From 268e1e02fa2d30babe86a93432f13c61afa07f4a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 21:44:11 +0000 Subject: [PATCH] build(deps): bump the action-dependencies group with 2 updates Bumps the action-dependencies group with 2 updates: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) and [github/codeql-action](https://github.com/github/codeql-action). Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33) Updates `github/codeql-action` from 4.37.3 to 4.37.5 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.37.3...v4.37.5) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies - dependency-name: github/codeql-action dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: action-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yml | 2 +- .github/workflows/codeql-analysis.yml | 4 ++-- .github/workflows/scorecards.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index ce86e51cf9..5f6a3e93da 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -103,7 +103,7 @@ jobs: - name: Publish binary wheel and source tarball on PyPI # Only attempt pypi upload in upstream repository if: github.repository == 'theupdateframework/python-tuf' - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - name: Finalize GitHub release uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 62459a1d62..5295615b20 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -28,9 +28,9 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.3 # zizmor: ignore[unpinned-uses] + uses: github/codeql-action/init@v4.37.5 # zizmor: ignore[unpinned-uses] with: languages: 'python' - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.3 # zizmor: ignore[unpinned-uses] + uses: github/codeql-action/analyze@v4.37.5 # zizmor: ignore[unpinned-uses] diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 4718a0004b..7e3755c2b9 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -37,6 +37,6 @@ jobs: publish_results: true - name: "Upload to code-scanning dashboard" - uses: github/codeql-action/upload-sarif@v4.37.3 # zizmor: ignore[unpinned-uses] + uses: github/codeql-action/upload-sarif@v4.37.5 # zizmor: ignore[unpinned-uses] with: sarif_file: results.sarif