chore(deps): update github actions - #51
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.48.1→v2.63.0v6.2.3→v6.3.0v0.3.0→v0.4.0Release Notes
aquaproj/aqua (aqua)
v2.63.0Compare Source
Security
Fix a path traversal vulnerability GHSA-286g-rf2x-cv99.
When a package archive contained a GNU sparse file, aqua re-extracted the whole archive with the host
tar, applying none of its own path or symlink containment. On hosts whosetarfollows symlinks during extraction (e.g. BusyBox tar), a crafted archive could plant a symlink escaping the install directory and write a regular file through it. aqua now keeps the systemtarout of the install directory: it validates the sparse member names, extracts them into a staging directory, and moves each to its verified destination itself.Features
#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR
#5115 Support AQUA_DISABLE_TRACKING to disable the tracking of last used date times
Fixes
#5237 Skip minisign verification if the host platform doesn't support minisign
#5188 Ignore incomplete release assets in aqua gr
#5178 Support files[].src in go_install packages
#5171 Extract 7z archives that use the ARM64 filter
#5161 signer_workflow is a literal path, not a regex
Others
#5239 Fix Dockerfile build failure caused by a stale apt package index
v2.62.3Compare Source
🐛 Bug Fixes
#4840 update-checksum: Consider variants when enumerating package assets
v2.62.2Compare Source
Features
#5085 Update github.com/suzuki-shunsuke/ghtkn-go-sdk v0.4.1 to v0.5.0
https://github.com/suzuki-shunsuke/ghtkn-go-sdk/releases/tag/v0.5.0
v2.62.1Compare Source
🐛 Bug Fixes
#5048 unarchive: expand a pkg file into a non-existent destination
#5051 installpackage: create package directories with the usual permissions
v2.62.0Compare Source
Features
#5024 Embed fallback X.509 roots to support sandboxed environments
Fixes
#5018 More signature related filename extension exclusions @scop
#5025 Extract packages into a temp dir and rename atomically
Documentation
#5023 Add a guide to use aqua with Claude Code's sandbox
v2.61.0Compare Source
Features
#5002 unarchive: Fall back to the system tar for GNU sparse tarballs
#4971 genrate-registry: Prefer .sha512 > .sha256 > .sha1 > .md5 @scop
v2.60.2Compare Source
Improvements
Update ghtkn-go-sdk to v0.4.1
min_expirationandbackend.typein the configuration file🐛 Bug Fixes
#4990 #4992 unarchive: allow benign symlinks that point outside the extraction directory
#4974 help: make the help message consistent
Refactoring
#4958 Remove more GitHub release attestation support remnants @scop
Documentation
#4967 Checksum pattern extraction from first capturing group @scop
v2.60.1Compare Source
d5b02b2fix(unarchive): prevent archive extraction from writing outside the destinationFor more details, please see the security advisory.
*.sigand*.pemfiles are no longer included in the release assets*.bundlefiles are renamed to*.sigstore.jsonFixes
#4938 Remove GitHub Release Attestation verification
v2.60.0Compare Source
Features
#4894 Update ghtkn-go-sdk to v0.3.0 to support new features suche as backends and disabling device flow
New Contributors
v2.59.1Compare Source
Fixes
#4865 gr: don't treat *.minisig as checksum files @scop
v2.59.0Compare Source
Features
#4517 Get checksums from GitHub API Release Asset Digest
v2.58.1Compare Source
Fixes
#4786 checksum: Change the algorithm to sha256 when registry file isn't cached
v2.58.0Compare Source
Features
#4733 #4742 #4755 Add the variants override mechanism with libc detection
https://aquaproj.github.io/docs/reference/registry-config/overrides/#variants
#4667 Refactor GitHub release attestations control naming @scop
#4634 Get a GitHub access token from AQUA_GITHUB_TOKEN and pass it to gh command if GH_TOKEN and GITHUB_TOKEN aren't set
Document
#4729 Update edit URL in docusaurus configuration @dsychin
#4756 Add musl vs glibc section to registry style guide
v2.57.2Compare Source
Fixes
#4719 Fix jar support
#4722 Map x86-64 to amd64
#4688 Normalize CRLF line endings in checksum file parser
Documentation
#4668 Deprecate signer-workflow @scop
#4663 JSON Schema: signer-workflow string format @scop
v2.57.1Compare Source
🐛 Bug Fixes
#4659 Fix a bug that
aqua update-checksumdoesn't verify checksum files using tools like Cosignv2.57.0Compare Source
Features
#4625 Support executing .jar
If
aqua whichreturns a.jarfile, aqua executes it byjava -jar.This requires
javacommand.Fixes
#4629 Re-add
envfield to logv2.56.7Compare Source
Bug Fixes
#4585 remove: fix a bug that
-idoesn't workRefactoring
#4527 Refactor Checksum Verification
Document
#4560 Fix typos and invalid links in documents @kangetsu121
Dependency Updates
v2.56.6Compare Source
🐛 Bug Fixes
#4510 Fix a bug that
-log-colordoesn't work#4526 aqua gr: Fix a bug that
win32are excludedv2.56.5Compare Source
🐛 Bug Fixes
#4495 Fix a bug that
aqua gr's-cmdoption doesn't workThis was a bug of v2.56.2 ~ v2.56.4. #4450
v2.56.4Compare Source
🐛 Bub Fixes
#4484 #4485 Prevent duplicate log field output
v2.56.3Compare Source
🐛 Bug Fixes
#4475 cp: Fix a bug that command arguments are ignored and always all commands are copied
#4476 update-aqua: Fix a bug that a command argument is ignored and always the latest version is installed
Others
#4471 Update sigstore/cosign to v3.0.4
v2.56.2Compare Source
Refactoring
#4448 Replace logrus with slog
#4450 Use urfave/cli/v3 Destination pattern for flag values
v2.56.1Compare Source
Fixes
#4436 gr: Exclude
eabihfv2.56.0Compare Source
Features
#4422 Get pseudo-versions from Go Proxy if no tagged version exists @gizmoguy
Fixes
#4401 Add YAML tags @Shion1305
#4404 Update golangci-lint to v2.7.2, with lint fixes @Shion1305
Dependency Updates
#4402 Update goreleaser to v2.13.1
#4405 Update anchore/syft to v1.38.2
#4406 Update Cosign to v3.0.3
#4420 Update expr to v1.17.7
#4424 Update goccy/go-yaml to v1.19.1
v2.55.3Compare Source
Bug Fixes
#4393 gr: Fix the support of
sigstoreandsigstore.jsonfile extensionsRefactoring
#4369 Enable
tagalignrule in golangci-lint @Shion1305#4394 chore(deps): migrate to go.yaml.in/yaml @scop
v2.55.2Compare Source
Performance Improvement
#4342 Skip packages that cannot provide the desired exe @refi64
Others
#4312 Update Go to 1.25.4
v2.55.1Compare Source
🐛 Bug Fixes
#4274 #4276 exec: Fix the command name (
args[0])Dependency Updates
#4220 #4266 Update github.com/google/go-github/v74 to v76
#4233 #4251 #4261 Update Go to 1.25.2
Others
Release Cosign Bundle file *.bundle
v2.55.0Compare Source
Features
#4195 #4213 Support verifying the integrity of GitHub Releases
https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/verifying-the-integrity-of-a-release
https://aquaproj.github.io/docs/reference/security/github-immutable-release
v2.54.1Compare Source
🐛 Bug Fixes
#4182 Fix a bug of
generate-registrycommand thatarm64is replaced toarmincorrectlyv2.54.0Compare Source
Features
#4173 ghtkn integration
https://aquaproj.github.io/docs/reference/security/ghtkn/
Now aqua can get a GitHub App User Access Token by ghtkn integration.
Stop risking token leaks - Use secure, short-lived GitHub tokens for local development.
Requirements
The ghtkn integration requires:
This feature doesn't depend on ghtkn CLI.
Limitation
The integration requires the user interaction when creating an access token via Device Flow, so it's unavailable in CI.
Set up
For more details, please see https://github.com/suzuki-shunsuke/ghtkn .
AQUA_GHTKN_ENABLED=trueexport AQUA_GHTKN_ENABLED=trueThen aqua gets a user access token using ghtkn Go SDK when aqua calls GitHub APIs.
v2.53.11Compare Source
Performance Improvement
#4159 Update github.com/gdamore/tcell/v2 to reduce startup time @refi64
Benchmark
aqua.yaml
v2.53.10Compare Source
🛡️ Starting from this release, Immutable Release is enabled!
#4147 Update Go to v1.25.1
#4145 Update aqua-proxy to v1.2.12
🐛 Bug Fixes
#4140 Fix error messages
v2.53.9Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.8...v2.53.9
🐛 Bug Fixes
#4064 Fix a bug that environment variables aren't passed to
gh attestation verifyOthers
#4065 Update Go to v1.24.6
#4065 Update aqua-proxy to v1.2.11
v2.53.8Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.7...v2.53.8
🐛 Bug Fixes
#4047 cp: Add missing .exe on Windows @W1M0R
v2.53.7Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.6...v2.53.7
Fixes
#4038 Fix a bug that it fails to verify GitHub Artifact Attestations on GitHub Enterprise Server @yamoyamoto
v2.53.6Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.5...v2.53.6
🐛 Bug Fixes
#4024 #4025 Fix a bug that aqua works without registries'
ref#4019 Set User-Agent to GitHub Release downloads @yanolab
v2.53.5Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.4...v2.53.5
#4008 Fix Homebrew tap to remove the quarantine bit from the binary on a post install hook
v2.53.4Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.3...v2.53.4
#3995 Add license files of Go and Go modules to released assets
#3995 Release SBOM
#3995 Update Go to 1.24.5
#3996 Update aqua-proxy to v1.2.10
v2.53.3Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.2...v2.53.3
🐛 Bug Fixes
#3957 Fix Shell Completion
Dependency Updates
#3956 Cosign v2.5.2
#3942 github.com/urfave/cli/v3 v3.3.8
Refactoring
#3949 apply gopls modernize improvements @scop
v2.53.2Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.1...v2.53.2
🐛 Bug Fixes
#3932 Fix the issue that aqua can't be installed by
go installv2.53.1Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.53.0...v2.53.1
🐛 Bug Fixes
#3926 checksum: Fix a bug that checksums of awslabs/amazon-ecr-credential-helper are wrong
Others
#3924 gr: Map
armtoarm64v2.53.0Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.52.0...v2.53.0
Features
#3920 Retry HTTP requests for robustness
v2.52.0Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.51.2...v2.52.0
Features
#3890 feat(generate-registry): cosign bundle support @scop
Update dependencies
#3915 Update golang.org/x/sync to v0.15.0
#3876 #3903 #3912 Update github.com/expr-lang/expr to v1.17.5
#3905 Update github.com/goccy/go-yaml to v1.18.0
#3881 Update github.com/mholt/archives to v0.1.2
#3870 Update github.com/google/go-github/v71 to v72
Others
#3891 chore(golangci-lint): remove gofmt, it's a gofumpt subset @scop
v2.51.2Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.51.1...v2.51.2
🐛 Bug Fixes
#3868 Fix
versioncommandDependency Updates
update module github.com/urfave/cli/v3 to v3.3.3 (#3866)
golang.org/x/term to v0.32.0 (#3863)
v2.51.1Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.51.0...v2.51.1
Features
#3852 #3853 Support managing a GitHub access token using Keyring
You can now manage a GitHub Access token using secret store such as Windows Credential Manager, macOS Keychain, and GNOME Keyring.
aqua token setcommand:or you can also pass a GitHub Access token via standard input:
AQUA_KEYRING_ENABLED:export AQUA_KEYRING_ENABLED=trueNote that if the environment variable
GITHUB_TOKENis set, this feature gets disabled.You can remove a GitHub Access token from keyring by
aqua token rmcommand:v2.51.0Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.50.1...v2.51.0
v2.50.1Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.50.0...v2.50.1
Improve the performance of command execution
#3826
This release improves the performance of
aqua whichandaqua execcommand.aqua whichread registries, but the standard registry is very large (about 2MB) so it makes the performance worse.Furthermore, the standard registry gets larger every time we improve the standard registry.
To solve the problem, this pull request introduces the cache mechanism of packages by aqua.yaml.
aqua creates a cache file per aqua.yaml into
$(aqua root-dir)/registry-cache/<base64 encoded aqua.yaml absolute path>.json.The structure of cache files is:
{ "absolute path of registry.yaml": { "package name": { "type": "github_release", // ... } } }If a registry type is
local, a cache file isn't created.Cache files are much smaller than the standard registry, so aqua can read them much faster.
If packages aren't found in cache files, aqua reads the original registries and updates cache files.
aqua removes unused records from cache.
Bench mark
Others
#3840 chore: update aqua-proxy to v1.2.9
#3839 chore: update urfave-cli-v3-util to v0.0.4
v2.50.0Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.49.0...v2.50.0
Features
#3794 GitHub Artifact Attestations: Non-default predicate type support @scop
v2.49.0Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.48.3...v2.49.0
Features
#3780 Support creating hardlinks
v2.48.3Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.48.2...v2.48.3
🐛 Bug Fixes
#3774 Fix
aqua versioncommandv2.48.2Compare Source
Pull Requests | Issues | aquaproj/aqua@v2.48.1...v2.48.2
🐛 Bug Fixes
#3771 Fix fish completion
#3750 generate-registry: Fix panic if version isn't semver
Improvement
#3772 Improve
-voption andversioncommand#3740 checksum: don't treat *.bundle as checksum @scop
aws-actions/configure-aws-credentials (aws-actions/configure-aws-credentials)
v6.3.0Compare Source
v6.2.4Compare Source
masterpointio/actions (masterpointio/actions)
v0.4.0Compare Source
Features
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.