From 12e54583781ffadd348df025cb105b02fe47c075 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 8 Nov 2026 00:43:41 +0000 Subject: [PATCH] build(deps): bump the actions group with 3 updates Bumps the actions group with 3 updates: [CodSpeedHQ/action](https://github.com/codspeedhq/action), [jdx/mise-action](https://github.com/jdx/mise-action) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `CodSpeedHQ/action` from 5.6.0 to 5.6.3 - [Release notes](https://github.com/codspeedhq/action/releases) - [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codspeedhq/action/compare/78102a468f96d8e0ccb92d0ec49425753fc42062...af75f77f17a054769abefaa42fe8dc2975469b5f) Updates `jdx/mise-action` from 5.2.4 to 5.2.6 - [Release notes](https://github.com/jdx/mise-action/releases) - [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/jdx/mise-action/compare/6be3c7ed4c21d4f76b208d351d95aac273ebb76d...f5be966e4a917d54244728e6a5fdcd1d93a35e6c) Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/6f9f17788090df1f26f669e9d70d6ae9567deba6...756fe2d284c7292c4e9b62c8a28f1e5629c59532) --- updated-dependencies: - dependency-name: CodSpeedHQ/action dependency-version: 5.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: jdx/mise-action dependency-version: 5.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/check.bench.yml | 4 ++-- .github/workflows/check.jvm.yml | 2 +- .github/workflows/check.rust.yml | 2 +- .github/workflows/job.central.yml | 2 +- .github/workflows/job.release.yml | 2 +- .github/workflows/on.packages.yml | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/check.bench.yml b/.github/workflows/check.bench.yml index 69c6dd0..1d49511 100644 --- a/.github/workflows/check.bench.yml +++ b/.github/workflows/check.bench.yml @@ -22,7 +22,7 @@ jobs: - name: Build deterministic CPU benchmarks run: cargo codspeed build -p bemo --bench buffers --bench handles --bench http --locked -m simulation - name: Track CPU performance - uses: CodSpeedHQ/action@78102a468f96d8e0ccb92d0ec49425753fc42062 # v5.6.0 + uses: CodSpeedHQ/action@af75f77f17a054769abefaa42fe8dc2975469b5f # v5.6.3 with: mode: simulation runner-version: '5.2.1' @@ -111,7 +111,7 @@ jobs: - run: cargo codspeed build -p bemo --bench tls --locked -m walltime - run: make bench-prepare - name: Track TLS and end-to-end wall time - uses: CodSpeedHQ/action@78102a468f96d8e0ccb92d0ec49425753fc42062 # v5.6.0 + uses: CodSpeedHQ/action@af75f77f17a054769abefaa42fe8dc2975469b5f # v5.6.3 with: mode: walltime runner-version: '5.2.1' diff --git a/.github/workflows/check.jvm.yml b/.github/workflows/check.jvm.yml index b613f8e..dd5bece 100644 --- a/.github/workflows/check.jvm.yml +++ b/.github/workflows/check.jvm.yml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 + - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6 with: version: '2026.9.10' # Keep the stock JVM test matrix authoritative after Mise's development JDK. diff --git a/.github/workflows/check.rust.yml b/.github/workflows/check.rust.yml index 3fec6ba..ffcd946 100644 --- a/.github/workflows/check.rust.yml +++ b/.github/workflows/check.rust.yml @@ -29,7 +29,7 @@ jobs: - name: Check generated C exports if: runner.os == 'Linux' run: python3 tools/generate_exports.py --check - - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 + - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6 if: runner.os == 'Linux' with: version: '2026.9.10' diff --git a/.github/workflows/job.central.yml b/.github/workflows/job.central.yml index e54708a..a9109b7 100644 --- a/.github/workflows/job.central.yml +++ b/.github/workflows/job.central.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 with: cosign-release: v3.0.5 - name: Verify the immutable release and its main-source provenance diff --git a/.github/workflows/job.release.yml b/.github/workflows/job.release.yml index b67c132..9927636 100644 --- a/.github/workflows/job.release.yml +++ b/.github/workflows/job.release.yml @@ -47,7 +47,7 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: python3 tools/release.py stage - - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 if: steps.draft.outputs.tag != '' with: cosign-release: v3.0.5 diff --git a/.github/workflows/on.packages.yml b/.github/workflows/on.packages.yml index 74ecd99..d24faec 100644 --- a/.github/workflows/on.packages.yml +++ b/.github/workflows/on.packages.yml @@ -25,7 +25,7 @@ jobs: - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: '3.13' - - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3 with: cosign-release: v3.0.5 - name: Authenticate and publish immutable release artifacts