deps: ci: bump actions/attest-build-provenance from 2 to 3
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 20/100
- Issue 类型
- 重构
- 描述清晰度
- 基本清楚
- 活跃度
- 停滞
- 技术栈
- github-actions
- 领域
- ci-cd
调研方向
审查 PR #54 并定位对 actions/attest-build-provenance 的 workflow 引用。根据 release notes 检查升级内容，包括最低 runner 版本 v2.327.1，然后验证 CI 是否在版本 3 下通过；当依赖项已更新且 workflow 没有失败时，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Dependabot Update
Bumps actions/attest-build-provenance from 2 to 3.
Release notes
Sourced from actions/attest-build-provenance's releases.
v3.0.0
What's Changed
- Adjust node max-http-header-size setting by
@bdehamerin actions/attest-build-provenance#687- Bump actions/attest from v2.4.0 to v3.0.0 by
@bdehamerin actions/attest-build-provenance#691
- Bump to node24 runtime
- Improved checksum parsing
- Bump attest-build-provenance/predicate to v2.0.0 by
@bdehamerin actions/attest-build-provenance#693
- Bump to node24 runtime by
@bdehamerin actions/attest-build-provenance#692⚠️ Minimum Compatible Runner Version
v2.327.1 Release Notes
Make sure your runner is updated to this version or newer to use this release.
Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.4.0...v3.0.0
v2.4.0
What's Changed
- Bump undici from 5.28.5 to 5.29.0 by
@dependabotin actions/attest-build-provenance#633- Bump actions/attest from 2.3.0 to 2.4.0 by
@bdehamerin actions/attest-build-provenance#654
- Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run
Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0
v2.3.0
What's Changed
- Bump
actions/attestfrom 2.2.1 to 2.3.0 by@bdehamerin actions/attest-build-provenance#615
- Updates
@sigstore/ocifrom 0.4.0 to 0.5.0Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0
v2.2.3
What's Changed
- Pin actions/attest reference by commit SHA by
@bdehamerin actions/attest-build-provenance#493Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3
v2.2.2
What's Changed
- Bump predicate action from 1.1.4 to 1.1.5 by
@bdehamerin actions/attest-build-provenance#485
- Bump
@actions/attestfrom 1.5.0 to 1.6.0 by@bdehamerin actions/attest-build-provenance#484
- Update buildSLSAProvenancePredicate to populate
workflow.reffield from therefclaim in the OIDC token (actions/toolkit#1969)Full Changelog: https://github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2
v2.2.1
... (truncated)
Commits
977bb37bump attest-build-provenance/predicate to v2.0.0 (#693)864457aBump to node24 runtime (#692)57aa2b0bump actions/attest from v2.4.0 to v3.0.0 (#691)8ee7163refactor eslint config (#690)91ca1c2Bump actions/checkout from 4.1.1 to 5.0.0 (#684)ff19f40custom node max-http-header-size (#687)8bd83f1pin workflow deps (#683)f0878deBump the npm-development group with 4 updates (#681)463e6dfBump the npm-development group with 3 updates (#678)fef91c1Bump the npm-development group with 6 updates (#673)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Pull Request
- PR: #54
- Author: @dependabot[bot]
- URL: https://github.com/aRustyDev/gh/pull/54
This issue was automatically created to track the Dependabot update.
- 主要语言
- Shell
- 星标
- 0
- 派生
- 0
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aRustyDev/gh 的其他 Issue
-
dependencies github-actions
难度 1/5 1 小时以内 新手友好度 10/100
-
dependencies github-actions
难度 1/5 1 小时以内 新手友好度 15/100
-
dependencies github-actions
难度 1/5 1 小时以内 新手友好度 50/100
-
dependencies github-actions
难度 2/5 1-3 小时 新手友好度 10/100
-
dependencies github-actions
难度 2/5 1-3 小时 新手友好度 45/100
相似的 Issue
-
[cifuzz] "Minimizing crashes reduces fuzzing time" is logged for every batch run, even with minimize-crashes off可能已有人在做 @martinfrancois 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 1 天内回复
-
enhancement
难度 1/5 1 小时以内 新手友好度 85/100
alunduil/alunduil-chezmoi#914 ·
维护者通常 1 天内回复
-
cao-evolution cao-evolution:compiler-security
难度 1/5 1 小时以内 新手友好度 86/100
githubnext/gh-aw-cao#17586 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
-
bug
难度 1/5 1 小时以内 新手友好度 84/100
维护者通常 1 天内回复