chore(deps): update github-actions

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	digest	b4ffde6 -> a5ac7e5
actions/checkout	action	patch	v4.1.1 -> v4.1.6
actions/download-artifact	action	patch	v4.1.4 -> v4.1.7
actions/upload-artifact	action	patch	v4.3.1 -> v4.3.3
ianlewis/todo-issue-reopener	action	patch	v1.2.0 -> v1.2.1
ossf/scorecard-action	action	patch	v2.3.0 -> v2.3.3
sigstore/cosign-installer	action	minor	v3.4.0 -> v3.5.0

---

Release Notes

actions/checkout (actions/checkout)

v4.1.6

Compare Source

• Check platform to set archive extension appropriately by @​cory-miller in https://github.com/actions/checkout/pull/1732

v4.1.5

Compare Source

What's Changed

• Update NPM dependencies by @​cory-miller in https://github.com/actions/checkout/pull/1703
• Bump github/codeql-action from 2 to 3 by @​dependabot in https://github.com/actions/checkout/pull/1694
• Bump actions/setup-node from 1 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1696
• Bump actions/upload-artifact from 2 to 4 by @​dependabot in https://github.com/actions/checkout/pull/1695
• README: Suggest user.email to be 41898282+github-actions[bot]@​users.noreply.github.com by @​cory-miller in https://github.com/actions/checkout/pull/1707

Full Changelog: actions/checkout@v4.1.4...v4.1.5

v4.1.4

Compare Source

• Disable extensions.worktreeConfig when disabling sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1692
• Add dependabot config by @​cory-miller in https://github.com/actions/checkout/pull/1688
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot in https://github.com/actions/checkout/pull/1693
• Bump word-wrap from 1.2.3 to 1.2.5 by @​dependabot in https://github.com/actions/checkout/pull/1643

v4.1.3

Compare Source

What's Changed

• Update actions/checkout version in update-main-version.yml by @​jww3 in https://github.com/actions/checkout/pull/1650
• Check git version before attempting to disable sparse-checkout by @​jww3 in https://github.com/actions/checkout/pull/1656
• Add SSH user parameter by @​cory-miller in https://github.com/actions/checkout/pull/1685

Full Changelog: actions/checkout@v4.1.2...v4.1.3

v4.1.2

Compare Source

• Fix: Disable sparse checkout whenever sparse-checkout option is not present @​dscho in https://github.com/actions/checkout/pull/1598

actions/download-artifact (actions/download-artifact)

v4.1.7

Compare Source

What's Changed

• Update @​actions/artifact dependency by @​bethanyj28 in https://github.com/actions/download-artifact/pull/325

Full Changelog: actions/download-artifact@v4.1.6...v4.1.7

v4.1.6

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in https://github.com/actions/download-artifact/pull/324

Full Changelog: actions/download-artifact@v4.1.5...v4.1.6

v4.1.5

Compare Source

What's Changed

• Update readme with v3/v2/v1 deprecation notice by @​robherley in https://github.com/actions/download-artifact/pull/322
• Update dependencies @actions/core to v1.10.1 and @actions/artifact to v2.1.5

Full Changelog: actions/download-artifact@v4.1.4...v4.1.5

actions/upload-artifact (actions/upload-artifact)

v4.3.3

Compare Source

What's Changed

• updating @actions/artifact dependency to v2.1.6 by @​eggyhead in https://github.com/actions/upload-artifact/pull/565

Full Changelog: actions/upload-artifact@v4.3.2...v4.3.3

v4.3.2

Compare Source

What's Changed

• Update release-new-action-version.yml by @​konradpabjan in https://github.com/actions/upload-artifact/pull/516
• Minor fix to the migration readme by @​andrewakim in https://github.com/actions/upload-artifact/pull/523
• Update readme with v3/v2/v1 deprecation notice by @​robherley in https://github.com/actions/upload-artifact/pull/561
• updating @actions/artifact dependency to v2.1.5 and @actions/core to v1.0.1 by @​eggyhead in https://github.com/actions/upload-artifact/pull/562

New Contributors

• @​andrewakim made their first contribution in https://github.com/actions/upload-artifact/pull/523

Full Changelog: actions/upload-artifact@v4.3.1...v4.3.2

ianlewis/todo-issue-reopener (ianlewis/todo-issue-reopener)

v1.2.1

Compare Source

Fixed in 1.2.1

• Fixed the "error updating to TUF remote mirror: invalid key" error (#​688).

All changes

• fix: Update slsa-verifier version by @​ianlewis in https://github.com/ianlewis/todo-issue-reopener/pull/689
• chore(deps): Bump github/codeql-action from 3.23.2 to 3.25.5 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/711
• chore(deps): Bump codecov/codecov-action from 4.0.1 to 4.4.0 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/705
• chore(deps): Bump actions/upload-artifact from 4.3.0 to 4.3.3 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/670
• chore(deps-dev): Bump @​types/jest from 29.5.11 to 29.5.12 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/664
• chore(deps): Bump actions/setup-node from 4.0.1 to 4.0.2 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/605
• chore(deps): Bump yamllint from 1.33.0 to 1.35.1 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/598
• chore(deps-dev): Bump eslint-plugin-github from 4.9.1 to 4.10.2 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/592
• chore(deps): Bump thehanimo/pr-title-checker from 1.4.1 to 1.4.2 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/604
• chore(deps): Bump yaml from 2.3.4 to 2.4.2 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/727
• chore(deps-dev): Bump @​vercel/ncc from 0.36.1 to 0.38.1 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/635
• chore(deps-dev): Bump eslint from 8.56.0 to 8.57.0 by @​dependabot in https://github.com/ianlewis/todo-issue-reopener/pull/634
• chore(release): v1.2.1 by @​ianlewis in https://github.com/ianlewis/todo-issue-reopener/pull/833

Full Changelog: ianlewis/todo-issue-reopener@v1.2.0...v1.2.1

ossf/scorecard-action (ossf/scorecard-action)

v2.3.3

Compare Source

[!NOTE]
There is no v2.3.2 release as a step was skipped in the release process. This was fixed and re-released under the v2.3.3 tag

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 (v4.13.1) to github.com/ossf/scorecard/v5 (v5.0.0-rc1) by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1366
• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc1 to v5.0.0-rc2 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1374
• 🌱 Bump github.com/ossf/scorecard/v5 from v5.0.0-rc2 to v5.0.0-rc2.0.20240509182734-7ce860946928 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1377

For a full changelist of what these include, see the v5.0.0-rc1 and v5.0.0-rc2 release notes.

Documentation

• 📖 Move token discussion out of main README. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1279
• 📖 link to ossf/scorecard workflow instead of maintaining an example by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1352
• 📖 update api links to new scorecard.dev site by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1376

Full Changelog: ossf/scorecard-action@v2.3.1...v2.3.3

v2.3.2

Compare Source

v2.3.1

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
  • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

sigstore/cosign-installer (sigstore/cosign-installer)

v3.5.0

Compare Source

What's Changed

• Bump actions/checkout from 4.1.1 to 4.1.2 by @​dependabot in https://github.com/sigstore/cosign-installer/pull/157
• use go 1.22 now by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/160
• bump default version to v2.2.4, prep for v3.5.0 release by @​bobcallaway in https://github.com/sigstore/cosign-installer/pull/159

Full Changelog: sigstore/cosign-installer@v3.4.0...v3.5.0

---

Configuration

📅 Schedule: Branch creation - "before 4am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.