chore(deps): bump the github-actions group across 1 directory with 8 updates - #806
Merged
Marcel Bindseil (bindsi) merged 1 commit intoSep 17, 2026
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
security
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #806 +/- ##
=======================================
Coverage 31.79% 31.79%
=======================================
Files 40 40
Lines 6017 6017
=======================================
Hits 1913 1913
Misses 4104 4104
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-c366e5d05d
branch
from
September 14, 2026 16:14
7bfe800 to
2786b60
Compare
Marcel Bindseil (bindsi)
approved these changes
Sep 16, 2026
Marcel Bindseil (bindsi)
left a comment
Marcel Bindseil (bindsi)
left a comment
Member
There was a problem hiding this comment.
Thanks for the action updates. Reviewed the 12-workflow diff: SHA pinning, inputs, and permissions are preserved; the repository deny-all workflow-permissions validator passed all 36 workflows. Failed checks are unrelated to these action patches: Cargo Audit reports existing rustls RUSTSEC-2026-0285 (upgrade to >=0.23.45), and three Rust scan jobs failed with HTTP 500 while downloading Grype before scanning. Code approved; fix the affected lockfiles and rerun the failed scans before merging, without bypassing the required gate.
29 tasks
Marcel Bindseil (bindsi)
added a commit
that referenced
this pull request
Sep 16, 2026
# Pull Request > **IMPORTANT:** Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed. ## Description <!-- Provide a detailed description of the changes in this PR --> Upgrade the HTTP broker and media-capture service lockfiles to `rustls 0.23.45` to resolve [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285). This addresses the shared Cargo Audit failure affecting the open Dependabot PRs without weakening the existing audit policy. ## Related Issue <!-- Link to the related issue (Use the format: Fixes #123 or Relates to #123) --> Relates to #793, #798, #802, #806, #807, and #808. These dependency PRs remain separate and must be refreshed and validated after this fix merges. ## Type of Change <!-- What type of change does this PR introduce? Mark relevant options with 'x' --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [x] Component modification or addition - [ ] Documentation update - [ ] CI/CD pipeline change - [ ] Other (please describe): ## Implementation Details <!-- Describe the implementation details and approach taken --> - Update `rustls` from 0.23.40 to 0.23.45 in the HTTP broker and from 0.23.41 to 0.23.45 in media capture. - Update `rustls-webpki` to 0.103.15 in both lockfiles, plus the required broker crypto dependencies `aws-lc-rs 1.18.1` and `aws-lc-sys 0.45.0`. - Generate both updates with `cargo update -p rustls --precise 0.23.45`; leave manifests, application source, and advisory exceptions unchanged. ## Testing Performed <!-- Describe the testing you have performed or plan to perform --> <!-- For bug fixes: A regression test verifies the fix and prevents the issue from recurring --> - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [ ] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](docs/contributing/testing-validation.md)) - [ ] Manual validation - [x] Other: security audit and focused dependency compilation `cargo-audit 0.22.1` with `--deny warnings` passed for all 18 tracked Cargo lockfiles using the unchanged repository `.github/audit.toml` policy. Focused `cargo check --locked` passed for the changed crypto packages in both service dependency graphs. `git diff --check origin/main...HEAD` passed. Full HTTP broker compilation was attempted on macOS but is unavailable there: the unchanged Azure MQTT SDK references Linux-only `TcpTlsRx`/`TcpTlsTx` and TLS constants. Full service builds and tests remain pending in Linux CI; no application test pass is claimed. ## Validation Steps <!-- Provide steps that reviewers should follow to validate your changes --> 1. Run the existing Dependency Audit workflow, retaining its advisory configuration and `--deny warnings` setting. 2. Run the existing Linux Rust service build/test jobs for the HTTP broker and media-capture service. 3. Confirm the required PR Validation Gate succeeds before merging. ## Checklist <!-- Mark relevant options with 'x' --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [ ] I have checked for any sensitive data/tokens that should not be committed - [ ] Lint checks pass (run applicable linters for changed file types) ## Security Review <!-- Required for PRs touching security-sensitive paths: - SECURITY.md - src/000-cloud/010-security-identity/ - deploy/ PRs modifying these paths require the `security-reviewed` label before merge. --> - [ ] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [ ] No new network exposure or public endpoints introduced without justification - [ ] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes <!-- Add any other context about the PR here --> The Checkov/ecdsa finding in #808 and transient Grype download failures in #806 are separate follow-ups. This PR changes only the two affected Rust lockfiles. ## Screenshots (if applicable) <!-- Add screenshots to show the changes, if applicable -->
Member
|
Dependabot (@dependabot) rebase |
…updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.8` | `4.38.0` | | [azure/login](https://github.com/azure/login) | `3.0.1` | `3.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.8` | `4.38.0` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.8` | `4.38.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.8` | `4.38.0` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` | | [actions/deploy-pages](https://github.com/actions/deploy-pages) | `5.0.0` | `5.0.1` | | [chainguard-dev/actions/setup-gitsign](https://github.com/chainguard-dev/actions) | `1.6.33` | `1.6.35` | Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...b96794f) Updates `azure/login` from 3.0.1 to 3.1.0 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@f5d393a...a641126) Updates `github/codeql-action/init` from 4.37.8 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...b96794f) Updates `github/codeql-action/autobuild` from 4.37.8 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...b96794f) Updates `github/codeql-action/analyze` from 4.37.8 to 4.38.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...b96794f) Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@e22c389...3ad7283) Updates `actions/deploy-pages` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/actions/deploy-pages/releases) - [Commits](actions/deploy-pages@cd2ce8f...368f825) Updates `chainguard-dev/actions/setup-gitsign` from 1.6.33 to 1.6.35 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](chainguard-dev/actions@0ffab11...142d22e) --- updated-dependencies: - dependency-name: actions/deploy-pages dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: azure/login dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: chainguard-dev/actions/setup-gitsign dependency-version: 1.6.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-c366e5d05d
branch
from
September 17, 2026 10:35
2786b60 to
03e2546
Compare
Marcel Bindseil (bindsi)
deleted the
dependabot/github_actions/github-actions-c366e5d05d
branch
September 17, 2026 11:12
29 tasks
Marcel Bindseil (bindsi)
added a commit
that referenced
this pull request
Sep 17, 2026
# Pull Request > **IMPORTANT:** Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed. ## Description <!-- Provide a detailed description of the changes in this PR --> Retry transient failures when downloading Grype and its checksum manifest in the Rust vulnerability-scan job. Three jobs in #806 failed on HTTP 500 responses before scanning; this change lets those downloads recover while keeping persistent errors fatal. ## Related Issue <!-- Link to the related issue (Use the format: Fixes #123 or Relates to #123) --> Relates to #806. ## Type of Change <!-- What type of change does this PR introduce? Mark relevant options with 'x' --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [ ] Component modification or addition - [ ] Documentation update - [x] CI/CD pipeline change - [ ] Other (please describe): ## Implementation Details <!-- Describe the implementation details and approach taken --> - Add `--retry 3 --retry-delay 2 --connect-timeout 10 --max-time 30` to both Grype download commands. - Allow up to four attempts per download, with a two-second retry delay, ten-second connection timeout, and thirty-second per-attempt transfer timeout. - Retain curl's transient-error classification and HTTP failure handling. Checksum verification, Grype version, workflow permissions, crate matrix, and scan thresholds are unchanged. ## Testing Performed <!-- Describe the testing you have performed or plan to perform --> <!-- For bug fixes: A regression test verifies the fix and prevents the issue from recurring --> - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [ ] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](docs/contributing/testing-validation.md)) - [ ] Manual validation - [x] Other: focused HTTP behavior checks and workflow validation - Extracted the actual retry options from the YAML installer and verified identical options on both downloads. - Local HTTP checks passed: three HTTP 500 responses followed by success recovered on attempt four; persistent HTTP 500 returned curl exit 22 after four attempts; HTTP 404 returned exit 22 after one attempt. - YAML lint with CI's pinned dependencies, Bash syntax validation, and ShellCheck passed. - Structured comparison confirmed the rest of the workflow is unchanged, including checksum verification and security settings. - Workflow permissions validation passed for all 36 workflows; Rust crate registration passed for all 16 inspected crates. - `git diff --check origin/main...HEAD` passed. No persistent test files were added. Full Rust builds, hosted workflow execution, and an actual GitHub release download were not run as part of this scoped validation. ## Validation Steps <!-- Provide steps that reviewers should follow to validate your changes --> 1. Confirm both Grype downloads use the same retry and timeout options. 2. Verify the checksum command remains before installation and the scan still fails at the existing severity threshold. 3. Require the applicable hosted workflow checks and PR Validation Gate to pass before merging. ## Checklist <!-- Mark relevant options with 'x' --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [ ] I have checked for any sensitive data/tokens that should not be committed - [x] Lint checks pass (run applicable linters for changed file types) ## Security Review <!-- Required for PRs touching security-sensitive paths: - SECURITY.md - src/000-cloud/010-security-identity/ - deploy/ PRs modifying these paths require the `security-reviewed` label before merge. --> - [ ] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [ ] No new network exposure or public endpoints introduced without justification - [ ] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes <!-- Add any other context about the PR here --> This change is limited to `.github/workflows/rust-tests.yml`; it does not alter other installers or add security exceptions. Downloads that cannot finish within the new per-attempt timeout will fail after exhausting the retry allowance rather than wait indefinitely. ## Screenshots (if applicable) <!-- Add screenshots to show the changes, if applicable -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 8 updates in the / directory:
4.37.84.38.03.0.13.1.04.37.84.38.04.37.84.38.04.37.84.38.00.24.00.24.25.0.05.0.11.6.331.6.35Updates
github/codeql-action/upload-sariffrom 4.37.8 to 4.38.0Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
azure/loginfrom 3.0.1 to 3.1.0Release notes
Sourced from azure/login's releases.
Commits
a641126prepare release v3.1.03c5b5ceAdd max-context-population input to override Azure PowerShell MaxCont… (#642)fcd0340Bump browserslist from 4.21.4 to 4.28.8 (#637)5a8018fBump js-yaml from 3.14.2 to 3.15.2 (#643)a23dddfci: reduce scheduled test frequency and clarify workflow names (#639)4c016e0docs: document immutable release model and correct branch reference (#640)63f3c38Automate release tagging via deploy key + self-pin bump (#638)92a0b67Add the ability to prevent the masking of clientId (#634)5cb857dPin GitHub Actions to full-length commit SHAs (#636)d90bae5Cap@actions/execand@actions/corebelow the ESM-only 3.x majors (#628)Updates
github/codeql-action/initfrom 4.37.8 to 4.38.0Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
github/codeql-action/autobuildfrom 4.37.8 to 4.38.0Release notes
Sourced from github/codeql-action/autobuild's releases.
Changelog
Sourced from github/codeql-action/autobuild's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
github/codeql-action/analyzefrom 4.37.8 to 4.38.0Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
b96794fMerge pull request #4131 from github/update-v4.38.0-7e08580a902d5093Update changelog for v4.38.07e08580Merge pull request #4130 from github/henrymercer/workflow-runner-sizingbfcc52bRun slow macOS checks on larger runners8c251e7Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.00b7ca40Add changelog note40484b3Update default bundle to codeql-bundle-v2.27.0977e6ceMerge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup40a6b38Address toolcache cleanup review feedbackdeece8fApply suggestion from@henrymercerUpdates
anchore/sbom-actionfrom 0.24.0 to 0.24.2Release notes
Sourced from anchore/sbom-action's releases.
Commits
3ad7283ops: update write permissions for release (#723)31f5287chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#724)aa80c8cchore(deps): update Syft to latest release (#722)74b54e9chore(deps): bump lodash from 4.17.23 to 4.18.1 (#623)6b92ff5chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#721)4f8983bchore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (#719)10f27f4chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (#720)249403achore(deps-dev): bump@types/nodefrom 26.1.0 to 26.2.0 (#718)cbf8daachore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (#693)6afc793fix: pin syft install.sh to the release tag being installed (#716)Updates
actions/deploy-pagesfrom 5.0.0 to 5.0.1Release notes
Sourced from actions/deploy-pages's releases.
Commits
368f825Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff7e97763Validate deployment polling intervals0143e11Add backoff and jitter to deployment polling5e98f10Merge pull request #440 from actions/user/adwitiya8b0625aImprove deployment request test coverageUpdates
chainguard-dev/actions/setup-gitsignfrom 1.6.33 to 1.6.35Release notes
Sourced from chainguard-dev/actions/setup-gitsign's releases.
Commits
142d22ebuild(deps): bump the actions group across 8 directories with 8 updates (#1031)15451ddbuild(deps): bump step-security/harden-runner from 2.20.1 to 2.21.1 (#1032)0b85f3bbuild(deps): bump the actions group across 8 directories with 10 updates (#1029)a2ef676Update Go version from 1.26 to 1.27 (#1030)327340dOmit empty sbom-format from Verify invocation (#1028)a9d4aa7fix(melange-build-pkg): fix --source-dir (#991)