From 7cef6cd08d030d3cc0459ca187caa2cb35aa6416 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:37:28 +0000 Subject: [PATCH] Bump the ci group with 2 updates Bumps the ci group with 2 updates: [docker/github-builder/.github/workflows/build.yml](https://github.com/docker/github-builder) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `docker/github-builder/.github/workflows/build.yml` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/docker/github-builder/releases) - [Commits](https://github.com/docker/github-builder/compare/a492c6d04fd3315f67230809b44d60cc0acd50b3...58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a) Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.37.8 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) --- updated-dependencies: - dependency-name: docker/github-builder/.github/workflows/build.yml dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci ... Signed-off-by: dependabot[bot] --- .github/workflows/open-pr.yml | 2 +- .github/workflows/push-tag.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/open-pr.yml b/.github/workflows/open-pr.yml index d3671fe..de98374 100644 --- a/.github/workflows/open-pr.yml +++ b/.github/workflows/open-pr.yml @@ -80,7 +80,7 @@ jobs: write-comment: true github-token: ${{ secrets.GITHUB_TOKEN }} multi-arch-build: - uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 + uses: docker/github-builder/.github/workflows/build.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0 with: output: image push: false diff --git a/.github/workflows/push-tag.yml b/.github/workflows/push-tag.yml index b9a6585..bc17832 100644 --- a/.github/workflows/push-tag.yml +++ b/.github/workflows/push-tag.yml @@ -7,7 +7,7 @@ permissions: contents: read # to fetch the repository content jobs: build-push: - uses: docker/github-builder/.github/workflows/build.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 + uses: docker/github-builder/.github/workflows/build.yml@58cb9f5b71b1836d6f690c1e95effdeb9b98cb8a # v1.17.0 permissions: id-token: write # to sign attestation(s) with GitHub OIDC Token packages: write # to push container image to ghcr @@ -60,7 +60,7 @@ jobs: summary: true image: registry://ghcr.io/${{ github.repository_owner }}/my-sample-workload:${{ github.ref_name }} - name: Upload SARIF report - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: sarif_file: sarif.output.json