Repository navigation
deps: bump the go-deps group across 1 directory with 2 updates - #178
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ErenAri
added a commit
that referenced
this pull request
Oct 14, 2026
scholarly-release-v1 runs on every push to main that changes its own file. research-v1 was published once, from 141c491 on 2026-09-19 (run 35456618576). Any later edit, including the permission fix in this PR, re-ran the publish job with a contents:write token. Its own refusal step stopped it, but the run went red. A read-only `state` job (contents/attestations read) now runs scripts/research/research-v1-release-state.sh before anything else, and the write-scoped `publish` job runs only on `needs.state.outputs.publish == 'true'`: - publish=true only when neither the tag nor the release exists AND the run is the pinned commit 141c491. That is the original first publication, which can no longer happen. - publish=false only when the published release is verified intact. The annotated tag (direct and peeled refs) peels to 141c491. The release is non-draft and non-prerelease with exactly the four assets. archive-lock.json is byte-identical to the reviewed lock. The manifest and payload match the lock. RELEASE-CHECKSUMS.txt covers exactly the other three files and verifies. All four assets carry a scholarly-release-v1.yml attestation for 141c491 on refs/heads/main. The run ends green with no write token issued. - Every other state fails closed and never silently skips: a missing release run from another commit (which would create a different research-v1), a partial publication, a mismatch, or a lookup error. scripts/check-release-consistency.sh now requires this gate: the pinned commit, the state script, `needs: state`, the exact `if:` and a read-only state job. It rejects the ungated workflow from cf7a20a. Tests: - scripts/research/test-release-state-v1.sh (real git remote, stubbed gh) has 30 checks, each asserting the failure reason. - Every guard mutation is caught except dropping the payload size check. That one is equivalent, since the payload SHA-256 binding implies size. - Against the live release, the script returns publish=false from 802d515 and fails for a wrong pinned commit. docs/workflow-token-permissions.md records the Scorecard v5.5.0 scoring rules, reproduces alerts #173-#178 locally on 802d515 (0 SARIF results on this tree, score 10), and documents the five required job-level write grants with the step that uses each and its gate. Signed-off-by: ErenAri <erenari27@gmail.com>
ErenAri
added a commit
that referenced
this pull request
Oct 14, 2026
… research-v1 Operator-approved (conditional) at exact head 1c6926b on base 802d515 (expected tree fe7bd74). Fixes Scorecard Token-Permissions #178 at the root (top-level write in scholarly-release-v1.yml), which also stops #173-#177 being reported; gates the one-time research-v1 publish behind a read-only, fail-closed state job; adds the workflow-permission guard. No release, qualification, environment or protection change. Signed-off-by: ErenAri <erenari27@gmail.com>
Bumps the go-deps group with 2 updates in the / directory: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang). Updates `github.com/google/go-containerregistry` from 0.21.7 to 0.22.1 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.7...v0.22.1) Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-version: 0.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/go-deps-a7d9ee87ad
branch
from
October 19, 2026 06:34
3887974 to
ba62ea7
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go-deps group with 2 updates in the / directory: github.com/google/go-containerregistry and github.com/prometheus/client_golang.
Updates
github.com/google/go-containerregistryfrom 0.21.7 to 0.22.1Release notes
Sourced from github.com/google/go-containerregistry's releases.
... (truncated)
Commits
8a72a42remote: copy manifest annotations to referrers fallback tag descriptors (#2441)5765c35build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)969402ffix(mutate): make Time layer updates lazy (#2429)25c682eflatten: preserve config and layer media types when flattening (#2438)79af990remote: add SSRF redirect protection to writer-side HTTP clients (#2432)4b9b3c7fix(release): honor declared Go toolchain (#2435)e033b9cfix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)8bd7902name: return a helpful error when a reference contains a URL scheme (#2431)163134dvalidate: support index attestation manifests and empty configs (#2414)44f7ea3fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)Updates
github.com/prometheus/client_golangfrom 1.24.1 to 1.25.0Release notes
Sourced from github.com/prometheus/client_golang's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/client_golang's changelog.
Commits
0d88875Cut v1.25.0 (#2164)e9946eeCut v1.25.0-rc.0 (#2154)de866d6Merge pull request #2152 from prometheus/dependabot/go_modules/api/prometheus...a37302fprometheus: fix modernize lint findings (#2151)a3fa380build(deps): bump google.golang.org/grpc9da3fccfix: updates for tsdb blocks handling (#1928)0ecb5c2api: match complete URL placeholders (#2136)2ad001aexp/api/remote: reset buffer before generic marshal (#2139)0db8d43promhttp: vary negotiated metrics responses (#2142)b1f9c7aMerge pull request #2144 from prometheus/dependabot/go_modules/exp/github.com...