chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	pinDigest	-> e12d46a
actions/checkout	action	pinDigest	-> f43a0e5
aquaproj/aqua-installer	action	minor	v2.0.2 -> v2.3.2
codecov/codecov-action	action	patch	v3.1.1 -> v3.1.6
docker/login-action	action	pinDigest	-> 465a078
elgohr/go-vulncheck-action	action	digest	90e331d -> e73217f
github/codeql-action	action	pinDigest	-> e113c55
magefile/mage-action	action	digest	3b833fb -> a3d5bb5

---

Release Notes

aquaproj/aqua-installer (aquaproj/aqua-installer)

v2.3.2

Compare Source

#​607 export environment variable AQUA_DISABLE_COSIGN and AQUA_DISABLE_SLSA

https://github.com/aquaproj/aqua/issues/2759

To disable Cosign and slsa-verifier on subsequent steps.

v2.3.1

Compare Source

#​605 Disable Cosign and slsa-verifier

Until we will finish upgrading Cosign to v2, we disable Cosign and slsa-verifier.

https://github.com/aquaproj/aqua/issues/1665#issuecomment-2008588288

v2.3.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.2.0...v2.3.0

Features

#​580 Support disabling the verification with Cosign and SLSA Provenance

[!CAUTION]
This feature is for users who can't use Cosign and slsa-verifier.
Most users can use them, so most users don't need this feature.
aqua installs Cosign and slsa-verifier internally, so you don't need to install them yourself.
If you can use Cosign and slsa-verifier, you should not disable them because they are important for security.

The bootstrap version is updated to aqua v2.22.0.
From this version, aqua supports disabling the verification with Cosign and SLSA Provenance.

To disable the verification with Cosign and SLSA Provenance when you install aqua with aqua-installer,
please set the environment variables AQUA_DISABLE_COSIGN and AQUA_DISABLE_SLSA.

export AQUA_DISABLE_COSIGN=true
export AQUA_DISABLE_SLSA=true
./aqua-installer

- uses: aquaproj/aqua-installer@v2.3.0
  with:
    aqua_version: v2.22.0
  env:
    AQUA_DISABLE_COSIGN: "true"
    AQUA_DISABLE_SLSA: "true"

v2.2.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.1.3...v2.2.0

Features

#​365 #​550 #​551 Output the guide to set the environment variable PATH

aqua-installer outputs the following guide.

===============================================================
[INFO] aqua is installed into /root/.local/share/aquaproj-aqua/bin/aqua
[INFO] Please add the path to the environment variable "PATH"
[INFO] export PATH=${AQUA_ROOT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/aquaproj-aqua}/bin:$PATH
===============================================================

#​551 Use wget if curl isn't found

v2.1.3

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.1.2...v2.1.3

#​545 Update the bootstrap version to v2.16.4

To support aqua v2.17.0 or later on Windows.

https://github.com/aquaproj/aqua/releases/tag/v2.16.1

To upgrade aqua to v2.17.0 or later on Windows, you need to upgrade aqua to v2.16.1 or later first.

v2.1.2

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.1.1...v2.1.2

Fixes

#​432 Fix typo
#​461 #​463 Fix a bug that action doesn't work in a container

Fix a bug that action doesn't work in a container

#​461 #​463

GitHub Actions supports running a job in a container.

https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container

But in a container the variable ${{ github.action_path }} is wrong, so action can't access the script aqua-installer.
This is a known issue of GitHub Actions.

• https://github.com/actions/runner/issues/2185

To solve the issue, we copy the content of the script aqua-installer into action itself, then action don't have to access the script aqua-installer.

v2.1.1

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.1.0...v2.1.1

Others

#​411 Update the bootstrapping aqua v1.26.2 to v2.2.3

This update enables to verify prerelease versions by Cosign and slsa-verifier.

ref. https://aquaproj.github.io/docs/reference/upgrade-guide/v2/change-semver

v2.1.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-installer@v2.0.2...v2.1.0

Features

#​403 Add an input policy_allow to run aqua policy allow

aqua >= v2.3.0

If policy_allow is true, aqua policy allow command is run.
If a Policy file path is set, aqua policy allow "${{inputs.policy_allow}}" is run.

See also

• Tutorial
• Reference
• Reference - Git Repository root's policy file and policy commands

codecov/codecov-action (codecov/codecov-action)

v3.1.6

Compare Source

Full Changelog: codecov/codecov-action@v3.1.5...v3.1.6

v3.1.5

Compare Source

What's Changed

• action.yml: Update to Node.js 20 by @​hallabro in https://github.com/codecov/codecov-action/pull/1228

New Contributors

• @​hallabro made their first contribution in https://github.com/codecov/codecov-action/pull/1228

Full Changelog: codecov/codecov-action@v3.1.4...v3.1.5

v3.1.4: 3.1.4

Compare Source

What's Changed

• build(deps-dev): bump @​types/node from 18.15.12 to 18.16.3 by @​dependabot in https://github.com/codecov/codecov-action/pull/970
• Fix typo in README.md by @​hisaac in https://github.com/codecov/codecov-action/pull/967
• fix: add back in working dir by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/971
• fix: CLI option names for uploader by @​kleisauke in https://github.com/codecov/codecov-action/pull/969
• build(deps-dev): bump @​types/node from 18.16.3 to 20.1.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/975
• build(deps-dev): bump @​types/node from 20.1.0 to 20.1.2 by @​dependabot in https://github.com/codecov/codecov-action/pull/979
• build(deps-dev): bump @​types/node from 20.1.2 to 20.1.4 by @​dependabot in https://github.com/codecov/codecov-action/pull/981
• release: 3.1.4 by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/983

New Contributors

• @​hisaac made their first contribution in https://github.com/codecov/codecov-action/pull/967
• @​kleisauke made their first contribution in https://github.com/codecov/codecov-action/pull/969

Full Changelog: codecov/codecov-action@v3.1.3...v3.1.4

v3.1.3: 3.1.3

Compare Source

What's Changed

• build(deps-dev): bump jest-junit from 15.0.0 to 16.0.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/957
• build(deps): bump openpgp from 5.7.0 to 5.8.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/958
• build(deps-dev): bump @​types/node from 18.15.10 to 18.15.12 by @​dependabot in https://github.com/codecov/codecov-action/pull/959
• fix: allow for aarch64 build by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/960
• chore(release): bump to 3.1.3 by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/961

Full Changelog: codecov/codecov-action@v3.1.2...v3.1.3

v3.1.2: 3.1.2

Compare Source

What's Changed

• build(deps): bump node-fetch from 3.2.4 to 3.2.10 by @​dependabot in https://github.com/codecov/codecov-action/pull/835
• build(deps-dev): bump @​types/node from 16.11.40 to 18.13.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/911
• build(deps-dev): bump @​vercel/ncc from 0.34.0 to 0.36.1 by @​dependabot in https://github.com/codecov/codecov-action/pull/900
• build(deps-dev): bump typescript from 4.7.4 to 4.9.5 by @​dependabot in https://github.com/codecov/codecov-action/pull/905
• Update README.md by @​stefanomunarini in https://github.com/codecov/codecov-action/pull/718
• build(deps): bump openpgp from 5.4.0 to 5.5.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/819
• build(deps): bump ossf/scorecard-action from 1.1.1 to 2.0.4 by @​dependabot in https://github.com/codecov/codecov-action/pull/840
• build(deps): bump @​actions/core from 1.9.1 to 1.10.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/841
• build(deps): bump @​actions/github from 5.0.3 to 5.1.1 by @​dependabot in https://github.com/codecov/codecov-action/pull/843
• build(deps): bump actions/upload-artifact from 3.1.0 to 3.1.2 by @​dependabot in https://github.com/codecov/codecov-action/pull/896
• build(deps-dev): bump jest-junit from 13.2.0 to 15.0.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/872
• build(deps): bump node-fetch from 3.2.10 to 3.3.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/869
• build(deps): bump decode-uri-component from 0.2.0 to 0.2.2 by @​dependabot in https://github.com/codecov/codecov-action/pull/879
• build(deps): bump json5 from 2.2.1 to 2.2.3 by @​dependabot in https://github.com/codecov/codecov-action/pull/895
• codeql-analysis.yml by @​minumulasri in https://github.com/codecov/codecov-action/pull/898
• build(deps): bump ossf/scorecard-action from 1.1.1 to 2.1.2 by @​dependabot in https://github.com/codecov/codecov-action/pull/889
• build(deps-dev): bump @​types/node from 18.13.0 to 18.14.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/922
• build(deps): bump openpgp from 5.5.0 to 5.7.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/924
• build(deps-dev): bump @​types/node from 18.14.0 to 18.14.2 by @​dependabot in https://github.com/codecov/codecov-action/pull/927
• Remove unsupported path_to_write_report argument by @​jsoref in https://github.com/codecov/codecov-action/pull/851
• Update README to contain correct information - inputs and negate feature by @​moshe-azaria-sage in https://github.com/codecov/codecov-action/pull/901
• build(deps-dev): bump @​types/node from 18.14.2 to 18.14.6 by @​dependabot in https://github.com/codecov/codecov-action/pull/933
• build(deps-dev): bump @​types/node from 18.14.6 to 18.15.0 by @​dependabot in https://github.com/codecov/codecov-action/pull/937
• build(deps-dev): bump @​types/node from 18.15.0 to 18.15.5 by @​dependabot in https://github.com/codecov/codecov-action/pull/945
• build(deps): bump node-fetch from 3.3.0 to 3.3.1 by @​dependabot in https://github.com/codecov/codecov-action/pull/938
• build(deps-dev): bump @​types/node from 18.15.5 to 18.15.6 by @​dependabot in https://github.com/codecov/codecov-action/pull/946
• build(deps-dev): bump @​types/node from 18.15.6 to 18.15.10 by @​dependabot in https://github.com/codecov/codecov-action/pull/947
• build(deps): bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @​dependabot in https://github.com/codecov/codecov-action/pull/951
• fix: add in all the extra arguments for uploader by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/955
• chore(release): bump to 3.1.2 by @​thomasrockhu-codecov in https://github.com/codecov/codecov-action/pull/956

New Contributors

• @​stefanomunarini made their first contribution in https://github.com/codecov/codecov-action/pull/718
• @​minumulasri made their first contribution in https://github.com/codecov/codecov-action/pull/898
• @​jsoref made their first contribution in https://github.com/codecov/codecov-action/pull/851
• @​moshe-azaria-sage made their first contribution in https://github.com/codecov/codecov-action/pull/901

Full Changelog: codecov/codecov-action@v3.1.1...v3.1.2

---

Configuration

📅 Schedule: Branch creation - "every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.