[dependabot]

Bumps the github-actions group with 3 updates: suzuki-shunsuke/pinact-action, docker/login-action and zizmorcore/zizmor-action.

Updates suzuki-shunsuke/pinact-action from 3.0.0 to 3.1.0

Release notes

Sourced from suzuki-shunsuke/pinact-action's releases.

v3.1.0

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v3.0.0...v3.1.0 | Base revision

This release includes all changes in v3.0.1.

Features

#1217 Sign JSON Web Tokens with AWS KMS

A GitHub App private key stored in GitHub Secrets never expires, and anyone who obtains it can generate access tokens as long as the key stays registered. You can now keep the private key in AWS KMS instead. The key can never be exported, and only the JSON Web Token signing is delegated to KMS.

- uses: suzuki-shunsuke/pinact-action@v3.1.0
  with:
    client_id: ${{vars.APP_CLIENT_ID}}
    aws_kms_key_id: ${{vars.KMS_KEY_ID}}
    aws_role_to_assume: ${{vars.AWS_ROLE_ARN}}

New inputs:

purpose	app	Securefix app
identify the app	client_id (new) or app_id	securefix_client_id (new) or securefix_app_id
KMS key	aws_kms_key_id	securefix_aws_kms_key_id
IAM role	aws_role_to_assume	securefix_aws_role_to_assume
region	aws_region	securefix_aws_region

• client_id and securefix_client_id can be used instead of app_id and securefix_app_id. GitHub recommends the Client ID. When both are set, the Client ID takes precedence.
• aws_role_to_assume assumes the IAM role with the GitHub OIDC token inside the action, so the AWS credentials are never exported to later steps of the job. The job needs the permission id-token: write. If it's not set, the standard AWS credential environment variables are used, so aws-actions/configure-aws-credentials also works.
• The securefix_ role and region fall back to the unprefixed ones.

Existing workflows using app_id and app_private_key need no change.

Fixes

#1227 Install pinact when the caller has no aqua configuration

In a repository without its own aqua configuration, the action failed before running pinact:

ERR aqua failed exe_name=pinact error="command is not found"

The action's bundled aqua configuration wasn't found correctly, so the action only worked when the caller's repository had an aqua configuration to fall back to. This has been broken since the action was rewritten in JavaScript (#838).

Behavior change

... (truncated)

Commits

• b1a1f46 chore: prepare release v3.1.0
• 4a4d933 chore(deps): update dependency aquaproj/aqua to v2.65.2 (#1303)
• bac0fed chore: update aqua installed by the action and let Renovate track it (#1302)
• 283e850 chore(deps): update dependency suzuki-shunsuke/cmdx to v2.0.3 (#1290)
• 24b7686 chore(deps): update dependency aquaproj/aqua-registry to v4.576.0 (#1289)
• dd64e8b chore(deps): update suzuki-shunsuke/js-action-test-workflow action to v0.0.4 ...
• 0772425 chore(deps): update suzuki-shunsuke/js-action-release-workflow action to v0.0...
• a5c74a2 chore(deps): update suzuki-shunsuke/js-autofix-action action to v0.0.7 (#1301)
• fc0e2e4 ci: use the shared workflows for JavaScript Actions (#1278)
• 9b4f671 chore(deps): lock file maintenance (#1298)
• Additional commits viewable in compare view

Updates docker/login-action from 4.7.0 to 4.8.0

Release notes

Sourced from docker/login-action's releases.

v4.8.0

• Set Docker Hub OIDC token lifetime default to 1 hour by @​crazy-max in docker/login-action#1070
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1161.0 in docker/login-action#1103
• Bump @​docker/actions-toolkit from 0.107.0 to 0.109.0 in docker/login-action#1105
• Bump vite from 7.3.6 to 7.3.7 in docker/login-action#1101

Full Changelog: docker/login-action@v4.7.0...v4.8.0

Commits

• 8aa5831 Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...
• 043f81d [dependabot skip] chore: update generated content
• 3ff6998 build(deps): bump @​docker/actions-toolkit from 0.107.0 to 0.109.0
• 694ef6a Merge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• 7c6e412 [dependabot skip] chore: update generated content
• aa2441f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• d6c10b0 Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...
• 319f1ee Merge pull request #1104 from docker/dependabot/github_actions/actions/setup-...
• b483b7f Merge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7
• dc7d67c Merge pull request #1070 from crazy-max/increase-oidc-default-expiry
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.8.0 to 0.8.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.1

Sponsorship is appreciated!

zizmor 1.32 is now the default version used by this action.

Full release notes: zizmorcore/zizmor-action#1320

Full Changelog: zizmorcore/zizmor-action@v0.8.0...v0.8.1

Commits

• 45d7276 Sync zizmor versions (#191)
• ff38741 chore(deps): bump the github-actions group across 1 directory with 2 updates ...
• 4a9eca4 README: another troubleshooting section (#186)
• 83a0416 Bump pins (#185)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions