Bump the actions group across 2 directories with 5 updates by dependabot[bot] · Pull Request #47 · fluxcd/gha-workflows

dependabot · 2026-05-07T05:17:10Z

Bumps the actions group with 5 updates in the / directory:

Package	From	To
korthout/backport-action	`4.3.0`	`4.5.1`
github/codeql-action	`4.35.1`	`4.35.3`
fluxcd/pkg	`1.29.0`	`1.31.0`
sigstore/cosign-installer	`4.1.1`	`4.1.2`
goreleaser/goreleaser-action	`7.0.0`	`7.2.1`

Bumps the actions group with 1 update in the /.github/actions/setup-kubernetes directory: fluxcd/pkg.

Updates korthout/backport-action from 4.3.0 to 4.5.1

Release notes

Sourced from korthout/backport-action's releases.

Backport-action v4.5.1

What's Changed

Bug fix for [comment_style: summary drops conflict-resolution instructions #633](korthout/backport-action#633)

Post resolve-conflicts comment on draft PR in summary mode by @korthout in korthout/backport-action#634

Updated dependencies

Update korthout/backport-action action to v4.5.0 by @renovate[bot] in korthout/backport-action#627

Lock file maintenance by @renovate[bot] in korthout/backport-action#632

Maintenance changes

Enable summary comment style for our own backport workflow by @korthout in korthout/backport-action#628

Full Changelog: korthout/backport-action@v4.5.0...v4.5.1

Backport-action v4.5.0

What's Changed

This release introduces a new comment_style input with two options:

legacy (default): one comment per target branch. This is the same behavior as you know from previous versions.

summary: a single comment per workflow run that updates progressively as each target is processed. It links back to the workflow run, shows a status table for every target, and includes recovery hints for known failure modes (e.g. push permission denied, cherry-pick conflicts).

Here's what a summary comment looks like mid-run:
Backport-action is backporting this pull request in workflow run 15439584062.

Target Status

stable/8.7 ✅ Created #612

stable/8.6 ⚠️ Drafted with conflicts #613

stable/8.5 ❌ Failed

stable/8.4 ➖ Skipped (PR already exists)

stable/8.3 ⌛ Pending

Tried to cherry-pick commits onto stable/8.5, but the cherry-pick failed.

Please cherry-pick the changes locally and resolve any conflicts.
git fetch origin stable/8.5
git worktree add -d .worktree/stable/8.5 origin/stable/8.5
cd .worktree/stable/8.5
git switch --create <backport-branch-name>
git cherry-pick -x a1b2c3d e4f5g6h
Opt in by adding comment_style: summary to your workflow:

... (truncated)

Commits

bf97bcf dist: release 4.5.1
5751715 dist: build new artifacts
d7640ad Merge pull request #634 from korthout/summary-conflict-resolution-instructions
4da98db fix: post resolve-conflicts comment on draft PR in summary mode
0b636e5 refactor: extract draft-PR conflict comment helper
9ec6a2d test: cover draft-PR conflict comment in summary mode
ce302ba Merge pull request #632 from korthout/renovate/lock-file-maintenance
5cc454f Lock file maintenance
2315a7c Merge pull request #628 from korthout/enable-summary-comment-style
cdc3b59 ci: opt the backport workflow into summary comment style
Additional commits viewable in compare view

Updates github/codeql-action from 4.35.1 to 4.35.3

Release notes

Sourced from github/codeql-action's releases.

v4.35.3

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

v4.35.2

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

4.35.1 - 27 Mar 2026

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

... (truncated)

Commits

e46ed2c Merge pull request #3867 from github/update-v4.35.3-8c6e48dbe
b73d1d1 Add changelog entry for #3853
24e0bb0 Reorder changelog entries
ec298da Update changelog for v4.35.3
8c6e48d Merge pull request #3865 from github/update-bundle/codeql-bundle-v2.25.3
7190983 Add changelog note
2bb2095 Update default bundle to codeql-bundle-v2.25.3
7851e55 Merge pull request #3850 from github/mbg/private-registry/cloudsmith-gcp
262a15f Add generic non-printable chars test for OIDC configs
a6109b1 Merge pull request #3853 from github/mbg/start-proxy/improved-checks
Additional commits viewable in compare view

Updates fluxcd/pkg from 1.29.0 to 1.31.0

Commits

1bfcca4 Merge pull request #1184 from fluxcd/release-main
29717cf Prepare for release
56b4f16 Merge pull request #1183 from fluxcd/cel-api-group
6b6497f runtime/cel: allow empty kind in status reader
8f83548 Merge pull request #1180 from fluxcd/release-main
9b58a01 Prepare for release
31385e2 Merge pull request #1179 from fluxcd/go-git-5.18
d527b34 Upgrade go-git to v5.18
edb5072 Merge pull request #1178 from fluxcd/cleanup-aws-eni
d7014c4 tests/intergration: cleanup AWS ENIs
Additional commits viewable in compare view

Updates sigstore/cosign-installer from 4.1.1 to 4.1.2

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.2

What's Changed

Bump cosign to 3.0.6 in sigstore/cosign-installer#232

Commits

6f9f177 Bump cosign to 3.0.6 (#232)
b5e753a Bump actions/github-script from 8.0.0 to 9.0.0 (#230)
115e4ce Bump actions/setup-go from 6.3.0 to 6.4.0 (#226)
See full diff in compare view

Updates goreleaser/goreleaser-action from 7.0.0 to 7.2.1

Release notes

Sourced from goreleaser/goreleaser-action's releases.

v7.2.1

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

v7.2.0

What's Changed

test: cover install across release eras by @caarlos0 in goreleaser/goreleaser-action#555

feat: add version-file input by @caarlos0 in goreleaser/goreleaser-action#556

feat: resolve nightly to latest vX.Y.Z--nightly release by @caarlos0 in goreleaser/goreleaser-action#558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

v7.1.0

What's Changed

feat: verify release checksum and cosign signature by @caarlos0 in goreleaser/goreleaser-action#550

docs: document cosign verification in README by @caarlos0 in goreleaser/goreleaser-action#553

docs: Upgrade import GPG action version by @flecno in goreleaser/goreleaser-action#547

ci: drop docker-bake in favor of plain npm by @caarlos0 in goreleaser/goreleaser-action#551

ci: add release-major-tag workflow by @caarlos0 in goreleaser/goreleaser-action#552

ci: drop pre-cosign-v3 goreleaser versions from tests by @caarlos0 in goreleaser/goreleaser-action#554

ci(deps): bump the actions group with 2 updates by @dependabot[bot] in goreleaser/goreleaser-action#543

ci(deps): bump the actions group with 5 updates by @dependabot[bot] in goreleaser/goreleaser-action#546

chore(deps): bump undici from 6.23.0 to 6.24.1 by @dependabot[bot] in goreleaser/goreleaser-action#545

New Contributors

@flecno made their first contribution in goreleaser/goreleaser-action#547

Full Changelog: goreleaser/goreleaser-action@v7...v7.1.0

Commits

1a80836 ci(nightly): pass GITHUB_TOKEN to nightly integration job
a71152e refactor: drop legacy 'nightly' tag fallback
4c6ab56 feat: resolve nightly to latest vX.Y.Z-<sha>-nightly release (#558)
4f96abf feat: add version-file input (#556)
15fa2a9 test: cover install across release eras (#555)
e24998b ci: drop pre-cosign-v3 goreleaser versions from tests (#554)
be2e8a3 docs: document cosign verification in README (#553)
5e53f8e ci: add release-major-tag workflow (#552)
4068afa build: drop docker-bake in favor of plain npm (#551)
213ec80 docs: add CONTRIBUTING with pre-commit workflow
Additional commits viewable in compare view

Updates fluxcd/pkg from 1.29.0 to 1.31.0

Commits

1bfcca4 Merge pull request #1184 from fluxcd/release-main
29717cf Prepare for release
56b4f16 Merge pull request #1183 from fluxcd/cel-api-group
6b6497f runtime/cel: allow empty kind in status reader
8f83548 Merge pull request #1180 from fluxcd/release-main
9b58a01 Prepare for release
31385e2 Merge pull request #1179 from fluxcd/go-git-5.18
d527b34 Upgrade go-git to v5.18
edb5072 Merge pull request #1178 from fluxcd/cleanup-aws-eni
d7014c4 tests/intergration: cleanup AWS ENIs
Additional commits viewable in compare view

Updates fluxcd/pkg from 1.29.0 to 1.31.0

Commits

1bfcca4 Merge pull request #1184 from fluxcd/release-main
29717cf Prepare for release
56b4f16 Merge pull request #1183 from fluxcd/cel-api-group
6b6497f runtime/cel: allow empty kind in status reader
8f83548 Merge pull request #1180 from fluxcd/release-main
9b58a01 Prepare for release
31385e2 Merge pull request #1179 from fluxcd/go-git-5.18
d527b34 Upgrade go-git to v5.18
edb5072 Merge pull request #1178 from fluxcd/cleanup-aws-eni
d7014c4 tests/intergration: cleanup AWS ENIs
Additional commits viewable in compare view

Updates fluxcd/pkg from 1.29.0 to 1.31.0

Commits

1bfcca4 Merge pull request #1184 from fluxcd/release-main
29717cf Prepare for release
56b4f16 Merge pull request #1183 from fluxcd/cel-api-group
6b6497f runtime/cel: allow empty kind in status reader
8f83548 Merge pull request #1180 from fluxcd/release-main
9b58a01 Prepare for release
31385e2 Merge pull request #1179 from fluxcd/go-git-5.18
d527b34 Upgrade go-git to v5.18
edb5072 Merge pull request #1178 from fluxcd/cleanup-aws-eni
d7014c4 tests/intergration: cleanup AWS ENIs
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [korthout/backport-action](https://github.com/korthout/backport-action) | `4.3.0` | `4.5.1` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.3` | | [fluxcd/pkg](https://github.com/fluxcd/pkg) | `1.29.0` | `1.31.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.0.0` | `7.2.1` | Bumps the actions group with 1 update in the /.github/actions/setup-kubernetes directory: [fluxcd/pkg](https://github.com/fluxcd/pkg). Updates `korthout/backport-action` from 4.3.0 to 4.5.1 - [Release notes](https://github.com/korthout/backport-action/releases) - [Commits](korthout/backport-action@3c06f32...bf97bcf) Updates `github/codeql-action` from 4.35.1 to 4.35.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...e46ed2c) Updates `fluxcd/pkg` from 1.29.0 to 1.31.0 - [Commits](fluxcd/pkg@63d73fd...1bfcca4) Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@cad07c2...6f9f177) Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.2.1 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@ec59f47...1a80836) Updates `fluxcd/pkg` from 1.29.0 to 1.31.0 - [Commits](fluxcd/pkg@63d73fd...1bfcca4) Updates `fluxcd/pkg` from 1.29.0 to 1.31.0 - [Commits](fluxcd/pkg@63d73fd...1bfcca4) Updates `fluxcd/pkg` from 1.29.0 to 1.31.0 - [Commits](fluxcd/pkg@63d73fd...1bfcca4) --- updated-dependencies: - dependency-name: korthout/backport-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: fluxcd/pkg dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: goreleaser/goreleaser-action dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: fluxcd/pkg dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: fluxcd/pkg dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: fluxcd/pkg dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the actions group across 2 directories with 5 updates#47

Bump the actions group across 2 directories with 5 updates#47
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions-472c420b9b

dependabot Bot commented on behalf of github May 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Target	Status
`stable/8.7`	✅ Created #612
`stable/8.6`	⚠️ Drafted with conflicts #613
`stable/8.5`	❌ Failed
`stable/8.4`	➖ Skipped (PR already exists)
`stable/8.3`	⌛ Pending

Conversation

dependabot Bot commented on behalf of github May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport-action v4.5.1

What's Changed

Updated dependencies

Maintenance changes

Backport-action v4.5.0

What's Changed

v4.35.3

v4.35.2

CodeQL Action Changelog

[UNRELEASED]

4.35.3 - 01 May 2026

4.35.2 - 15 Apr 2026

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

v4.1.2

What's Changed

v7.2.1

v7.2.0

What's Changed

v7.1.0

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 7, 2026 •

edited

Loading