ci(deps): bump the github-actions-minor-patch group across 1 directory with 14 updates

[dependabot]

Bumps the github-actions-minor-patch group with 14 updates in the / directory:

Package	From	To
actions/checkout	4.3.1	4.4.0
actions/setup-go	6.4.0	6.5.0
github/codeql-action/init	3.36.0	3.37.6
github/codeql-action/autobuild	3.36.0	3.37.6
github/codeql-action/analyze	3.36.0	3.37.6
actions/setup-python	6.2.0	6.3.0
golangci/golangci-lint-action	9.2.1	9.3.0
google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml	2.3.8	2.5.0
google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml	2.3.8	2.5.0
relizaio/rearm-actions/setup-cli	1.5.0	1.7.0
relizaio/rearm-actions/initialize	1.5.0	1.7.0
relizaio/rearm-actions/sbom-sign-scan	1.5.0	1.7.0
relizaio/rearm-actions/finalize	1.5.0	1.7.0
goreleaser/goreleaser-action	7.2.2	7.2.3

Updates actions/checkout from 4.3.1 to 4.4.0

Release notes

Sourced from actions/checkout's releases.

v4.4.0

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v4 by @​aiqiaoy in actions/checkout#2502
• backport fixes to releases-v4 by @​aiqiaoy in actions/checkout#2524

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v4.3.1...v4.4.0

Commits

• 11d5960 backport fixes to releases-v4 (#2524)
• c915c33 backport allow-unsafe-pr-checkout to v4 (#2502)
• See full diff in compare view

Updates actions/setup-go from 6.4.0 to 6.5.0

Release notes

Sourced from actions/setup-go's releases.

v6.5.0

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in actions/setup-go#744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in actions/setup-go#755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-go#758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in actions/setup-go#762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in actions/setup-go#744
• @​jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

• 924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
• e91cc3b Bump @​actions/cache to 5.1.0, log cache write denied (#758)
• 4a2405e chore: update @​types/node and @​typescript-eslint dependencies to latest versi...
• 78961f6 chore: update @​actions dependencies and refresh license cache (#744)
• See full diff in compare view

Updates github/codeql-action/init from 3.36.0 to 3.37.6

Release notes

Sourced from github/codeql-action/init's releases.

v3.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v3.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v3.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v3.37.3

No user facing changes.

v3.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v3.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v3.36.3

No user facing changes.

v3.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v3.36.1

No user facing changes.

Commits

• c4dd10e Merge pull request #4074 from github/backport-v3.37.6-5595ccaf9
• 2ba473f Trigger workflows
• b4d147f Rebuild
• f6580d2 Update version and changelog for v3.37.6
• 5e7686d Merge remote-tracking branch 'origin/releases/v4' into backport-v3.37.6-5595c...
• 324dd69 Revert "Rebuild"
• 200d550 Revert "Update version and changelog for v3.37.5"
• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• Additional commits viewable in compare view

Updates github/codeql-action/autobuild from 3.36.0 to 3.37.6

Release notes

Sourced from github/codeql-action/autobuild's releases.

v3.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v3.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v3.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v3.37.3

No user facing changes.

v3.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v3.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v3.36.3

No user facing changes.

v3.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v3.36.1

No user facing changes.

Commits

• c4dd10e Merge pull request #4074 from github/backport-v3.37.6-5595ccaf9
• 2ba473f Trigger workflows
• b4d147f Rebuild
• f6580d2 Update version and changelog for v3.37.6
• 5e7686d Merge remote-tracking branch 'origin/releases/v4' into backport-v3.37.6-5595c...
• 324dd69 Revert "Rebuild"
• 200d550 Revert "Update version and changelog for v3.37.5"
• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 3.36.0 to 3.37.6

Release notes

Sourced from github/codeql-action/analyze's releases.

v3.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v3.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v3.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v3.37.3

No user facing changes.

v3.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v3.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

v3.37.0

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v3.36.3

No user facing changes.

v3.36.2

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

v3.36.1

No user facing changes.

Commits

• c4dd10e Merge pull request #4074 from github/backport-v3.37.6-5595ccaf9
• 2ba473f Trigger workflows
• b4d147f Rebuild
• f6580d2 Update version and changelog for v3.37.6
• 5e7686d Merge remote-tracking branch 'origin/releases/v4' into backport-v3.37.6-5595c...
• 324dd69 Revert "Rebuild"
• 200d550 Revert "Update version and changelog for v3.37.5"
• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• Additional commits viewable in compare view

Updates actions/setup-python from 6.2.0 to 6.3.0

Release notes

Sourced from actions/setup-python's releases.

v6.3.0

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in actions/setup-python#1323
• Fix pip cache error handling on Windows by @​priyagupta108 in actions/setup-python#1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in actions/setup-python#1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in actions/setup-python#1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-python#1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in actions/setup-python#1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in actions/setup-python#811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in actions/setup-python#1303
• @​jasongin made their first contribution in actions/setup-python#1324
• @​Dunky-Z made their first contribution in actions/setup-python#811

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

Commits

• ece7cb0 Fix pip cache error handling on Windows. (#1040)
• 1d18d7a Update advanced-usage.md (#811)
• d2b357a Update dependency versions and test workflow configuration (#1322)
• 8f639b1 Merge pull request #1324 from jasongin/update-actions-cache-5.1.0
• 6731c2b Resolve high-severity audit issues
• 0cb1a84 Add RHEL support and include Linux distro in cache keys (#1323)
• dc6eab6 Update dist
• 6f4b74b Strict equality
• fa8bde1 Bump @​actions/cache to 5.1.0, log cache write denied
• c8813ba Upgrade @​actions dependencies and update licenses (#1303)
• Additional commits viewable in compare view

Updates golangci/golangci-lint-action from 9.2.1 to 9.3.0

Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.3.0

What's Changed

Changes

• feat: add no-run-logs-group as experimental option by @​ldez in golangci/golangci-lint-action#1403

Dependencies

• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-actions group by @​dependabot[bot] in golangci/golangci-lint-action#1395
• build(deps): bump tmp from 0.2.5 to 0.2.6 by @​dependabot[bot] in golangci/golangci-lint-action#1397
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-actions group by @​dependabot[bot] in golangci/golangci-lint-action#1398
• build(deps): bump tmp from 0.2.6 to 0.2.7 by @​dependabot[bot] in golangci/golangci-lint-action#1399
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in golangci/golangci-lint-action#1400

Full Changelog: golangci/golangci-lint-action@v9.2.1...v9.3.0

Commits

• ba0d7d2 chore: prepare release v9.3.0
• efd0857 feat: add no-run-logs-group as experimental option (#1403)
• ed485de build(deps): bump undici from 6.24.0 to 6.27.0
• 8872e8d build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (#1400)
• b163415 build(deps): bump tmp from 0.2.6 to 0.2.7 (#1399)
• e52a9f8 build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
• 8182aa3 build(deps): bump tmp from 0.2.5 to 0.2.6 (#1397)
• 5403a41 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-ac...
• See full diff in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.3.8 to 2.5.0

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

• feat: gate reusable workflow outputs with a flag by @​another-rex in google/osv-scanner-action#130
• Pin download-artifact action to SHA by @​SVilgelm in google/osv-scanner-action#127
• feat: add runs-on input to reusable workflows by @​BeyondEvil in google/osv-scanner-action#131
• fix: address zizmor warnings by @​another-rex in google/osv-scanner-action#135
• fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @​another-rex in google/osv-scanner-action#138

New Contributors

• @​SVilgelm made their first contribution in google/osv-scanner-action#127
• @​BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

Commits

• 8deb546 Merge pull request #140 from google/update-to-v2.5.0
• 8fb3f8c Update unified workflow example to point to v2.5.0 reusable workflows
• 0c58c54 Update reusable workflows to point to v2.5.0 actions
• 06b2ab4 "Update actions to use v2.5.0 osv-scanner image"
• 9fd1bcc Merge pull request #138 from google/fix/gotoolchain-auto
• 01a87d5 fix: add GOTOOLCHAIN=auto env to osv-scanner calls
• a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
• 272ff57 fix: address zizmor template injection warnings
• 10621fb refactor: move permissions to job level to satisfy zizmor
• fa4ff67 Merge pull request #131 from BeyondEvil/feat/add-runs-on-input
• Additional commits viewable in compare view

Updates google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.8 to 2.5.0

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

• feat: gate reusable workflow outputs with a flag by @​another-rex in google/osv-scanner-action#130
• Pin download-artifact action to SHA by @​SVilgelm in google/osv-scanner-action#127
• feat: add runs-on input to reusable workflows by @​BeyondEvil in google/osv-scanner-action#131
• fix: address zizmor warnings by @​another-rex in google/osv-scanner-action#135
• fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @​another-rex in google/osv-scanner-action#138

New Contributors

• @​SVilgelm made their first contribution in google/osv-scanner-action#127
• @​BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: google/osv-scanner-action@v2.3.8...v2.5.0

Commits

• 8deb546 Merge pull request #140 from google/update-to-v2.5.0
• 8fb3f8c Update unified workflow example to point to v2.5.0 reusable workflows
• 0c58c54 Update reusable workflows to point to v2.5.0 actions
• 06b2ab4 "Update actions to use v2.5.0 osv-scanner image"
• 9fd1bcc Merge pull request #138 from google/fix/gotoolchain-auto
• 01a87d5 fix: add GOTOOLCHAIN=auto env to osv-scanner calls
• a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
• 272ff57 fix: address zizmor template injection warnings
• 10621fb refactor: move permissions to job level to satisfy zizmor
• fa4ff67 Merge pull request #131 from BeyondEvil/feat/add-runs-on-input
• Additional commits viewable in compare view

Updates relizaio/rearm-actions/setup-cli from 1.5.0 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/setup-cli's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.

# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256

Fixes:

• This release addresses zizmor findings around possible unsafe inputs.

1.6.1

Chores

• Switch cdxgen to 12.3.3

1.6.0

Breaking Changes

• Finalize action no longer submits finalizer call to ReARM after the release is pushed (that is now handled by ReARM Backend automatically).

Features

• Add add-multi-release action (allows to submit multiple component releases at a time which would fire auto-integrate once per matching feature set within the submission)

Chores

• Bump ReARM CLI to 26.05.20
• Bump cdxgen to 12.5.0

Commits

• dac3e77 fix: proper variable expanding following hardening
• 7768d9b docs: describe possible breaking changes on input
• 9dceef7 feat: handle possible unsafe inputs
• ea942d9 docs: correct type on add multi-release
• 411386f chore: downgrade cdxgen to 12.3.3
• 710b7c0 chore: bump cdxgen to 12.5.0
• 121c78a chore: add add-multi-release action
• f48839b chore(setup-cli): bump ReARM CLI to 26.05.20
• 7c60f73 feat(finalize)!: remove ReARM finalize call since backend now handles it auto...
• See full diff in compare view

Updates relizaio/rearm-actions/initialize from 1.5.0 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/initialize's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.

# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256

Fixes:

• This release addresses zizmor findings around possible unsafe inputs.

1.6.1

Chores

• Switch cdxgen to 12.3.3

1.6.0

Breaking Changes

• Finalize action no longer submits finalizer call to ReARM after the release is pushed (that is now handled by ReARM Backend automatically).

Features

• Add add-multi-release action (allows to submit multiple component releases at a time which would fire auto-integrate once per matching feature set within the submission)

Chores

• Bump ReARM CLI to 26.05.20
• Bump cdxgen to 12.5.0

Commits

• dac3e77 fix: proper variable expanding following hardening
• 7768d9b docs: describe possible breaking changes on input
• 9dceef7 feat: handle possible unsafe inputs
• ea942d9 docs: correct type on add multi-release
• 411386f chore: downgrade cdxgen to 12.3.3
• 710b7c0 chore: bump cdxgen to 12.5.0
• 121c78a chore: add add-multi-release action
• f48839b chore(setup-cli): bump ReARM CLI to 26.05.20
• 7c60f73 feat(finalize)!: remove ReARM finalize call since backend now handles it auto...
• See full diff in compare view

Updates relizaio/rearm-actions/sbom-sign-scan from 1.5.0 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/sbom-sign-scan's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.

# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by the action
image_digest: $DOCKER_SHA_256

Fixes:

• This release addresses zizmor findings around possible unsafe inputs.

1.6.1

Chores

• Switch cdxgen to 12.3.3

1.6.0

Breaking Changes

• Finalize action no longer submits finalizer call to ReARM after the release is pushed (that is now handled by ReARM Backend automatically).

Features

• Add add-multi-release action (allows to submit multiple component releases at a time which would fire auto-integrate once per matching feature set within the submission)

Chores

• Bump ReARM CLI to 26.05.20
• Bump cdxgen to 12.5.0

Commits

• dac3e77 fix: proper variable expanding following hardening
• 7768d9b docs: describe possible breaking changes on input
• 9dceef7 feat: handle possible unsafe inputs
• ea942d9 docs: correct type on add multi-release
• 411386f chore: downgrade cdxgen to 12.3.3
• 710b7c0 chore: bump cdxgen to 12.5.0
• 121c78a chore: add add-multi-release action
• f48839b chore(setup-cli): bump ReARM CLI to 26.05.20
• 7c60f73 feat(finalize)!: remove ReARM finalize call since backend now handles it auto...
• See full diff in compare view

Updates relizaio/rearm-actions/finalize from 1.5.0 to 1.7.0

Release notes

Sourced from relizaio/rearm-actions/finalize's releases.

1.7.0

Breaking Changes:

Input Value Requirements

Since v1.7.0, every action consumes its inputs through step-level env: indirection — a hardening against template injection (each ${{ inputs.* }} is bound to an environment variable instead of being interpolated directly into the run script). As a result, every input value must be an already-resolved string: a literal, a step output, or an env context expression such as ${{ steps.build.outputs.IMAGE_DIGEST }} or ${{ env.DOCKER_SHA_256 }}.

Do not pass a bare shell-variable reference. A value like image_digest: $DOCKER_SHA_256 is forwarded verbatim and is not expanded by the action's shell (it was under the pre-v1.7.0 inline form, but no longer), producing errors such as invalid reference format: repository name (...@$DOCKER_SHA_256) must be lowercase. If you computed a value into a shell variable, surface it via $GITHUB_OUTPUT or $GITHUB_ENV first and reference it with ${{ steps.<id>.outputs.<name> }} or ${{ env.<NAME> }}.

# ✅ resolved from a step output
image_digest: ${{ steps.build.outputs.IMAGE_DIGEST }}
# ✅ resolved from an env var exported earlier via $GITHUB_ENV
image_digest: ${{ env.DOCKER_SHA_256 }}
# ❌ bare shell reference — forwarded literally, never expanded by th...
Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.