From e281cb65f92eab18cf25cea995e9abbe595c3700 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Oct 2025 13:04:42 +0000 Subject: [PATCH 1/5] deps(actions): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 (#112486) deps(actions): bump peter-evans/create-or-update-comment Bumps [peter-evans/create-or-update-comment](https://github.com/peter-evans/create-or-update-comment) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/peter-evans/create-or-update-comment/releases) - [Commits](https://github.com/peter-evans/create-or-update-comment/compare/71345be0265236311c031f5c7866368bd1eff043...e8674b075228eee787fea43ef493e45ece1004c9) --- updated-dependencies: - dependency-name: peter-evans/create-or-update-comment dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index ded468b0110..33b3656bd2d 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -333,7 +333,7 @@ jobs: body-includes: GitHub Actions Build token: ${{ steps.generate_token.outputs.token }} - name: Create or update comment - uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v4 with: token: ${{ steps.generate_token.outputs.token }} comment-id: ${{ steps.fc.outputs.comment-id }} From b7eb5661950a7c58bcd21a837b31540c146695b5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Oct 2025 13:05:40 +0000 Subject: [PATCH 2/5] deps(actions): bump github/actions-oidc-debugger from 2e9ba5d3f4bebaad1f91a2cede055115738b7ae8 to bc12dcf1a852221e54f27c95b2db36d135c1b97f (#112482) deps(actions): bump github/actions-oidc-debugger Bumps [github/actions-oidc-debugger](https://github.com/github/actions-oidc-debugger) from 2e9ba5d3f4bebaad1f91a2cede055115738b7ae8 to bc12dcf1a852221e54f27c95b2db36d135c1b97f. - [Release notes](https://github.com/github/actions-oidc-debugger/releases) - [Commits](https://github.com/github/actions-oidc-debugger/compare/2e9ba5d3f4bebaad1f91a2cede055115738b7ae8...bc12dcf1a852221e54f27c95b2db36d135c1b97f) --- updated-dependencies: - dependency-name: github/actions-oidc-debugger dependency-version: bc12dcf1a852221e54f27c95b2db36d135c1b97f dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release-npm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml index 4dd92e9d0a1..aa39a625774 100644 --- a/.github/workflows/release-npm.yml +++ b/.github/workflows/release-npm.yml @@ -124,7 +124,7 @@ jobs: run: ./scripts/validate-npm-packages.sh - name: Debug OIDC Claims - uses: github/actions-oidc-debugger@2e9ba5d3f4bebaad1f91a2cede055115738b7ae8 + uses: github/actions-oidc-debugger@bc12dcf1a852221e54f27c95b2db36d135c1b97f with: audience: '${{ github.server_url }}/${{ github.repository_owner }}' From b762bdcaf7641054d71f49d8051c678eef5430fc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Oct 2025 13:06:25 +0000 Subject: [PATCH 3/5] deps(actions): bump trufflesecurity/trufflehog from 3.90.9 to 3.90.11 (#112483) Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.90.9 to 3.90.11. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Changelog](https://github.com/trufflesecurity/trufflehog/blob/main/.goreleaser.yml) - [Commits](https://github.com/trufflesecurity/trufflehog/compare/e88e7d019eb84ca64f6b768c82eb6bf1a6271401...ad6fc8fb446b8fafbf7ea8193d2d6bfd42f45690) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.90.11 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/trufflehog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml index b045df5a144..7278c8ad3ed 100644 --- a/.github/workflows/trufflehog.yml +++ b/.github/workflows/trufflehog.yml @@ -31,6 +31,6 @@ jobs: persist-credentials: false fetch-depth: ${{ steps.fetch_depth.outputs.fetch_depth }} - name: Trufflehog - uses: trufflesecurity/trufflehog@e88e7d019eb84ca64f6b768c82eb6bf1a6271401 # v3.90.9 + uses: trufflesecurity/trufflehog@ad6fc8fb446b8fafbf7ea8193d2d6bfd42f45690 # v3.90.11 with: extra_args: --results=verified From 252ac753680d3db28d92d282a94967d8eb35af86 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Oct 2025 13:07:26 +0000 Subject: [PATCH 4/5] deps(actions): bump aquasecurity/setup-trivy from 0.2.3 to 0.2.4 (#112485) Bumps [aquasecurity/setup-trivy](https://github.com/aquasecurity/setup-trivy) from 0.2.3 to 0.2.4. - [Release notes](https://github.com/aquasecurity/setup-trivy/releases) - [Commits](https://github.com/aquasecurity/setup-trivy/compare/9ea583eb67910444b1f64abf338bd2e105a0a93d...e6c2c5e321ed9123bda567646e2f96565e34abe1) --- updated-dependencies: - dependency-name: aquasecurity/setup-trivy dependency-version: 0.2.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/trivy-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index c9fe0b8cdab..b8eb3c59616 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -20,7 +20,7 @@ jobs: with: persist-credentials: false - name: Install Trivy - uses: aquasecurity/setup-trivy@9ea583eb67910444b1f64abf338bd2e105a0a93d + uses: aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 with: version: v0.56.2 cache: true From 16b02e86fab9caf238f14b0e27b856afb17d88da Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Oct 2025 13:07:43 +0000 Subject: [PATCH 5/5] deps(actions): bump actions/download-artifact from 4 to 5 (#112484) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/backport-workflow.yml | 2 +- .../detect-breaking-changes-levitate.yml | 6 +++--- .github/workflows/pr-e2e-tests.yml | 16 ++++++++-------- .github/workflows/publish-artifact.yml | 2 +- .github/workflows/release-build.yml | 12 ++++++------ 5 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/backport-workflow.yml b/.github/workflows/backport-workflow.yml index 245e79cc6f7..f3d6761440c 100644 --- a/.github/workflows/backport-workflow.yml +++ b/.github/workflows/backport-workflow.yml @@ -36,7 +36,7 @@ jobs: private_key: ${{ fromJSON(steps.secrets.outputs.secrets).APP_PEM }} - name: Download PR info artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 id: download-pr-info with: github-token: ${{ github.token }} diff --git a/.github/workflows/detect-breaking-changes-levitate.yml b/.github/workflows/detect-breaking-changes-levitate.yml index a646c1983a2..13ee0955932 100644 --- a/.github/workflows/detect-breaking-changes-levitate.yml +++ b/.github/workflows/detect-breaking-changes-levitate.yml @@ -141,12 +141,12 @@ jobs: node-version-file: '.nvmrc' - name: Get built packages from pr - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: buildPr - name: Get built packages from base - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: buildBase @@ -225,7 +225,7 @@ jobs: persist-credentials: false - name: 'Download artifact' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: levitate diff --git a/.github/workflows/pr-e2e-tests.yml b/.github/workflows/pr-e2e-tests.yml index 63dd2952534..bc37f344b65 100644 --- a/.github/workflows/pr-e2e-tests.yml +++ b/.github/workflows/pr-e2e-tests.yml @@ -159,7 +159,7 @@ jobs: with: registry: 'us-docker.pkg.dev' environment: 'dev' - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: grafana-docker-tar-gz path: . @@ -221,10 +221,10 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v5 with: name: grafana-tar-gz - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v5 with: name: ${{ needs.build-e2e-runner.outputs.artifact }} - name: chmod +x @@ -298,7 +298,7 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v5 with: name: grafana-tar-gz - name: Run E2E tests @@ -360,7 +360,7 @@ jobs: run: | docker cp cpp-e2e-deploy:/outputs.json /tmp/outputs.json - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v5 with: name: grafana-tar-gz @@ -400,7 +400,7 @@ jobs: node-version-file: '.nvmrc' - name: Download blob reports from GitHub Actions Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: path: blobs pattern: playwright-blob-* @@ -479,7 +479,7 @@ jobs: - uses: actions/checkout@v5 with: persist-credentials: false - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v5 with: name: grafana-tar-gz - name: Run PR a11y test @@ -531,7 +531,7 @@ jobs: - name: Install dependencies run: yarn install --immutable - name: Get pa11y results - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: pa11y-ci-results - name: Extract and publish metrics diff --git a/.github/workflows/publish-artifact.yml b/.github/workflows/publish-artifact.yml index 87a6e58f5dd..8ea0b9b90a0 100644 --- a/.github/workflows/publish-artifact.yml +++ b/.github/workflows/publish-artifact.yml @@ -44,7 +44,7 @@ jobs: permissions: id-token: write steps: - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: ${{ inputs.name }} pattern: ${{ inputs.pattern }} diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index 33b3656bd2d..be9bd4b492b 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -224,27 +224,27 @@ jobs: - build steps: - uses: grafana/shared-workflows/actions/dockerhub-login@dockerhub-login/v1.0.2 - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-list-linux-amd64 path: . - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-list-linux-arm64 path: . - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-list-linux-armv7 path: . - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-linux-amd64 path: dist - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-linux-arm64 path: dist - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + - uses: actions/download-artifact@4a24838f3d5601fd639834081e118c2995d51e1c with: name: artifacts-linux-armv7 path: dist