From 8c61661e1f70485319a7a91d2bacfef1ec0d3f3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 05:15:20 +0000 Subject: [PATCH] chore(deps)(deps): bump the github-actions group across 1 directory with 11 updates Bumps the github-actions group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_book.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_ci.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | | [docker/login-action](https://github.com/docker/login-action) | `4.6.0` | `4.7.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | | [jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml](https://github.com/jebel-quant/rhiza) | `1.9.0` | `1.11.0` | Updates `jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_book.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_ci.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v7.0.1...v7.0.2) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2) Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.2...v1.14.3) Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v4.6.0...v4.7.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) Updates `jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/jebel-quant/rhiza/releases) - [Changelog](https://github.com/Jebel-Quant/rhiza/blob/main/CHANGELOG.md) - [Commits](https://github.com/jebel-quant/rhiza/compare/v1.9.0...v1.11.0) --- updated-dependencies: - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_book.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/rhiza_benchmark.yml | 2 +- .github/workflows/rhiza_book.yml | 2 +- .github/workflows/rhiza_ci.yml | 2 +- .github/workflows/rhiza_codeql.yml | 2 +- .github/workflows/rhiza_marimo.yml | 2 +- .github/workflows/rhiza_release.yml | 16 ++++++++-------- .github/workflows/rhiza_scorecard.yml | 2 +- .github/workflows/rhiza_weekly.yml | 2 +- 8 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/rhiza_benchmark.yml b/.github/workflows/rhiza_benchmark.yml index f67c63d..4b65a7c 100644 --- a/.github/workflows/rhiza_benchmark.yml +++ b/.github/workflows/rhiza_benchmark.yml @@ -20,7 +20,7 @@ on: jobs: benchmark: - uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`. diff --git a/.github/workflows/rhiza_book.yml b/.github/workflows/rhiza_book.yml index afb31e4..67cfbbc 100644 --- a/.github/workflows/rhiza_book.yml +++ b/.github/workflows/rhiza_book.yml @@ -29,7 +29,7 @@ permissions: jobs: book: - uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`. diff --git a/.github/workflows/rhiza_ci.yml b/.github/workflows/rhiza_ci.yml index 4633344..01f19e5 100644 --- a/.github/workflows/rhiza_ci.yml +++ b/.github/workflows/rhiza_ci.yml @@ -26,7 +26,7 @@ on: jobs: ci: - uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_ci.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`. diff --git a/.github/workflows/rhiza_codeql.yml b/.github/workflows/rhiza_codeql.yml index 11c7ce7..ecc027f 100644 --- a/.github/workflows/rhiza_codeql.yml +++ b/.github/workflows/rhiza_codeql.yml @@ -26,7 +26,7 @@ on: jobs: codeql: - uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_codeql.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`. diff --git a/.github/workflows/rhiza_marimo.yml b/.github/workflows/rhiza_marimo.yml index 29513aa..2f8fe9e 100644 --- a/.github/workflows/rhiza_marimo.yml +++ b/.github/workflows/rhiza_marimo.yml @@ -28,7 +28,7 @@ on: jobs: marimo: - uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_marimo.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`. diff --git a/.github/workflows/rhiza_release.yml b/.github/workflows/rhiza_release.yml index 0b02f74..0b66ed8 100644 --- a/.github/workflows/rhiza_release.yml +++ b/.github/workflows/rhiza_release.yml @@ -425,7 +425,7 @@ jobs: - name: Upload SBOM artifacts if: hashFiles('pyproject.toml') != '' - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@v7.0.2 with: name: sbom path: | @@ -449,7 +449,7 @@ jobs: - name: Upload dist artifact if: steps.buildable.outputs.buildable == 'true' - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@v7.0.2 with: name: dist path: dist @@ -476,7 +476,7 @@ jobs: - name: Download SBOM artifact # Downloads sbom.cdx.json and sbom.cdx.xml into sbom/ directory - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@v8.0.2 with: name: sbom path: sbom @@ -485,7 +485,7 @@ jobs: - name: Download dist artifact # Brings in provenance.intoto.jsonl (and the built distributions) staged # by the build job, so the SLSA provenance ships as a release asset. - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@v8.0.2 with: name: dist path: dist @@ -520,7 +520,7 @@ jobs: fetch-depth: 0 - name: Download dist artifact - uses: actions/download-artifact@v8.0.1 + uses: actions/download-artifact@v8.0.2 with: name: dist path: dist @@ -553,7 +553,7 @@ jobs: # repository-url and password only used for custom feeds, not for PyPI with OIDC - name: Publish to PyPI if: ${{ steps.check_dist.outputs.should_publish == 'true' }} - uses: pypa/gh-action-pypi-publish@v1.14.2 + uses: pypa/gh-action-pypi-publish@v1.14.3 with: packages-dir: dist/ skip-existing: true @@ -650,7 +650,7 @@ jobs: - name: Upload conda recipe artifact if: steps.check_conda.outputs.should_generate == 'true' - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@v7.0.2 with: name: conda-recipe path: conda-recipe/meta.yaml @@ -697,7 +697,7 @@ jobs: - name: Login to Container Registry if: steps.check_publish.outputs.should_publish == 'true' - uses: docker/login-action@v4.6.0 + uses: docker/login-action@v4.7.0 with: registry: ${{ steps.registry.outputs.registry }} username: ${{ github.repository_owner }} diff --git a/.github/workflows/rhiza_scorecard.yml b/.github/workflows/rhiza_scorecard.yml index 2e85a56..62e619a 100644 --- a/.github/workflows/rhiza_scorecard.yml +++ b/.github/workflows/rhiza_scorecard.yml @@ -36,7 +36,7 @@ permissions: read-all jobs: scorecard: - uses: jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_scorecard.yml@v1.11.0 permissions: security-events: write # Upload the SARIF results to code scanning id-token: write # Publish results to the OpenSSF REST API (badge) diff --git a/.github/workflows/rhiza_weekly.yml b/.github/workflows/rhiza_weekly.yml index 8398434..fd62186 100644 --- a/.github/workflows/rhiza_weekly.yml +++ b/.github/workflows/rhiza_weekly.yml @@ -28,7 +28,7 @@ on: jobs: weekly: - uses: jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml@v1.9.0 + uses: jebel-quant/rhiza/.github/workflows/rhiza_weekly.yml@v1.11.0 # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the # caller's own organisation or enterprise (#1689). A secret this repository has not # defined arrives empty and the workflow falls back to `github.token`.