881a07e8ce
post-merge: use and override dev tag
...
This is exactly what wasmtime does, maybe it works with immutable github
releases.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-11 09:12:12 +02:00
e0e2af9057
Deploy edge prelease ( #8626 )
...
follow up to: https://github.com/open-policy-agent/opa/pull/8615
The S3 bucket containing the edge release binaries is no longer
available. setup-opa relies on these binaries. This new `Deploy Edge
Prelease` re-introduces edge release by publishing them as a Github
pre-release instead.
On every push to main, after the linux/windows/darwin release builds
complete, a new deploy-edge job deletes any existing edge release and
creates a fresh GitHub prerelease tagged edge with all OPA binaries
attached.
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-08 15:28:19 -05:00
df98759c2f
benchmarks: fix PR comment script
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-08 13:44:44 +02:00
5c535f0019
benchmarks: fix reporting jq call
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-08 11:03:36 +02:00
dc77f2e259
workflows: report benchmark regressions back to pull request
...
Let's see if this works, it's a bit experimental at this point.
The twist comparred to how it's been done in EOPA (for example) is that
we're running the benchmarks post-merge, and report back if at the end
we find a failing check. This way, the PR goes green without having to
wait for the benchmarks, but there's still a connection between PR and
benchmark.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-08 10:01:50 +02:00
f645d91097
Remove edge releases ( #8615 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-05-07 08:47:15 -05:00
192a49a662
workflows: replace setup-zig with mise-action
...
The former seems dormant, and we need to deal with the node20
deprecation on github.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-05-04 10:15:17 +02:00
b1e1ac4efe
build(deps): bump the gha-dependencies group with 2 updates ( #8595 )
...
Bumps the gha-dependencies group with 2 updates:
[actions/cache](https://github.com/actions/cache ) and
[slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ).
Updates `actions/cache` from 4.2.3 to 5.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases ">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc "><code>@yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747 ">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5 ">https://github.com/actions/cache/compare/v5...v5.0.5 </a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link "><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696 ">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link "><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697 ">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link "><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699 ">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean "><code>@XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690 ">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link "><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701 ">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck "><code>@RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722 ">actions/cache#1722</a></li>
<li>Update dependencies & patch security vulnerabilities by <a
href="https://github.com/Link "><code>@Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738 ">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean "><code>@XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690 ">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck "><code>@RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722 ">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4 ">https://github.com/actions/cache/compare/v5...v5.0.4 </a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33 ">https://github.com/actions/cache/security/dependabot/33 </a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.3 ">https://github.com/actions/cache/compare/v5...v5.0.3 </a></p>
<h2>v.5.0.2</h2>
<h1>v5.0.2</h1>
<h2>What's Changed</h2>
<p>When creating cache entries, 429s returned from the cache service
will not be retried.</p>
<h2>v5.0.1</h2>
<blockquote>
<p>[!IMPORTANT]
<strong><code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of
<code>2.327.1</code>.</strong></p>
<p>If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<hr />
<h1>v5.0.1</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md ">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]<br />
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json "><code>https://github.com/actions/cache/blob/main/package.json </code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md "><code>https://github.com/actions/cache/blob/main/RELEASES.md </code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml "><code>https://github.com/actions/cache/blob/main/.licensed.yml </code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases ">https://github.com/actions/cache/releases </a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml ">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml </a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33 ">https://github.com/actions/cache/security/dependabot/33 </a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.3 <a
href="https://redirect.github.com/actions/cache/pull/1692 ">#1692</a></li>
</ul>
<h3>5.0.1</h3>
<ul>
<li>Update <code>@azure/storage-blob</code> to <code>^12.29.1</code> via
<code>@actions/cache@5.0.1</code> <a
href="https://redirect.github.com/actions/cache/pull/1685 ">#1685</a></li>
</ul>
<h3>5.0.0</h3>
<blockquote>
<p>[!IMPORTANT]
<code>actions/cache@v5</code> runs on the Node.js 24 runtime and
requires a minimum Actions Runner version of <code>2.327.1</code>.</p>
</blockquote>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/27d5ce7f107fe9357f9df03efb73ab90386fccae "><code>27d5ce7</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1747 ">#1747</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/cache/commit/f280785d7b6e1884c7d12b9136eb0f4a1574fcfd "><code>f280785</code></a>
licensed changes</li>
<li><a
href="https://github.com/actions/cache/commit/619aeb1606e195be0b36fd0ff68dcf1aff6b65a7 "><code>619aeb1</code></a>
npm run build generated dist files</li>
<li><a
href="https://github.com/actions/cache/commit/bcf16c2893940a4899761e55c7ac3c1cf88a04f6 "><code>bcf16c2</code></a>
Update ts-http-runtime to 0.3.5</li>
<li><a
href="https://github.com/actions/cache/commit/668228422ae6a00e4ad889ee87cd7109ec5666a7 "><code>6682284</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1738 ">#1738</a>
from actions/prepare-v5.0.4</li>
<li><a
href="https://github.com/actions/cache/commit/e34039626f957d3e3e50843d15c1b20547fc90e2 "><code>e340396</code></a>
Update RELEASES</li>
<li><a
href="https://github.com/actions/cache/commit/8a671105293e81530f1af99863cdf94550aba1a6 "><code>8a67110</code></a>
Add licenses</li>
<li><a
href="https://github.com/actions/cache/commit/1865903e1b0cb750dda9bc5c58be03424cc62830 "><code>1865903</code></a>
Update dependencies & patch security vulnerabilities</li>
<li><a
href="https://github.com/actions/cache/commit/565629816435f6c0b50676926c9b05c254113c0c "><code>5656298</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1722 ">#1722</a>
from RyPeck/patch-1</li>
<li><a
href="https://github.com/actions/cache/commit/4e380d19e192ace8e86f23f32ca6fdec98a673c6 "><code>4e380d1</code></a>
Fix cache key in examples.md for bun.lock</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...27d5ce7f107fe9357f9df03efb73ab90386fccae ">compare
view</a></li>
</ul>
</details>
<br />
Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/releases ">slackapi/slack-github-action's
releases</a>.</em></p>
<blockquote>
<h2>Slack GitHub Action v3.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>79529d7: fix: resolve url.parse deprecation warning for webhook
techniques</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md ">slackapi/slack-github-action's
changelog</a>.</em></p>
<blockquote>
<h1>slack-github-action</h1>
<h2>3.0.2</h2>
<h3>Patch Changes</h3>
<ul>
<li>79529d7: fix: resolve url.parse deprecation warning for webhook
techniques</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/03ea5433c137af7c0495bc0cad1af10403fc800c "><code>03ea543</code></a>
chore: release</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/90fee45e5a24e9528739e92f00a117715b567f60 "><code>90fee45</code></a>
chore: release (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/593 ">#593</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/b0fbce7f9b4377c9f74655f874e49a08e87de628 "><code>b0fbce7</code></a>
ci: send release announcements on publish (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/594 ">#594</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/0b9c067e72046525581ec13e37caa9d9435cbaec "><code>0b9c067</code></a>
build: automate release packaging and version bumps with changesets (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/592 ">#592</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/dd817b08e9a373b33f039b7d0ab4328a71425c78 "><code>dd817b0</code></a>
docs: update broken hyperlinks to docs (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/591 ">#591</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/7ce931db3e03539a3974cdb86b42df650e98ce36 "><code>7ce931d</code></a>
docs: streamlines doc structure (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/590 ">#590</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/093434f78f68609806ff1bed395f480e8ada3f8c "><code>093434f</code></a>
build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/589 ">#589</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/1f09fc7124315577beed7be7ebf027afb94ef524 "><code>1f09fc7</code></a>
build(deps-dev): bump typescript from 5.9.3 to 6.0.2 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/584 ">#584</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/79529d74f960df86c8beb7e51fb8e174fed0c65e "><code>79529d7</code></a>
build(deps): bump axios from 1.14.0 to 1.15.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/588 ">#588</a>)</li>
<li><a
href="https://github.com/slackapi/slack-github-action/commit/4414b7f01f5b1da26c98314521dcc5c802d0419e "><code>4414b7f</code></a>
build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (<a
href="https://redirect.github.com/slackapi/slack-github-action/issues/581 ">#581</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/slackapi/slack-github-action/compare/af78098f536edbc4de71162a307590698245be95...03ea5433c137af7c0495bc0cad1af10403fc800c ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-01 12:55:31 -05:00
ccdc35f8d7
ci: skip envoy e2e tests on nightly runs ( #8593 )
...
These require a more advanced setup.
Let's add this at a later time.
Signed-off-by: Johan Fylling <johan.dev@fylling.se >
2026-05-01 10:07:42 +02:00
23ccf9ead3
workflows: print less in benchmark workflow
...
It's the printing that takes the longest...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-30 21:31:48 +02:00
3937e5370d
ci: Test opa-envoy-plugin with nightly OPA build
...
Signed-off-by: Johan Fylling <johan.dev@fylling.se >
2026-04-30 20:45:46 +02:00
7bc92c6075
workflow: update benchmarks notebook generation
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-30 15:19:46 +02:00
686c66d717
build(deps): bump the gha-dependencies group with 2 updates ( #8576 )
...
Bumps the gha-dependencies group with 2 updates:
[actions/setup-node](https://github.com/actions/setup-node ) and
[github/codeql-action](https://github.com/github/codeql-action ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases ">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Dependency updates:</h3>
<ul>
<li>Upgrade <a
href="https://github.com/actions "><code>@actions</code></a>
dependencies by <a
href="https://github.com/Copilot "><code>@Copilot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1525 ">actions/setup-node#1525</a></li>
<li>Update Node.js versions in versions.yml and bump package to v6.4.0
by <a
href="https://github.com/priya-kinthali "><code>@priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1533 ">actions/setup-node#1533</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Copilot "><code>@Copilot</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1525 ">actions/setup-node#1525</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v6...v6.4.0 ">https://github.com/actions/setup-node/compare/v6...v6.4.0 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e "><code>48b55a0</code></a>
Update Node.js versions in versions.yml and bump package to v6.4.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1533 ">#1533</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/ab72c7e7eba0eaa11f8cab0f5679243900c2cac9 "><code>ab72c7e</code></a>
Upgrade <a href="https://github.com/actions "><code>@actions</code></a>
dependencies (<a
href="https://redirect.github.com/actions/setup-node/issues/1525 ">#1525</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e ">compare
view</a></li>
</ul>
</details>
<br />
Updates `github/codeql-action` from 4.35.1 to 4.35.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases ">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.35.2</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795 ">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789 ">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794 ">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807 ">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2 ">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823 ">#3823</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md ">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases ">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<ul>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852 ">#3852</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795 ">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789 ">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794 ">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807 ">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2 ">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823 ">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781 ">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<ul>
<li>Reduced the minimum Git version required for <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> from 2.38.0 to 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3767 ">#3767</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1 ">2.25.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3773 ">#3773</a></li>
</ul>
<h2>4.34.1 - 20 Mar 2026</h2>
<ul>
<li>Downgrade default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.3 ">2.24.3</a>
due to issues with a small percentage of Actions and JavaScript
analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3762 ">#3762</a></li>
</ul>
<h2>4.34.0 - 20 Mar 2026</h2>
<ul>
<li>Added an experimental change which disables TRAP caching when <a
href="https://redirect.github.com/github/roadmap/issues/1158 ">improved
incremental analysis</a> is enabled, since improved incremental analysis
supersedes TRAP caching. This will improve performance and reduce
Actions cache usage. We expect to roll this change out to everyone in
March. <a
href="https://redirect.github.com/github/codeql-action/pull/3569 ">#3569</a></li>
<li>We are rolling out improved incremental analysis to C/C++ analyses
that use build mode <code>none</code>. We expect this rollout to be
complete by the end of April 2026. <a
href="https://redirect.github.com/github/codeql-action/pull/3584 ">#3584</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.0 ">2.25.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3585 ">#3585</a></li>
</ul>
<h2>4.33.0 - 16 Mar 2026</h2>
<ul>
<li>
<p>Upcoming change: Starting April 2026, the CodeQL Action will skip
collecting file coverage information on pull requests to improve
analysis performance. File coverage information will still be computed
on non-PR analyses. Pull request analyses will log a warning about this
upcoming change. <a
href="https://redirect.github.com/github/codeql-action/pull/3562 ">#3562</a></p>
<p>To opt out of this change:</p>
<ul>
<li><strong>Repositories owned by an organization:</strong> Create a
custom repository property with the name
<code>github-codeql-file-coverage-on-prs</code> and the type
"True/false", then set this property to <code>true</code> in
the repository's settings. For more information, see <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization ">Managing
custom properties for repositories in your organization</a>.
Alternatively, if you are using an advanced setup workflow, you can set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using default setup:</strong> Switch
to an advanced setup workflow and set the
<code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable to
<code>true</code> in your workflow.</li>
<li><strong>User-owned repositories using advanced setup:</strong> Set
the <code>CODEQL_ACTION_FILE_COVERAGE_ON_PRS</code> environment variable
to <code>true</code> in your workflow.</li>
</ul>
</li>
<li>
<p>Fixed <a
href="https://redirect.github.com/github/codeql-action/issues/3555 ">a
bug</a> which caused the CodeQL Action to fail loading repository
properties if a "Multi select" repository property was
configured for the repository. <a
href="https://redirect.github.com/github/codeql-action/pull/3557 ">#3557</a></p>
</li>
<li>
<p>The CodeQL Action now loads <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization ">custom
repository properties</a> on GitHub Enterprise Server, enabling the
customization of features such as
<code>github-codeql-disable-overlay</code> that was previously only
available on GitHub.com. <a
href="https://redirect.github.com/github/codeql-action/pull/3559 ">#3559</a></p>
</li>
<li>
<p>Once <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries ">private
package registries</a> can be configured with OIDC-based authentication
for organizations, the CodeQL Action will now be able to accept such
configurations. <a
href="https://redirect.github.com/github/codeql-action/pull/3563 ">#3563</a></p>
</li>
<li>
<p>Fixed the retry mechanism for database uploads. Previously this would
fail with the error "Response body object should not be disturbed
or locked". <a
href="https://redirect.github.com/github/codeql-action/pull/3564 ">#3564</a></p>
</li>
<li>
<p>A warning is now emitted if the CodeQL Action detects a repository
property whose name suggests that it relates to the CodeQL Action, but
which is not one of the properties recognised by the current version of
the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3570 ">#3570</a></p>
</li>
</ul>
<h2>4.32.6 - 05 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/95e58e9a2cdfd71adc6e0353d5c52f41a045d225 "><code>95e58e9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3824 ">#3824</a>
from github/update-v4.35.2-d2e135a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/6f31bfe060e817d81e938dbec767969d20031e25 "><code>6f31bfe</code></a>
Update changelog for v4.35.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d2e135a73a39154e3a231aeb49163c4661c5b8b1 "><code>d2e135a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3823 ">#3823</a>
from github/update-bundle/codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/60abb65df09fcf213c398e064c8a80db1f15cdaf "><code>60abb65</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/5a0a562209255e956ad8aafcee303294e64eefa2 "><code>5a0a562</code></a>
Update default bundle to codeql-bundle-v2.25.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/65216971a11ded447a6b76263d5a144519e5eee1 "><code>6521697</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3820 ">#3820</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/3c45af2dd258e1623af1898da5c86545b514e028 "><code>3c45af2</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3821 ">#3821</a>
from github/dependabot/npm_and_yarn/npm-minor-345b93...</li>
<li><a
href="https://github.com/github/codeql-action/commit/f1c339364c12f922998186ed897e45e3b4ae8874 "><code>f1c3393</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/1024fc496c87e944a93e98d8cf2c09e2c7602a30 "><code>1024fc4</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/9dd4cfed96030ccdfe1af4daf7a7964322704fed "><code>9dd4cfe</code></a>
Bump the npm-minor group across 1 directory with 6 updates</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225 ">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-28 16:16:34 -05:00
76a5166b8b
workflows: bump setup-regal ( #8546 )
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-22 08:21:37 +00:00
973d83c6e5
build(deps): bump the gha-dependencies group with 3 updates ( #8539 )
...
* build(deps): bump the gha-dependencies group with 3 updates
Bumps the gha-dependencies group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action ), [actions/upload-artifact](https://github.com/actions/upload-artifact ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `github/codeql-action` from 4.32.4 to 4.35.1
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...c10b8064de6f491fea524254123dbe5e09572f13 )
Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f31590499237e7cce841e8e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
* update setup-opa
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-21 15:31:38 +00:00
8e31a0f1e7
Update Regal docs to v0.40.0 ( #8538 )
...
Add new rule docs, update adopters, and remove automated docs workflow
(broken due to hardening).
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-04-21 14:32:37 +00:00
f8c50574d8
Add generated output.jsons for docs examples ( #8535 )
...
This allows us to show the results of example evaluation before the user
clicks evaluate, but also for chatbots to see the output when viewing
without interaction.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-04-21 13:01:02 +00:00
22f8e8d0cd
fmt: restore indention level when handling unexpected comments ( #8534 )
...
* fmt: restore indention level when handling unexpected comments
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* add another test
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* support "rego-check-pr" in merge group
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-20 14:57:40 +00:00
d11fece3a3
Fix benchmarks check files changed ( #8530 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-17 08:35:21 -05:00
f6202bc049
Update benchmarks.yaml to use pr_check.rego ( #8526 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-17 12:11:14 +00:00
2ad3e3eb30
Test OCP and Regal during merge queue ( #8528 )
...
* Test OCP and Regal during merge queue
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* Test OCP and Regal during merge queue
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* fix permissions
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* ignore zizmor
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* set persist credentials to false
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 20:53:52 +00:00
fb5427972e
Run benchmarks in the merge queue ( #8525 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 19:01:35 +00:00
68eaef29dc
Add the latest videos to the README presentations section ( #8523 )
...
* Add the latest videos to the README presentations section
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* support merge queues in files changed check
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* zizmor ignore
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* zizmor ignore on run line
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* run PR checks as well so that the required PR check summary is run
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* give github action lint permission to upload
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 18:17:49 +00:00
069dc91cae
add merge_group build trigger to benchmarks ( #8522 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 10:48:16 -05:00
cd955f69d0
workflows: attempt to fix slack notifications
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 11:03:19 +02:00
ef9c47973b
workflows/nightly: use OCP ref (temporary workaround)
...
This should make the tests pass in CI, giving us a green nightly build.
On the next OCP release, we can revert this and go back to pulling the
latest release/tag.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 11:03:19 +02:00
159fe6b28d
workflows: fix nightly and release-vuln-check
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 09:17:01 +02:00
e7ccaed26f
benchmarks: bump nodejs (24 -> 25)
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 09:17:01 +02:00
a57f2ef42d
cicd: Split link checker into docs & repo checks ( #8492 )
...
We have fixed most of the broken links! But,
https://github.com/open-policy-agent/opa/issues/8464 is mostly not useful now
as we are checking the docs site internal links which are already checked at
build time which is done in PRs.
This change makes two jobs, one for the repo, and one for the docs site. The
OPA domain is ignored for website checks.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-04-07 15:05:44 +01:00
8479b69566
build(deps): bump actions/setup-go in the gha-dependencies group ( #8469 )
...
Bumps the gha-dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go ).
Updates `actions/setup-go` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...4a3601121dd01d1626a1e23e37211e3254c1c06c )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 09:32:00 -05:00
bad337a637
nightly: add OCP+Regal builds to catch breaking changes ( #8460 )
...
* nightly: add OCP build to catch breaking changes
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
* nightly: add Regal build + e2e test run w/ opa main
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
* .github: Add linter ignores for secrets-outside-env.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
Co-authored-by: Philip Conrad <philip@chariot-chaser.net >
2026-04-01 08:23:49 +02:00
a9aaac3070
workflows: remove trivy from nightly+release-vuln-check
...
Rationale: it's been under attack and it's not clear if its benefits right
now outweigh the risks.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-30 14:27:52 +02:00
9fd6f93be1
build(deps): bump the gha-dependencies group with 5 updates ( #8440 )
...
Bumps the gha-dependencies group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ) | `2.1.1` | `3.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `8.0.0` | `8.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.12.0` | `4.0.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) | `0.5.0` | `0.5.2` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) | `3.7.0` | `4.0.0` |
Updates `slackapi/slack-github-action` from 2.1.1 to 3.0.1
- [Release notes](https://github.com/slackapi/slack-github-action/releases )
- [Commits](https://github.com/slackapi/slack-github-action/compare/91efab103c0de0a537f72a35f6b8cda0ee76bf0a...af78098f536edbc4de71162a307590698245be95 )
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c )
Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd )
Updates `zizmorcore/zizmor-action` from 0.5.0 to 0.5.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d...71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 )
Updates `docker/setup-qemu-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...ce360397dd3f832beb865e1373c09c0e9f86d70a )
---
updated-dependencies:
- dependency-name: slackapi/slack-github-action
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: docker/setup-buildx-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: docker/setup-qemu-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 11:53:53 +01:00
654e445018
build(deps): bump the gha-dependencies group with 4 updates
...
Bumps the gha-dependencies group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go ), [actions/setup-node](https://github.com/actions/setup-node ), [actions/upload-artifact](https://github.com/actions/upload-artifact ) and [actions/download-artifact](https://github.com/actions/download-artifact ).
Updates `actions/setup-go` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417 )
Updates `actions/setup-node` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238...53b83947a5a98c8d113130e565377fae1a50d02f )
Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-10 09:37:08 +01:00
5116e8d7ab
gha: bump trivy-action
...
dependabot didn't do it because of our configured 7 day cooldown.
But hopefully this fixes the workflows that use it.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-10 09:36:41 +01:00
f205d9716c
nightly+release-vuln-check: add links to slack msg payloads
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-04 16:32:17 +01:00
c715c7caaf
build(deps): bump the gha-dependencies group with 3 updates
...
Bumps the gha-dependencies group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action ), [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action ) and [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ).
Updates `github/codeql-action` from 4.32.0 to 4.32.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b20883b0cd1f46c72ae0ba6d1090936928f9fa30...89a39a4e59826350b863aa6b6252a07ad50cf83e )
Updates `lycheeverse/lychee-action` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/lycheeverse/lychee-action/releases )
- [Commits](https://github.com/lycheeverse/lychee-action/compare/a8c4c7cb88f0c7386610c35eb25108e448569cb0...8646ba30535128ac92d33dfc9133794bfdd9b411 )
Updates `aquasecurity/trivy-action` from 0.34.0 to 0.34.1
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/c1824fd6edce30d7ab345a9989de00bbd46ef284...e368e328979b113139d6f9068e03accaed98a518 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: lycheeverse/lychee-action
dependency-version: 2.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: aquasecurity/trivy-action
dependency-version: 0.34.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-01 18:44:20 +01:00
eb18827f62
fix release-vulnerability-check.yaml
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-02-26 21:14:37 +01:00
167df6b57a
fix nightly.yaml by moving secret to env ( #8381 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-02-26 13:32:46 -06:00
b4b04a6219
ci: Fix check-changes job skipping over YAML changes. ( #8377 )
...
This commit fixes a copy/paste error from #8356 that resulted
in the YAML detection logic of the `check-changes` job setting
the wrong result for the job step's yaml changes output.
This bug caused downstream jobs to not see that YAML files were
altered at all in a PR, and YAML-specific jobs like the linter
and zizmor passes would not be run.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
2026-02-25 11:11:28 -05:00
dc7995efe7
workflows/benchmark: persist credentials, we need them for pushing
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-24 14:35:42 +01:00
019086bc3c
ci: Harden and update all GH Actions workflows.
...
This PR contains fixes for all findings by the static analysis
tool zizmor, and reduces the attack surface available in our
GH Actions workflows by a decent margin.
The most notable change: our post-tag workflow now does not
use the actions cache, to prevent cache poisoning attacks.
This will drive up release publishing times, but eliminates
an attack vector on those releases.
Other changes:
- We also update all of our Slack alerting steps to use the
official slackapi/slack-github-action project, instead of the
archived project we were using before.
- A new `yaml` change detection category to has been added
to the `check-changes` job, allowing later jobs and steps
in the pull-request workflow to run conditionally on
YAML-based changes.
- An explicit linting job that runs the zizmor Github Actions
static analysis tool on the repo when YAML changes are
detected.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
2026-02-23 07:00:32 +01:00
01229ed520
workflows: skip docs/ in release-vulnerability-check
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 11:17:50 +01:00
43fca92d4b
workflows: bump trivy-action (0.34.0, trivy 0.69.1)
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 11:17:50 +01:00
fd9c46c47a
workflows: add nightly vuln checks for released versions/images
...
This is almost what do in nightlies, but:
1. Not pulling docker images, trivy can do that -- we don't deal with
changing tags here (latest, edge), but concrete ones that don't get
overwritten in dockerhub ever.
2. It's a different, since we don't want nightly to turn red when there
is a vulnerability in the latest release, it's two separate concerns.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 09:28:41 +01:00
af61658027
docs: Add workflow to auto update Regal docs ( #8318 )
...
* docs: Add workflow to auto update regal docs
We want to automate the process of importing the
latest regal release's docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* docs: Remove review CC
This is not needed when we have reviewer set too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-16 11:47:42 +00:00
c256ef1f39
build: bump golang 1.25.7 -> 1.26.0
...
And raise `go` version in go.mod. 1.24.x is no longer supported.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-12 08:42:05 +01:00
b29b1dad76
docs/website: Markdown linting and spell checking for documentation ( #8292 )
...
* Add markdownlint tooling to docs
Install markdownlint-cli2 with configuration file and make targets for
auto fix etc too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Autofixable markdown issues
mainly, replace tabs with spaces for consistent 2-space indentation
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD059
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Fix a number of <link> issues
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD041
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD041
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD046
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD025
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD052
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD028
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD001
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Add GH action check in PRs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Use 4 spaces for tabs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Use 4 spaces for tabs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* docs: Add spell checking using Vale
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Correct comment for space indentation rule
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-05 10:20:13 +00:00
b1eb646ddc
docs/website: Add formatting and linting checks ( #8288 )
...
* Update baseline-browser-mapping to version 2.9.19
Addresses issue in build
[baseline-browser-mapping] The data in this module is over two
months old. To ensure accurate Baseline data, please update: `npm i
baseline-browser-mapping@latest -D`
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Add fmt and lint config for docs
This is based on dprint and eslint. Some vendored paths are ignored.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Format and lint docs project
Markdown linting will be added in another PR.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-03 17:01:54 +00:00
e86c554932
build(deps): bump the gha-dependencies group with 5 updates
...
Bumps the gha-dependencies group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `5.0.0` | `6.0.2` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.0.0` | `6.2.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.1.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.31.9` | `4.32.0` |
| [mlugg/setup-zig](https://github.com/mlugg/setup-zig ) | `2.1.0` | `2.2.1` |
Updates `actions/checkout` from 5.0.0 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v5...v6.0.2 )
Updates `actions/setup-go` from 6.0.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
Updates `actions/setup-node` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/395ad3262231945c25e8478fd5baf05154b1d79f...6044e13b5dc448c55e2357c09f80417699197238 )
Updates `github/codeql-action` from 4.31.9 to 4.32.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5d4e8d1aca955e8d8589aabd499c5cae939e33c7...b20883b0cd1f46c72ae0ba6d1090936928f9fa30 )
Updates `mlugg/setup-zig` from 2.1.0 to 2.2.1
- [Release notes](https://github.com/mlugg/setup-zig/releases )
- [Commits](https://github.com/mlugg/setup-zig/compare/fa65c4058643678a4e4a9a60513944a7d8d35440...d1434d08867e3ee9daa34448df10607b98908d29 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/setup-go
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: github/codeql-action
dependency-version: 4.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: mlugg/setup-zig
dependency-version: 2.2.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-02 13:22:37 +01:00
Stephan Renatus