Alex Goodman
c00be184b5
fix: revert hashstructure to v0.6.0 to keep artifact IDs stable ( #5364 )
...
* fix: revert hashstructure to v0.6.0 to keep artifact IDs stable
hashstructure v1 changed `SlicesAsSets` hashing (every slice now gets a finalizing hash pass, and duplicate elements are deduplicated), which changed nearly every artifact ID syft produces.
- pin `github.com/gohugoio/hashstructure` back to v0.6.0 and have dependabot ignore major bumps
- make the aggregate `Unit tests` job fail when a dependency fails; previously it was skipped, which satisfies the required check and let #5277 auto-merge with failing unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ci: fail unit test gate on any failed, cancelled, or skipped dependency
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ci: require every unit test dependency to succeed
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-10-01 17:40:34 +00:00
Alex Goodman
506ad5d6a7
refactor release pipeline: TAG_TOKEN, skip-checks gate, dependabot/zizmor cleanup ( #5003 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 14:04:48 -04:00
Alex Goodman
d61af0abab
Port to go-make ( #4923 )
...
* port to go-make
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refresh fixtures on running unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address refresh cache issues with old now-gitignored files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-18 11:59:55 -04:00
Alex Goodman
b0dc65a4fb
improve automation ( #4730 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-02 12:44:54 -04:00
Will Murphy
c5114fd745
chore(deps): ignore some dependabot deps ( #4696 )
...
Prevent some packages from being updated.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-24 08:12:50 -04:00
Will Murphy
3e563d90d5
ci: enable zizmor to fail PRs ( #4556 )
...
* ci: enable zizmor to fail PRs
Enable zizmor (gh actions yaml linter) to fail builds in PRs. Fix any
outstanding linting errors found by this tool.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* fix outdated version comments
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-01-16 10:49:00 -05:00
Alex Goodman
29a0b19a21
Group dependabot updates ( #4522 )
...
* group dependabot updates
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use directories key
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-05 16:57:38 +00:00
Weston Steimel
b7f78a6a8b
chore(ci): fix composite GitHub action path in dependabot config ( #3611 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2025-01-23 14:33:07 +00:00
Weston Steimel
246df97ae7
chore: enable dependabot to keep boostrap action updated ( #2976 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-06-19 20:17:11 +01:00
Alex Goodman
0d5ebed74a
dont include labels for dependabot ecosystems ( #2720 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-21 12:16:01 -04:00
Christopher Angelo Phillips
094b41b301
chore: pin and update all workflow dependencies; add permission scopes ( #2138 )
...
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2023-09-15 14:18:42 -04:00
Luca Comellini
6b2dc08ffb
Add dependabot ( #1451 )
...
Signed-off-by: Luca Comellini <luca.com@gmail.com >
Signed-off-by: Luca Comellini <luca.com@gmail.com >
2023-01-18 09:29:24 -05:00
Alex Goodman
Will Murphy
Weston Steimel
Christopher Angelo Phillips
Luca Comellini