3030
3131 steps :
3232 - name : Harden runner
33- uses : step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
33+ uses : step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
3434 with :
3535 disable-sudo : true
3636 egress-policy : block
6969 persist-credentials : false
7070
7171 - name : Install Cosign
72- uses : sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
72+ uses : sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0
7373
7474 - name : Docker meta
7575 id : docker-meta
9292 uses : docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
9393
9494 - name : Set up Docker Buildx
95- uses : docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10 .0
95+ uses : docker/setup-buildx-action@18ce135bb5112fa8ce4ed6c17ab05699d7f3a5e0 # v3.11 .0
9696
9797 - name : Login to DockerHub
9898 if : ${{ (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && github.actor != 'dependabot[bot]' }}
@@ -134,7 +134,7 @@ jobs:
134134
135135 - name : Generate SBOM
136136 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
137- uses : anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 # v0.20.0
137+ uses : anchore/sbom-action@9246b90769f852b3a8921f330c59e0b3f439d6e9 # v0.20.1
138138 with :
139139 image : ${{ vars.DOCKERHUB_USERNAME }}/cf-ips-to-hcloud-fw
140140 format : spdx-json
@@ -143,7 +143,7 @@ jobs:
143143
144144 - name : Generate SBOM attestation for DockerHub
145145 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
146- uses : actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2.2 .0
146+ uses : actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2.4 .0
147147 with :
148148 subject-name : index.docker.io/${{ vars.DOCKERHUB_USERNAME }}/cf-ips-to-hcloud-fw
149149 subject-digest : ${{ steps.build-and-push.outputs.digest }}
@@ -152,7 +152,7 @@ jobs:
152152
153153 - name : Generate SBOM attestation for Quay
154154 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
155- uses : actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2.2 .0
155+ uses : actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2.4 .0
156156 with :
157157 subject-name : quay.io/${{ vars.QUAY_USERNAME }}/cf-ips-to-hcloud-fw
158158 subject-digest : ${{ steps.build-and-push.outputs.digest }}
@@ -161,7 +161,7 @@ jobs:
161161
162162 - name : Generate SBOM attestation for GitHub Container Registry
163163 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
164- uses : actions/attest-sbom@115c3be05ff3974bcbd596578934b3f9ce39bf68 # v2.2 .0
164+ uses : actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2.4 .0
165165 with :
166166 subject-name : ghcr.io/${{ github.repository_owner }}/cf-ips-to-hcloud-fw
167167 subject-digest : ${{ steps.build-and-push.outputs.digest }}
@@ -170,23 +170,23 @@ jobs:
170170
171171 - name : Generate artifact attestation for DockerHub
172172 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
173- uses : actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3 .0
173+ uses : actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4 .0
174174 with :
175175 subject-name : index.docker.io/${{ vars.DOCKERHUB_USERNAME }}/cf-ips-to-hcloud-fw
176176 subject-digest : ${{ steps.build-and-push.outputs.digest }}
177177 push-to-registry : true
178178
179179 - name : Generate artifact attestation for Quay
180180 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
181- uses : actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3 .0
181+ uses : actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4 .0
182182 with :
183183 subject-name : quay.io/${{ vars.QUAY_USERNAME }}/cf-ips-to-hcloud-fw
184184 subject-digest : ${{ steps.build-and-push.outputs.digest }}
185185 push-to-registry : true
186186
187187 - name : Generate artifact attestation for GitHub Container Registry
188188 if : ${{ github.event_name != 'pull_request' && github.actor != 'dependabot[bot]' }}
189- uses : actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3 .0
189+ uses : actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4 .0
190190 with :
191191 subject-name : ghcr.io/${{ github.repository_owner }}/cf-ips-to-hcloud-fw
192192 subject-digest : ${{ steps.build-and-push.outputs.digest }}
@@ -219,12 +219,12 @@ jobs:
219219 - name : Upload Docker Scout scan result to GitHub Security tab
220220 if : ${{ (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && github.actor != 'dependabot[bot]' }}
221221 continue-on-error : true
222- uses : github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
222+ uses : github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
223223 with :
224224 sarif_file : sarif.output.json
225225
226226 - name : Scan image with Grype
227- uses : anchore/scan-action@2c901ab7378897c01b8efaa2d0c9bf519cc64b9e # v6.2 .0
227+ uses : anchore/scan-action@be7a22da4f22dde446c4c4c099887ff5b256526c # v6.3 .0
228228 id : grype-scan
229229 continue-on-error : true
230230 with :
@@ -233,7 +233,7 @@ jobs:
233233 add-cpes-if-none : true
234234
235235 - name : Upload Grype scan result to GitHub Security tab
236- uses : github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
236+ uses : github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
237237 continue-on-error : true
238238 with :
239239 sarif_file : ${{ steps.grype-scan.outputs.sarif }}
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments