Fix: Address Copilot review feedback b65bf61 Feat: Gate fork PR transfer on maintainer approval a485b30 Merge pull request #389 from modeseven-lfreleng-actions/fix/pr-command-author 411afac Fix: Authorise @github2gerrit comment directives 9d659e2 Merge pull request #388 from lfreleng-actions/pre-commit-ci-update-config da33e11 Chore: pre-commit autoupdate See full diff in compare view Updates `step-security/harden-runner` from 2.21.0 to 2.21.1 ## Release notes Sourced from step-security/harden-runner's releases. v2.21.1 What's Changed Improved performance of the disable-sudo feature. Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode. Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners. Documentation updates: clarified which features are in the Community (free) vs Enterprise tier. Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1 ## Commits e14015d Merge pull request #690 from step-security/rc-43 9001249 docs: update harden-runner version pin to v2.21.0 in getting started example a447fba docs: expand enterprise feature list and document custom VM and ubuntu-slim l b0eaf8d docs: clarify community vs enterprise tiers and add maintained actions section 063e8e3 Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallback f46bdc1 chore: bump agent-ebpf to v1.9.1 and agent to v0.16.3 42e6daa fix: fall back to /bin/echo for non-usr-merged distros See full diff in compare view Updates `lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml` from 0.3.0 to 0.5.1 ## Release notes Sourced from lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml's releases. v0.5.1 🐛 Bug Fixes 🐛 Fix: Bump maven-build-action to v0.4.1 @askb (#79) Links Submit bugs/feature requests v0.5.0 ✨ New Features ✨ Feat: Audit examples/ with actionlint and zizmor @ModeSevenIndustrialSolutions (#71) 🐛 Bug Fixes 🐛 Fix: Close CLM checkout gap and record audit evidence @ModeSevenIndustrialSolutions (#73) Links Submit bugs/feature requests v0.4.0 ✨ New Features ✨ Feat: Expose jacoco_mode so callers can share execution data @askb (#72) Links Submit bugs/feature requests v0.3.1 🐛 Bug Fixes 🐛 Chore: Bump action pins to their latest releases @askb (#53) 🔧 Maintenance 🔧 Chore: pre-commit autoupdate @pre-commit-ci[bot] (#52) CI(actions): Bump step-security/harden-runner from 2.20.1 to 2.21.0 @dependabot[bot] (#62) CI(actions): Bump github/codeql-action/analyze from 4.37.6 to 4.37.7 @dependabot[bot] (#63) CI(actions): Bump github/codeql-action/init from 4.37.6 to 4.37.7 @dependabot[bot] (#64) CI(actions): Bump lfreleng-actions/harden-runner-block-action from 0.2.1 to 0.3.0 @dependabot[bot] (#65) CI(actions): Bump lfreleng-actions/generic-workflows/.github/workflows/release.yaml from 0.0.4 to 0.0.5 @dependabot[bot] (#66) CI(actions): Bump lfreleng-actions/generic-workflows/.github/workflows/clear-action-cache.yaml from 0.0.4 to 0.0.5 @dependabot[bot] (#67) ... (truncated) ## Commits b2d87d2 Merge pull request #79 from lfreleng-actions/fix/bump-maven-build-action-v0.4.1 a7a0b55 Fix: Bump maven-build-action to v0.4.1 9219040 Merge pull request #73 from modeseven-lfreleng-actions/fix/lane-parity-and-go 937e05b Merge pull request #71 from modeseven-lfreleng-actions/feat/audit-examples 4053dba Fix: Address Copilot review feedback 48eb830 Docs: Record what callers set for the dropped inputs f0507f1 Docs: Show the Go path in the Gerrit CLM example 9e05a29 Docs: Name the CLM callers behind the cohesion claim 8ca2d35 Fix: Accept fetch_depth and submodules for CLM 6ee0886 Merge pull request #72 from lfreleng-actions/feat/jacoco-mode-input Additional commits viewable in compare view Updates `lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml` from 0.10.2 to 0.10.3 ## Release notes Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases. v0.10.3 🔧 Maintenance 🔧 Chore: Bump harden-runner allow-list to v0.16.0 @ModeSevenIndustrialSolutions (#879) Chore: Bump lfreleng-actions/harden-runner-block-action from 0.2.1 to 0.12.1 @dependabot[bot] (#868) Chore: Bump lfreleng-actions/draft-release-promote-action from 0.1.4 to 0.1.5 @dependabot[bot] (#869) Chore: Bump lfreleng-actions/tox-run-action from 0.1.2 to 0.1.3 @dependabot[bot] (#866) Chore: Bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.8 @dependabot[bot] (#870) Chore: Bump 1password/load-secrets-action from 5.0.0 to 5.0.1 @dependabot[bot] (#867) Chore: Bump lfreleng-actions/inject-issue-id-action from 0.1.2 to 0.1.3 @dependabot[bot] (#871) Chore: Bump lfreleng-actions/docker-save-images-action from 0.1.1 to 0.2.0 @dependabot[bot] (#872) Chore: Bump lfreleng-actions/checkout-gerrit-change-action from 1.0.2 to 1.1.0 @dependabot[bot] (#873) Chore: Bump lfreleng-actions/tag-push-verify-action from 0.1.2 to 0.1.3 @dependabot[bot] (#874) Chore: Bump lfreleng-actions/openssf-scorecard-summary-action from 0.1.1 to 0.1.2 @dependabot[bot] (#875) Chore: Bump github/codeql-action/init from 4.37.7 to 4.37.8 @dependabot[bot] (#876) Chore: Bump github/codeql-action/analyze from 4.37.7 to 4.37.8 @dependabot[bot] (#877) Chore: pre-commit linting updates @pre-commit-ci[bot] (#878) Links Submit bugs/feature requests ## Commits 87eacd1 Merge pull request #878 from lfit/pre-commit-ci-update-config e80cc27 Merge pull request #877 from lfit/dependabot/github_actions/github/codeql-act 8cf781e Merge pull request #876 from lfit/dependabot/github_actions/github/codeql-act 9e5b39e Merge pull request #875 from lfit/dependabot/github_actions/lfreleng-actions/ 3d515a0 Merge pull request #874 from lfit/dependabot/github_actions/lfreleng-actions/ 75daab7 Merge pull request #873 from lfit/dependabot/github_actions/lfreleng-actions/ 7b22cd2 Merge pull request #872 from lfit/dependabot/github_actions/lfreleng-actions/ 3d8ec4f Merge pull request #871 from lfit/dependabot/github_actions/lfreleng-actions/ 685f654 Merge pull request #867 from lfit/dependabot/github_actions/1password/load-se ecfca7e Merge pull request #870 from lfit/dependabot/github_actions/github/codeql-act Additional commits viewable in compare view Issue-ID: CIMAN-33 Signed-off-by: dependabot[bot] <support@github.com> Change-Id: I7bc1e1049bef83dddb4f6bf98c1270e7fe2c0ff9 GitHub-PR: #35 GitHub-Hash: eb1467a75d0e22b7 Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>
|
Automated PR Closure This pull request has been automatically closed by GitHub2Gerrit. The corresponding Gerrit change has been accepted and merged ✅ The changes from this PR are now part of the main codebase in Gerrit. This is an automated action performed by the GitHub2Gerrit tool. |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-updates-459935fb78
branch
September 3, 2026 10:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions-updates group with 4 updates: lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml, step-security/harden-runner, lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml and lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml.
Updates
lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yamlfrom 2.0.0 to 2.1.0Release notes
Sourced from lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml's releases.
Commits
3d548ccMerge pull request #390 from modeseven-lfreleng-actions/feat/fork-approval-gatebfdb90eFix: Address Copilot review feedbackb65bf61Feat: Gate fork PR transfer on maintainer approvala485b30Merge pull request #389 from modeseven-lfreleng-actions/fix/pr-command-author...411afacFix: Authorise@github2gerritcomment directives9d659e2Merge pull request #388 from lfreleng-actions/pre-commit-ci-update-configda33e11Chore: pre-commit autoupdateUpdates
step-security/harden-runnerfrom 2.21.0 to 2.21.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
e14015dMerge pull request #690 from step-security/rc-439001249docs: update harden-runner version pin to v2.21.0 in getting started examplea447fbadocs: expand enterprise feature list and document custom VM and ubuntu-slim l...b0eaf8ddocs: clarify community vs enterprise tiers and add maintained actions section063e8e3Merge pull request #687 from rohan-stepsecurity/rp/fix/bin-echo-fallbackf46bdc1chore: bump agent-ebpf to v1.9.1 and agent to v0.16.342e6daafix: fall back to/bin/echofor non-usr-merged distrosUpdates
lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yamlfrom 0.3.0 to 0.5.1Release notes
Sourced from lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml's releases.
... (truncated)
Commits
b2d87d2Merge pull request #79 from lfreleng-actions/fix/bump-maven-build-action-v0.4.1a7a0b55Fix: Bump maven-build-action to v0.4.19219040Merge pull request #73 from modeseven-lfreleng-actions/fix/lane-parity-and-go...937e05bMerge pull request #71 from modeseven-lfreleng-actions/feat/audit-examples4053dbaFix: Address Copilot review feedback48eb830Docs: Record what callers set for the dropped inputsf0507f1Docs: Show the Go path in the Gerrit CLM example9e05a29Docs: Name the CLM callers behind the cohesion claim8ca2d35Fix: Accept fetch_depth and submodules for CLM6ee0886Merge pull request #72 from lfreleng-actions/feat/jacoco-mode-inputUpdates
lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yamlfrom 0.10.2 to 0.10.3Release notes
Sourced from lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml's releases.
Commits
87eacd1Merge pull request #878 from lfit/pre-commit-ci-update-confige80cc27Merge pull request #877 from lfit/dependabot/github_actions/github/codeql-act...8cf781eMerge pull request #876 from lfit/dependabot/github_actions/github/codeql-act...9e5b39eMerge pull request #875 from lfit/dependabot/github_actions/lfreleng-actions/...3d515a0Merge pull request #874 from lfit/dependabot/github_actions/lfreleng-actions/...75daab7Merge pull request #873 from lfit/dependabot/github_actions/lfreleng-actions/...7b22cd2Merge pull request #872 from lfit/dependabot/github_actions/lfreleng-actions/...3d8ec4fMerge pull request #871 from lfit/dependabot/github_actions/lfreleng-actions/...685f654Merge pull request #867 from lfit/dependabot/github_actions/1password/load-se...ecfca7eMerge pull request #870 from lfit/dependabot/github_actions/github/codeql-act...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions