chore(deps): bump the actions group with 3 updates (#40) Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator). Updates `actions/checkout` from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

v6.0.2

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in actions/checkout#2356

v6.0.1

Add worktree support for persist-credentials includeIf by @ericsciple in actions/checkout#2327

v6.0.0

Persist creds to a separate file by @ericsciple in actions/checkout#2286

Update README to include Node.js 24 support details and requirements by @salmanmkc in actions/checkout#2248

v5.0.1

Port v6 cleanup to v5 by @ericsciple in actions/checkout#2301

v5.0.0

Update actions checkout to use node 24 by @salmanmkc in actions/checkout#2226

v4.3.1

Port v6 cleanup to v4 by @ericsciple in actions/checkout#2305

v4.3.0

docs: update README.md by @motss in actions/checkout#1971

Add internal repos for checking out multiple repositories by @mouismail in actions/checkout#1977

Documentation update - add recommended permissions to Readme by @benwells in actions/checkout#2043

Adjust positioning of user email note and permissions heading by @joshmgross in actions/checkout#2044

Update README.md by @nebuk89 in actions/checkout#2194

Update CODEOWNERS for actions by @TingluoHuang in actions/checkout#2224

Update package dependencies by @salmanmkc in actions/checkout#2236

v4.2.2

url-helper.ts now leverages well-known environment variables by @jww3 in actions/checkout#1941

Expand unit test coverage for isGhes by @jww3 in actions/checkout#1946

v4.2.1

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in actions/checkout#1924

v4.2.0

Add Ref and Commit outputs by @lucacome in actions/checkout#1180

Dependency updates by @dependabot- actions/checkout#1777, actions/checkout#1872

v4.1.7

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in actions/checkout#1739

Bump actions/checkout from 3 to 4 by @dependabot in actions/checkout#1697

Check out other refs/* by commit by @orhantoy in actions/checkout#1774

... (truncated)

Commits

df4cb1c Update changelog for v6.0.3 (#2446)
1cce339 Fix checkout init for SHA-256 repositories (#2439)
900f221 fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)
0c366fd Update changelog (#2357)
See full diff in compare view

Updates `github/codeql-action` from 4.36.0 to 4.36.2

Release notes

Sourced from github/codeql-action's releases.

v4.36.2

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.2 - 04 Jun 2026

Cache CodeQL CLI version information across Actions steps. #3943

Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937

Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894

Add support for SHA-256 Git object IDs. #3893

Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791

If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892

Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837

Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850

Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853

Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807

Update default CodeQL bundle version to 2.25.2. #3823

... (truncated)

Commits

8aad20d Merge pull request #3949 from github/update-v4.36.2-dcb947ce1
f521b08 Add additional changelog notes
8aeff0f Update changelog for v4.36.2
dcb947c Merge pull request #3948 from github/update-bundle/codeql-bundle-v2.25.6
c251bce Add changelog note
62953c1 Update default bundle to codeql-bundle-v2.25.6
423b570 Merge pull request #3946 from github/dependabot/npm_and_yarn/npm-minor-5d507a...
c35d1b1 Merge pull request #3947 from github/dependabot/github_actions/dot-github/wor...
cb1a588 Merge pull request #3937 from github/robertbrignull/waitForProcessing_backoff
ba47406 Merge pull request #3943 from github/henrymercer/cache-cli-version-info
Additional commits viewable in compare view

Updates `slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml` from 2.0.0 to 2.1.0

Release notes

Sourced from slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml's releases.

v2.1.0

What's Changed

chore: v2.0.0: update tags to v2.0.0 by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3584

fix: use @sigstore/cli in e2e.sign-attestations.schedule.yml by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3572

docs: fix broken links by @suzuki-shunsuke in slsa-framework/slsa-github-generator#3605

chore(setup-go): update actions/setup-go to resolve the warning by @suzuki-shunsuke in slsa-framework/slsa-github-generator#3604

fix: Update release docs by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3589

docs: Add Atsign-Foundation NoPorts to the Hall of Fame by @cpswan in slsa-framework/slsa-github-generator#3616

docs: Add v2.0.0 to SECURITY.md by @ianlewis in slsa-framework/slsa-github-generator#3630

docs: Add links to CHANGELOG by @ianlewis in slsa-framework/slsa-github-generator#3631

ci: fix PR title checker by @ianlewis in slsa-framework/slsa-github-generator#3632

ci: Add issue reopener by @ianlewis in slsa-framework/slsa-github-generator#3629

fix: update softprops/action-gh-release to v2.0.5 by @suzuki-shunsuke in slsa-framework/slsa-github-generator#3619

chore(renovate): use cron syntax for schedule by @rarkins in slsa-framework/slsa-github-generator#3638

chore: Fix Renovate config by @ianlewis in slsa-framework/slsa-github-generator#3635

feat: workflow to update actions dist by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3653

fix(deps): update dependency @sigstore/rekor-types to v2 by @renovate-bot in slsa-framework/slsa-github-generator#3650

chore(deps): update github-actions (major) by @renovate-bot in slsa-framework/slsa-github-generator#3648

fix(deps): update dependency org.json:json to v20231013 [security] by @renovate-bot in slsa-framework/slsa-github-generator#3641

fix(deps): update module github.com/sigstore/cosign/v2 to v2.2.4 [security] by @renovate-bot in slsa-framework/slsa-github-generator#3640

chore(deps): update dependency pathspec to v0.12.1 by @renovate-bot in slsa-framework/slsa-github-generator#3644

fix(deps): update dependency @actions/github to v6 by @renovate-bot in slsa-framework/slsa-github-generator#3649

fix(deps): update module golang.org/x/oauth2 to v0.20.0 by @renovate-bot in slsa-framework/slsa-github-generator#3646

fix(deps): update npm by @renovate-bot in slsa-framework/slsa-github-generator#3647

chore: formatting by @ianlewis in slsa-framework/slsa-github-generator#3655

chore(deps): update github-actions by @renovate-bot in slsa-framework/slsa-github-generator#3642

docs: Add openfga as another user of slsa-github-generator via Github Actions by @aaguiarz in slsa-framework/slsa-github-generator#2950

fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.6 by @renovate-bot in slsa-framework/slsa-github-generator#3645

chore: allow Renovate to create new config warning issues by @HonkingGoose in slsa-framework/slsa-github-generator#3662

chore: Fix markdown issues by @ianlewis in slsa-framework/slsa-github-generator#3658

chore(deps): update npm dev by @renovate-bot in slsa-framework/slsa-github-generator#3643

feat: Record vars in SLSA generators by @ianlewis in slsa-framework/slsa-github-generator#3633

chore(deps): update github-actions by @renovate-bot in slsa-framework/slsa-github-generator#3679

fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.7 by @renovate-bot in slsa-framework/slsa-github-generator#3680

docs: Remove expected GA for Node.js builder by @ianlewis in slsa-framework/slsa-github-generator#3659

ci: Add formatting pre-submit check by @ianlewis in slsa-framework/slsa-github-generator#3654

fix(deps): update dependency org.apache.maven:maven-plugin-api to v3.9.8 by @renovate-bot in slsa-framework/slsa-github-generator#3712

chore(deps): bump the npm_and_yarn group across 10 directories with 2 updates by @dependabot in slsa-framework/slsa-github-generator#3714

chore(deps): update github-actions by @renovate-bot in slsa-framework/slsa-github-generator#3711

chore(deps): bump the go_modules group with 2 updates by @dependabot in slsa-framework/slsa-github-generator#3715

chore: slsa-verifier v2.6.0: Update action.yml by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3736

fix: Update maven helper plugin build by @loosebazooka in slsa-framework/slsa-github-generator#3746

fix: maven e2e: remove verify job by @ramonpetgrave64 in slsa-framework/slsa-github-generator#3748

chore(deps): update github-actions by @renovate-bot in slsa-framework/slsa-github-generator#3753

chore(deps): bump github.com/docker/docker from 24.0.9+incompatible to 25.0.6+incompatible in the go_modules group by @dependabot in slsa-framework/slsa-github-generator#3760

chore(config): migrate renovate config by @renovate-bot in slsa-framework/slsa-github-generator#3774

chore(deps): update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.10.1 by @renovate-bot in slsa-framework/slsa-github-generator#3758

chore(deps): update dependency org.apache.maven.plugins:maven-deploy-plugin to v3.1.3 by @renovate-bot in slsa-framework/slsa-github-generator#3820

chore(deps): update dependency org.apache.maven.plugins:maven-gpg-plugin to v3.2.5 by @renovate-bot in slsa-framework/slsa-github-generator#3757

fix(deps): update npm by @renovate-bot in slsa-framework/slsa-github-generator#3754

... (truncated)

Changelog

Sourced from slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml's changelog.

CHANGELOG

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

v2.1.0

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

v2.1.0: Vars context recorded in provenance

v2.0.0

v2.0.0: Breaking Change: upload-artifact and download-artifact

v2.0.0: Breaking Change: attestation-name Workflow Input and Output

v2.0.0: DSSE Rekor Type

v1.10.0

v1.10.0: TUF fix

v1.10.0: Gradle Builder

v1.10.0: Go Builder

v1.10.0: Container Generator

v1.9.0

v1.9.0: BYOB framework (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)

v1.9.0: Maven builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)

v1.9.0: Gradle builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)

v1.9.0: JReleaser builder

v1.8.0

v1.8.0: Generic Generator

v1.8.0: Node.js Builder (https://github.com/slsa-framework/slsa-github-generator/blob/main/beta)

v1.7.0

v1.7.0: Go builder

v1.6.0

Summary of changes

Go builder

New Features

Generic generator

New Features

Container generator

Changelog since v1.5.0

v1.5.0

Summary of changes

Go builder

New Features

Generic generator

New Features

Container generator

New Features

Changelog since v1.4.0

... (truncated)

Commits

f7dd8c5 update the ref in the pre-submit
0a5124b fix jq for the sigstore bundles
fbeecf0 update docs
f701310 update workflows
3618598 v2.1.0-rc.3
46f81fc chore: update refs to v2.1.0-rc.1 (#4120)
5d20c93 chore: use builder tag v2.1.0-rc.0 (#4118)
e27b237 chore: braces and ejs vulns (#4116)
8967e1c chore: Update CODEOWNERS (#4115)
47d1954 chore: update octokit deps (#4114)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!