From eca1c63fee54667d75075cb7a179c85b566bbd6f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Nov 2025 05:09:45 +0000 Subject: [PATCH] Chore(deps): Bump the github_actions_dependencies group across 1 directory with 7 updates Bumps the github_actions_dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [shivammathur/setup-php](https://github.com/shivammathur/setup-php) | `2.35.3` | `2.35.5` | | [actions/cache](https://github.com/actions/cache) | `4.2.4` | `4.3.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `5` | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `5.3.0` | `6.0.0` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.28.0` | `0.33.1` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.2` | `2.4.3` | | [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` | Updates `shivammathur/setup-php` from 2.35.3 to 2.35.5 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/2.35.3...2.35.5) Updates `actions/cache` from 4.2.4 to 4.3.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v4.2.4...v4.3.0) Updates `actions/upload-artifact` from 4 to 5 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v5) Updates `SonarSource/sonarqube-scan-action` from 5.3.0 to 6.0.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/v5.3.0...v6.0.0) Updates `aquasecurity/trivy-action` from 0.28.0 to 0.33.1 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.33.1) Updates `ossf/scorecard-action` from 2.4.2 to 2.4.3 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/v2.4.2...v2.4.3) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions_dependencies - dependency-name: actions/cache dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions_dependencies - dependency-name: actions/upload-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github_actions_dependencies - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github_actions_dependencies - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions_dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions_dependencies - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github_actions_dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/main.yml | 32 ++++++++++++------------ .github/workflows/scorecard.yml | 6 ++--- .github/workflows/vulnerability-scan.yml | 2 +- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6105ab37a..84eda1b2a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -30,7 +30,7 @@ jobs: fetch-depth: '0' - name: Setup PHP, with composer and extensions - uses: shivammathur/setup-php@2.35.3 + uses: shivammathur/setup-php@2.35.5 with: php-version: '8.4' tools: composer:v2 @@ -40,7 +40,7 @@ jobs: run: echo "CACHE_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache composer dependencies - uses: actions/cache@v4.2.4 + uses: actions/cache@v4.3.0 with: path: ${{ steps.composer-cache.outputs.CACHE_DIR }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} @@ -75,7 +75,7 @@ jobs: fetch-depth: '0' - name: Setup PHP, with composer and extensions - uses: shivammathur/setup-php@2.35.3 + uses: shivammathur/setup-php@2.35.5 with: php-version: '8.4' tools: composer:v2 @@ -85,7 +85,7 @@ jobs: run: echo "CACHE_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache composer dependencies - uses: actions/cache@v4.2.4 + uses: actions/cache@v4.3.0 with: path: ${{ steps.composer-cache.outputs.CACHE_DIR }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} @@ -130,7 +130,7 @@ jobs: fetch-depth: '0' - name: Setup PHP, with composer and extensions - uses: shivammathur/setup-php@2.35.3 + uses: shivammathur/setup-php@2.35.5 with: php-version: '8.4' tools: composer:v2 @@ -140,7 +140,7 @@ jobs: run: echo "CACHE_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache composer dependencies - uses: actions/cache@v4.2.4 + uses: actions/cache@v4.3.0 with: path: ${{ steps.composer-cache.outputs.CACHE_DIR }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} @@ -185,13 +185,13 @@ jobs: run: make phpinsights - name: Archive Psalm results (psalm.json) - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: psalm.json path: ./build/psalm.json - name: Archive `phploc` results (phploc.json) - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: phploc.json path: ./build/phploc.json @@ -221,7 +221,7 @@ jobs: fetch-depth: '0' - name: Setup PHP, with composer and extensions - uses: shivammathur/setup-php@2.35.3 + uses: shivammathur/setup-php@2.35.5 with: php-version: '8.4' extensions: pdo_mysql, mysql @@ -233,7 +233,7 @@ jobs: run: echo "CACHE_DIR=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT - name: Cache composer dependencies - uses: actions/cache@v4.2.4 + uses: actions/cache@v4.3.0 with: path: ${{ steps.composer-cache.outputs.CACHE_DIR }} key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }} @@ -288,7 +288,7 @@ jobs: COVERALLS_RUN_LOCALLY: 1 - name: SonarQube Scan (https://sonarcloud.io/dashboard?id=github.com.tarlepp.symfony-flex-backend) - uses: SonarSource/sonarqube-scan-action@v5.3.0 + uses: SonarSource/sonarqube-scan-action@v6.0.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # https://github.com/SonarSource/sonarqube-scan-action?tab=readme-ov-file#environment-variables @@ -297,25 +297,25 @@ jobs: run: make phpmetrics - name: Archive code coverage results (clover.xml) - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: clover.xml path: ./build/logs/clover.xml - name: Archive code coverage results (junit.xml) - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: junit.xml path: ./build/logs/junit.xml - name: Archive Code Coverage - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: CodeCoverage path: ./build/report - name: Archive PhpMetrics results - uses: actions/upload-artifact@v4.6.1 + uses: actions/upload-artifact@v5 with: name: PhpMetrics path: ./build/phpmetrics @@ -369,7 +369,7 @@ jobs: run: docker build . --file Dockerfile --tag symfony-flex-backend:${{ steps.vars.outputs.DOCKER_TAG }} - name: Scan Docker image with Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.32.0 + uses: aquasecurity/trivy-action@0.33.1 with: image-ref: 'symfony-flex-backend:${{ steps.vars.outputs.DOCKER_TAG }}' format: 'table' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c09473c6a..c881b8e2a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -40,7 +40,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@v2.4.2 + uses: ossf/scorecard-action@v2.4.3 with: results_file: results.sarif results_format: sarif @@ -62,7 +62,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: SARIF file path: results.sarif @@ -70,6 +70,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml index 2eddd8ec8..5c5f68ae1 100644 --- a/.github/workflows/vulnerability-scan.yml +++ b/.github/workflows/vulnerability-scan.yml @@ -21,7 +21,7 @@ jobs: run: docker build . --file Dockerfile --tag symfony-flex-backend:master - name: Scan image with Trivy - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@0.33.1 with: image-ref: symfony-flex-backend:master ignore-unfixed: 'true'