From c27abeb0037ec933c61f04c89cfc63f3187153ca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 13:18:01 +0000 Subject: [PATCH] ci(deps): bump the actions-minor-patch group with 2 updates Bumps the actions-minor-patch group with 2 updates: [CodSpeedHQ/action](https://github.com/codspeedhq/action) and [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action). Updates `CodSpeedHQ/action` from 5.2.1 to 5.4.0 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codspeedhq/action/compare/373d6868929f444bc08d901fd0eb0ad52a8875ea...c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5) Updates `anchore/sbom-action/download-syft` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/3ad7283483fc7af8ff2b4ea19663c2d5ca935e26...66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c) --- updated-dependencies: - dependency-name: CodSpeedHQ/action dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/codspeed.yml | 2 +- .github/workflows/publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml index 9ad9fd9..a00444e 100644 --- a/.github/workflows/codspeed.yml +++ b/.github/workflows/codspeed.yml @@ -36,7 +36,7 @@ jobs: enable-cache: false - name: Run benchmarks under CodSpeed - uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1 + uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0 with: mode: simulation run: uv run --locked --group benchmark pytest benchmarks/ --codspeed --no-cov diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 38085f7..c426bae 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -59,7 +59,7 @@ jobs: test -s provenance/provenance.intoto.jsonl - name: Install syft - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 + uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: Generate SBOM (CycloneDX) run: syft scan dir:dist -o "cyclonedx-json=provenance/docopt2.sbom.cdx.json"