From 78a74f78f819d70d4faaf284e86f3017f81926ce Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Mon, 27 Jul 2026 14:38:07 +0000 Subject: [PATCH] chore(deps): pin dependencies (#1117) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | pinDigest | → `3d3c42e` | | | | [actions/setup-go](https://github.com/actions/setup-go) | action | pinDigest | → `b7ad1da` | | | | [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest | → `8207627` | | | | [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) | action | pinDigest | → `2dc316d` | | | | [docker/build-push-action](https://github.com/docker/build-push-action) | action | pinDigest | → `53b7df9` | | | | [docker/login-action](https://github.com/docker/login-action) | action | pinDigest | → `abd2ef4` | | | | [docker/metadata-action](https://github.com/docker/metadata-action) | action | pinDigest | → `dc80280` | | | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | action | pinDigest | → `bb05f3f` | | | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | action | pinDigest | → `96fe6ef` | | | | [go.yaml.in/yaml/v4](https://github.com/yaml/go-yaml) | require | patch | `v4.0.0-rc.3` → `v4.0.0-rc.6` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.yaml.in%2fyaml%2fv4/v4.0.0-rc.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.yaml.in%2fyaml%2fv4/v4.0.0-rc.3/v4.0.0-rc.6?slim=true) | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | action | pinDigest | → `f06c13b` | | | | ubuntu | final | major | `24.04` → `26.04` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ubuntu/resolute?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ubuntu/24.04/resolute?slim=true) | --- ### Release Notes
yaml/go-yaml (go.yaml.in/yaml/v4) ### [`v4.0.0-rc.6`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) ### [`v4.0.0-rc.5`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) ### [`v4.0.0-rc.4`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4)
--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). --------- Co-authored-by: silverwind Reviewed-on: https://gitea.com/gitea/runner/pulls/1117 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Renovate Bot --- .gitea/workflows/pull-pr-title.yml | 4 ++-- .gitea/workflows/release-nightly.yml | 16 +++++++-------- .gitea/workflows/release-tag.yml | 20 +++++++++---------- .gitea/workflows/test.yml | 4 ++-- .../testdata/actions/action1/Dockerfile | 2 +- renovate.json5 | 8 +++++++- 6 files changed, 30 insertions(+), 24 deletions(-) diff --git a/.gitea/workflows/pull-pr-title.yml b/.gitea/workflows/pull-pr-title.yml index b2c5b96d..03ba7469 100644 --- a/.gitea/workflows/pull-pr-title.yml +++ b/.gitea/workflows/pull-pr-title.yml @@ -18,8 +18,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: node-version: 24 - run: make lint-pr-title diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml index fcc6b26b..85e1d575 100644 --- a/.gitea/workflows/release-nightly.yml +++ b/.gitea/workflows/release-nightly.yml @@ -17,7 +17,7 @@ jobs: goreleaser: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # Custom publishers (the R2 mirror below) run as the very last @@ -32,11 +32,11 @@ jobs: R2_BUCKET: ${{ secrets.R2_BUCKET }} R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: go-version-file: "go.mod" - name: goreleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 with: distribution: goreleaser-pro args: release --nightly @@ -74,18 +74,18 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # all history for all branches and tags - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 - name: Set up Docker BuildX - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to DockerHub - uses: docker/login-action@v4 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} @@ -99,7 +99,7 @@ jobs: echo REPO_VERSION=$(git describe --tags --always | sed 's/-/+/' | sed 's/^v//') >> $GITHUB_OUTPUT - name: Build and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . file: ./Dockerfile diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml index acf8d1f4..cc0a1e89 100644 --- a/.gitea/workflows/release-tag.yml +++ b/.gitea/workflows/release-tag.yml @@ -9,7 +9,7 @@ jobs: goreleaser: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # all history for all branches and tags # Custom publishers (the R2 mirror below) run as the very last @@ -24,18 +24,18 @@ jobs: R2_BUCKET: ${{ secrets.R2_BUCKET }} R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} - - uses: actions/setup-go@v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: go-version-file: "go.mod" - name: Import GPG key id: import_gpg - uses: crazy-max/ghaction-import-gpg@v7 + uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7 with: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.PASSPHRASE }} fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0 - name: goreleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 with: distribution: goreleaser-pro args: release @@ -77,25 +77,25 @@ jobs: DOCKER_LATEST: latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # all history for all branches and tags - name: Set up QEMU - uses: docker/setup-qemu-action@v4 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 - name: Set up Docker BuildX - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to DockerHub - uses: docker/login-action@v4 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: "Docker meta" id: docker_meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 with: images: | ${{ env.DOCKER_ORG }}/runner @@ -108,7 +108,7 @@ jobs: suffix=${{ matrix.variant.tag_suffix }},onlatest=true - name: Build and push - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . file: ./Dockerfile diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml index 907e5edc..e65011a1 100644 --- a/.gitea/workflows/test.yml +++ b/.gitea/workflows/test.yml @@ -17,8 +17,8 @@ jobs: # to ~/.docker with the stale credentials. DOCKER_CONFIG: /tmp/docker-noauth steps: - - uses: actions/checkout@v7 - - uses: actions/setup-go@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 with: go-version-file: 'go.mod' - name: prepare anonymous docker config diff --git a/act/runner/testdata/actions/action1/Dockerfile b/act/runner/testdata/actions/action1/Dockerfile index 3f08e9af..a5bf22a4 100644 --- a/act/runner/testdata/actions/action1/Dockerfile +++ b/act/runner/testdata/actions/action1/Dockerfile @@ -1 +1 @@ -FROM ubuntu:24.04 \ No newline at end of file +FROM ubuntu:26.04 \ No newline at end of file diff --git a/renovate.json5 b/renovate.json5 index c7e09e46..6ff4eaae 100644 --- a/renovate.json5 +++ b/renovate.json5 @@ -2,5 +2,11 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "local>gitea/renovate-config" - ] + ], + "packageRules": [ + { + "matchPackageNames": ["go.yaml.in/yaml/v4"], + "allowedVersions": "<4.0.0-rc.4", // rc.4 removes the error types actionlint builds against + }, + ], }