Skip to content

ci(deps): bump the actions-minor-patch group across 1 directory with 2 updates#309

Merged
1 commit merged intodevfrom
dependabot/github_actions/dev/actions-minor-patch-29bb5d88da
Mar 13, 2026
Merged

ci(deps): bump the actions-minor-patch group across 1 directory with 2 updates#309
1 commit merged intodevfrom
dependabot/github_actions/dev/actions-minor-patch-29bb5d88da

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 13, 2026

Bumps the actions-minor-patch group with 2 updates in the / directory: sigstore/cosign-installer and anchore/sbom-action.

Updates sigstore/cosign-installer from 4.0.0 to 4.1.0

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

Commits

Updates anchore/sbom-action from 0.22.2 to 0.23.1

Release notes

Sourced from anchore/sbom-action's releases.

v0.23.1

⬆️ Dependencies

v0.23.0

Commits
  • 57aae52 chore(deps): update Syft to v1.42.2 (#607)
  • c29e913 chore(deps): bump fast-xml-parser and other deps (#604)
  • 17ae174 chore(deps/test): move to es modules, node:test, single dist file (#595)
  • 6d473d3 chore(deps): update Syft to v1.42.1 (#599)
  • 60619e7 fix tests and bump fast-xml-parser (#598)
  • e2bd58a chore(deps-dev): bump the dev-dependencies group with 3 updates (#592)
  • d032d7d ci(syft auto update): npm ci, not npm install (#597)
  • 2d09430 fix(dev): switch to esbuild (#590)
  • 74c5ce9 chore(deps): update Syft to v1.42.0 (#589)
  • 77fae5a chore(deps-dev): bump the dev-dependencies group with 4 updates (#583)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci(deps): bump the actions-minor-patch group across 1 directory with …
348d5d9 
…2 updates

Bumps the actions-minor-patch group with 2 updates in the / directory: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) and [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `sigstore/cosign-installer` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](sigstore/cosign-installer@faadad0...ba7bc0a)

Updates `anchore/sbom-action` from 0.22.2 to 0.23.1
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@28d7154...57aae52)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
- dependency-name: anchore/sbom-action
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from c-vigo as a code owner March 13, 2026 16:36
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 13, 2026
@c-vigo c-vigo mentioned this pull request Mar 13, 2026
Merged
@c-vigo c-vigo closed this pull request by merging all changes into dev in 4d1d7ac Mar 13, 2026
@c-vigo c-vigo deleted the dependabot/github_actions/dev/actions-minor-patch-29bb5d88da branch March 13, 2026 17:27
This was referenced Mar 17, 2026
Open
Merged
vig-os-release-app bot added a commit to vig-os/devcontainer-smoke-test that referenced this pull request Mar 23, 2026
@vig-os-release-app
chore: release 0.3.1 (#70)
8449869 
## Release 0.3.1

This PR prepares release 0.3.1 for merge to main.

### Release Content

## [0.3.1] - TBD

### Added

- **Split downstream release workflow with project-owned extension
hook** ([#326](vig-os/devcontainer#326))
- Add local `workflow_call` release phases (`release-core.yml`,
`release-publish.yml`) and a lightweight `release.yml` orchestrator in
`assets/workspace/.github/workflows/`
- Add `release_kind` support with candidate mode (`X.Y.Z-rcN`) and final
mode (`X.Y.Z`) in downstream release workflows
- Candidate mode now auto-computes the next RC tag, skips CHANGELOG
finalization/sync-issues, and publishes a GitHub pre-release
- Add project-owned `release-extension.yml` stub and preserve it during
`init-workspace.sh --force` upgrades
- Add `validate-contract` composite action for single-source contract
version validation
- Add downstream release contract documentation and GHCR extension
example in `docs/DOWNSTREAM_RELEASE.md`

### Changed

- **Dependabot dependency update batch**
([#302](vig-os/devcontainer#302),
[#303](vig-os/devcontainer#303),
[#305](vig-os/devcontainer#305),
[#306](vig-os/devcontainer#306),
[#307](vig-os/devcontainer#307),
[#308](vig-os/devcontainer#308),
[#309](vig-os/devcontainer#309))
- Bump `@devcontainers/cli` from `0.81.1` to `0.84.0` and `bats-assert`
from `v2.2.0` to `v2.2.4`
- Bump GitHub Actions: `actions/download-artifact` (`4.3.0` -> `8.0.1`),
`actions/github-script` (`7.1.0` -> `8.0.0`),
`actions/attest-build-provenance` (`3.0.0` -> `4.1.0`),
`actions/checkout` (`4.3.1` -> `6.0.2`)
- Bump release workflow action pins: `sigstore/cosign-installer`
(`4.0.0` -> `4.1.0`) and `anchore/sbom-action` (`0.22.2` -> `0.23.1`)
- **Dependabot dependency update batch**
([#314](vig-os/devcontainer#314),
[#315](vig-os/devcontainer#315),
[#316](vig-os/devcontainer#316),
[#317](vig-os/devcontainer#317))
- Bump GitHub Actions: `actions/attest-sbom` (`3.0.0` -> `4.0.0`),
`actions/upload-artifact` (`4.6.2` -> `7.0.0`),
`actions/create-github-app-token` (`2.2.1` -> `3.0.0`)
  - Bump `docker/login-action` from `3.7.0` to `4.0.0`
  - Bump `just` minor version from `1.46` to `1.47`
- **Node24-ready GitHub Actions pin refresh for shared composite
actions** ([#321](vig-os/devcontainer#321))
- Update Docker build path pins in `build-image`
(`docker/setup-buildx-action`, `docker/metadata-action`,
`docker/build-push-action`) to Node24-compatible releases
- Set `setup-env` default Node runtime to `24` and upgrade
`actions/setup-node`
- Align test composite actions with newer pins (`actions/checkout`,
`actions/cache`, `actions/upload-artifact`)
- **Smoke-test dispatch payload now carries source run traceability
metadata** ([#289](vig-os/devcontainer#289))
- Candidate release dispatches now include source repo/workflow/run/SHA
metadata plus a deterministic `correlation_id`
- Smoke-test dispatch receiver logs normalized source context, derives
source run URL when possible, and writes it to workflow summary output
- Release-cycle docs now define required vs optional dispatch payload
keys and the future callback contract path for `publish-candidate`
- **Smoke-test repository dispatch now runs for final releases too**
([#173](vig-os/devcontainer#173))
- `release.yml` now triggers the existing smoke-test dispatch contract
for both `candidate` and `final` release kinds
- Final release summaries and release-cycle documentation now reflect
dispatch behavior for both release modes
- **Workspace CI templates now use a single container-based workflow**
([#327](vig-os/devcontainer#327))
- Consolidate `assets/workspace/.github/workflows/ci.yml` as the
canonical CI workflow and remove the obsolete `ci-container.yml`
template
- Extract reusable `assets/workspace/.github/actions/resolve-image` and
run workspace release tests in the same containerized workflow model
- Update smoke-test and release-cycle documentation to reference the
single CI workflow contract
- **Final release now requires downstream RC pre-release gate**
([#331](vig-os/devcontainer#331))
- Add upstream final-release validation that requires a downstream
GitHub pre-release for the latest published RC tag
- Move smoke-test dispatch to a dedicated release job and include
`release_kind` in the dispatch payload
- Add downstream `repository-dispatch.yml` template that runs smoke
tests and creates pre-release/final release artifacts
- **Ship changelog into workspace payload and smoke-test deploy root**
([#333](vig-os/devcontainer#333))
- Sync canonical `CHANGELOG.md` into both workspace root and
`.devcontainer/` template paths
- Smoke-test dispatch now copies `.devcontainer/CHANGELOG.md` to
repository root so deploy output keeps a root changelog
- **Final release now publishes a GitHub Release with finalized notes**
([#310](vig-os/devcontainer#310))
- Add a final-only publish step in `.github/workflows/release.yml` that
creates a GitHub Release for `X.Y.Z`
- Source GitHub Release notes from the finalized `CHANGELOG.md` section
and fail the run if notes extraction or release publishing fails
- **Release dispatch and publish ordering hardened for 0.3.1**
([#336](vig-os/devcontainer#336))
- Make smoke-test dispatch fire-and-forget in
`.github/workflows/release.yml` and decouple rollback from downstream
completion timing
- Add bounded retries to the final-release downstream RC pre-release
gate API check
- Move final GitHub Release creation to the end of publish so artifact
publication/signing completes before release object creation
- Add concurrency control to
`assets/smoke-test/.github/workflows/repository-dispatch.yml` to prevent
overlapping dispatch races
- Handle smoke-test dispatch failures with a targeted issue while
avoiding destructive rollback after publish artifacts are already
released
- **Redesigned smoke-test dispatch release orchestration**
([#358](vig-os/devcontainer#358))
- Replace premature `publish-release` behavior with full downstream
orchestration: deploy-to-dev merge gate, `prepare-release.yml`, release
PR readiness/approval, and `release.yml` dispatch polling
- Add upstream failure issue reporting with job-phase results and
cleanup guidance when dispatch orchestration fails
- **Smoke-test release orchestration now runs as two phases**
([#402](vig-os/devcontainer#402))
- Keep `repository-dispatch.yml` focused on deploy/prepare/release-PR
readiness and move release dispatch to a dedicated merged-PR workflow
(`on-release-pr-merge.yml`)
- Add release-kind labeling and auto-merge enablement for release PRs,
and keep upstream failure notifications in both phases
- Remove release-branch upstream `CHANGELOG.md` sync from
`repository-dispatch.yml` (previously added in
[#358](vig-os/devcontainer#358))
- **Dependabot dependency update batch**
([#414](vig-os/devcontainer#414))
- Bump `github/codeql-action` from `4.32.6` to `4.34.1` and
`anchore/sbom-action` from `0.23.1` to `0.24.0`
- Bump `actions/cache` restore/save pins from `5.0.3` to `5.0.4` in
`sync-issues.yml`
- **Dependabot dependency update batch**
([#413](vig-os/devcontainer#413))
  - Bump `@devcontainers/cli` from `0.84.0` to `0.84.1`

### Fixed

- **Smoke-test deploy restores workspace CHANGELOG for prepare-release**
([#417](vig-os/devcontainer#417))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@c-vigo c-vigo Awaiting requested review from c-vigo c-vigo is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@c-vigo