ci: bump the github-actions group with 3 updates#123
Merged
Conversation
dependabot
bot
added
dependencies
Member
|
@dependabot rebase |
Bumps the github-actions group with 3 updates: [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action), [github/codeql-action](https://github.com/github/codeql-action) and [securego/gosec](https://github.com/securego/gosec). Updates `aquasecurity/trivy-action` from 0.30.0 to 0.33.1 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@0.30.0...0.33.1) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) Updates `securego/gosec` from 2.22.4 to 2.22.11 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@v2.22.4...v2.22.11) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: securego/gosec dependency-version: 2.22.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/github_actions/github-actions-ce696dd1c8
branch
from
2b56a0e to
2671fa2
Compare
jeremy
deleted the
dependabot/github_actions/github-actions-ce696dd1c8
branch
jeremy
pushed a commit
that referenced
this pull request
Feb 19, 2026
Bumps the github-actions group with 3 updates: [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action), [github/codeql-action](https://github.com/github/codeql-action) and [securego/gosec](https://github.com/securego/gosec). Updates `aquasecurity/trivy-action` from 0.30.0 to 0.33.1 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@0.30.0...0.33.1) Updates `github/codeql-action` from 3 to 4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) Updates `securego/gosec` from 2.22.4 to 2.22.11 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@v2.22.4...v2.22.11) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: securego/gosec dependency-version: 2.22.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
robzolkos
added a commit
that referenced
this pull request
Mar 12, 2026
When assigning with an invalid ID, the user would go through the
interactive person picker only to hit a "resource not found" error
afterward. Now the item is fetched first, surfacing a friendly
type-specific error ("to-do #123 not found", "card #456 not found",
"step #789 not found") before any interactive prompts.
jeremy
added a commit
that referenced
this pull request
Mar 13, 2026
* Validate item exists before showing person picker in assign/unassign
When assigning with an invalid ID, the user would go through the
interactive person picker only to hit a "resource not found" error
afterward. Now the item is fetched first, surfacing a friendly
type-specific error ("to-do #123 not found", "card #456 not found",
"step #789 not found") before any interactive prompts.
* Address PR review: type-safe validation, fix step 404 bug, add tests
- Replace validateItem/any with typed validateTodo/validateCard/validateStep
functions, eliminating unchecked type assertions and nolint suppressions
- Fix bug where getStep's convertSDKError call prevented step 404s from
producing the friendly "step not found" error
- Add tests for notFoundOrConvert covering all three item types and
non-404 passthrough
* Restore non-interactive error precedence for assign/unassign
The validate-before-picker change moved item lookup before
resolveAssignee, so non-interactive callers missing --to/--from
now hit a network call before the cheap ErrUsageHint. Add an
early guard after resolveProjectID that short-circuits with the
usage hint in non-interactive mode, preserving the interactive
person-picker flow unchanged.
* Fix test determinism: explicitly set non-interactive flag
The guard tests relied on os.Stdout not being a TTY to make
IsInteractive() return false. Under a PTY (e.g. script(1)),
the tests took the interactive path and failed. Set Flags.JSON
in the helper to make the non-interactive state explicit.
* Remove unused t field from assignGuardTransport, fix stale comment
The field was left over from an earlier iteration that used t.Fatalf;
the transport now returns an error instead. Update comment and helper
doc to match.
---------
Co-authored-by: Jeremy Daer <jeremy@37signals.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 3 updates: aquasecurity/trivy-action, github/codeql-action and securego/gosec.
Updates
aquasecurity/trivy-actionfrom 0.30.0 to 0.33.1Release notes
Sourced from aquasecurity/trivy-action's releases.
Commits
b6643a2Update setup-trivy action to version v0.2.4 (#486)f9424c1Merge pull request #481 from aquasecurity/bump-trivy-175589825185abccbdev: delete fanal.db before testsa169870ci: update golden files on Trivy bump71f6a8fdev: add update-golden goalbf330b1test: update golden files644762eMerge pull request #482 from aquasecurity/fix-gh-actionsf2e2851chore(ci): Add oras to correctly setup sync jobs636fd3cfix: update tests7c0244bchore(deps): Update trivy to v0.65.0Updates
github/codeql-actionfrom 3 to 4Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
9469107Update changelog for v4.31.111601acfMerge pull request #3415 from github/henrymercer/address-telemetry-gapfba7872Address review commentsa8dd5abMerge pull request #3414 from github/dependabot/npm_and_yarn/lodash-4.17.2328bfb7bOmit error from start-proxy Action91f3460Throw if in test modeedebb78Differentiate unhandled errors in telemetry529c266UsegetErrorMessagein more places6bd84b6Rename to "unhandled"5e98e18Merge pull request #3410 from github/dependabot/npm_and_yarn/tar-7.5.6Updates
securego/gosecfrom 2.22.4 to 2.22.11Release notes
Sourced from securego/gosec's releases.
... (truncated)
Commits
424fc4cfeature: add rule for trojan source (#1431)aa2e2fbfeat(ai): add OpenAI and custom API provider support (#1424)b6eea26chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#1437)41f28e2chore(deps): update module google.golang.org/genai to v1.37.0 (#1435)daccba6refactor: simplify report functions in main.go (#1434)d4be287Update go to 1.25.5 and 1.24.11 in CI (#1433)fde7515chore(deps): update all dependencies (#1425)20c9506feat(ai): add support for latest Claude models and update provider flags (#1423)bd9e372Bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#1427)7aa7e93chore(deps): update module golang.org/x/crypto to v0.45.0 [security] (#1428)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions