07f2482970
build(deps): bump the github-actions group with 4 updates
...
Bumps the github-actions group with 4 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby ), [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) and [docker/build-push-action](https://github.com/docker/build-push-action ).
Updates `ruby/setup-ruby` from 1.321.0 to 1.324.0
- [Release notes](https://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](https://github.com/ruby/setup-ruby/compare/95ef2b042f9d7a56d8268cba8559e2842e2ad01b...a0102e0972be65f351c307e2d64b9314a57c8073 )
Updates `zizmorcore/zizmor-action` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/70fb788f84895a7701f5643d103d587e460b5c99...cc914d7f3750a2d13d75c7f184a1060aa0e9d482 )
Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069 )
Updates `docker/build-push-action` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc )
---
updated-dependencies:
- dependency-name: ruby/setup-ruby
dependency-version: 1.324.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
dependency-version: 4.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: docker/build-push-action
dependency-version: 7.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-25 19:35:29 +00:00
b7da9c63f7
build(deps): bump zizmorcore/zizmor-action in the github-actions group ( #277 )
...
Bumps the github-actions group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/3dc1ecc9bcb9e94e9b2c709687979e1298497054...70fb788f84895a7701f5643d103d587e460b5c99 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 14:09:10 -05:00
6e25ddd92b
build(deps): bump the github-actions group across 1 directory with 7 updates
...
Bumps the github-actions group with 7 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4.3.1` | `7.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.11.1` | `4.3.0` |
| [docker/login-action](https://github.com/docker/login-action ) | `3.5.0` | `4.6.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action ) | `5.8.0` | `6.2.0` |
| [docker/build-push-action](https://github.com/docker/build-push-action ) | `6.18.0` | `7.3.0` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ) | `3.0.0` | `4.2.2` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) | `3.9.2` | `4.1.2` |
Updates `actions/checkout` from 4.3.1 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4.3.1...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `docker/setup-buildx-action` from 3.11.1 to 4.3.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/e468171a9de216ec08956ac3ada2f0791b6bd435...37fe631027851001ddb9b187196cc803df7f5f0e )
Updates `docker/login-action` from 3.5.0 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/184bdaa0721073962dff0199f1fb9940f07167d1...dbcb813823bdd20940b903addbd779551569679f )
Updates `docker/metadata-action` from 5.8.0 to 6.2.0
- [Release notes](https://github.com/docker/metadata-action/releases )
- [Commits](https://github.com/docker/metadata-action/compare/c1e51972afc2121e065aed6d45c65596fe445f3f...dc802804100637a589fabce1cb79ff13a1411302 )
Updates `docker/build-push-action` from 6.18.0 to 7.3.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/263435318d21b8e681c14492fe198d362a7d2c83...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a )
Updates `actions/attest-build-provenance` from 3.0.0 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/977bb373ede98d70efdf65b84cb5f73e068dcc2a...4d101475d8b20a2381f78447822ac1eab6504dd8 )
Updates `sigstore/cosign-installer` from 3.9.2 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/d58896d6a1865668819e1d91763c7751a165e159...6f9f17788090df1f26f669e9d70d6ae9567deba6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: docker/login-action
dependency-version: 4.6.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: docker/metadata-action
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: docker/build-push-action
dependency-version: 7.3.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
dependency-version: 4.2.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: sigstore/cosign-installer
dependency-version: 4.1.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-24 02:19:57 +00:00
22b6d4bdaf
Bump ruby/setup-ruby to v1.321.0
...
v1.295.0 predates Ruby 3.4.10 — its baked-in version index stops at
3.4.9, so asking for anything newer fails with "Unknown version 3.4.10
for ruby on ubuntu-24.04". The next commit needs 3.4.10, and pinning
our Ruby to whatever an old action happens to know is backwards.
SHA verified against the v1.321.0 tag.
2026-08-22 12:30:43 -07:00
dfd2dd2bca
Bump actionlint and zizmor-action to current releases ( #250 )
...
Dependabot version updates are disabled for this repo, so the weekly
github-actions group never proposed these. The pins had been frozen since
March: zizmor-action v0.5.2 ships zizmor 1.23.1, which flags
secrets-outside-env at the default persona -- that moved to the auditor
persona in zizmor 1.24.0. v0.6.2 ships zizmor 1.29.0.
Both linters pass locally at the new versions.
2026-08-20 03:08:26 -07:00
d79225ecd1
Fix version number for CI built images
2026-07-30 18:34:54 +02:00
3fada3d997
ci: harden GitHub Actions workflows ( #185 )
...
* Add GitHub Actions audit job (actionlint + zizmor) to CI
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Configure dependabot for GitHub Actions, bundler, and Docker
Batches all action updates into a single weekly PR. Adds cooldown
periods to all ecosystems.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Add local GitHub Actions linting (actionlint + zizmor) to bin/setup and bin/ci
Install actionlint, shellcheck, and zizmor in bin/setup. Run both
linters as CI steps in config/ci.rb alongside existing style checks.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Pin all GitHub Actions to SHA hashes
Run pinact to pin action versions to specific commit SHAs,
preventing supply chain attacks from tag mutation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Fix high severity zizmor findings
- Suppress unpinned-images for redis service containers (digest
pinning is nontrivial for service containers)
- Move workflow-level permissions to job-level in publish-image.yml
(build gets full set, manifest gets only what it needs)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Fix medium severity zizmor findings
- Add persist-credentials: false to all checkout steps
- Add permissions: {} at workflow level in ci.yml
- Add job-level permissions (contents: read) to all CI jobs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Fix informational template-injection findings in publish-image.yml
Move steps.meta.outputs.tags from inline ${{ }} expressions to env
vars in both the manifest creation and cosign signing steps.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* Update brakeman to 8.0.4
bin/brakeman uses --ensure-latest which fails if not on the newest version.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-20 19:26:25 -04:00
cf1ebda01c
fix: run on tag and not release
2025-09-10 04:18:08 +09:00
08cab1679e
fix: final tag release
2025-09-10 04:16:00 +09:00
d3d196af1c
fix: disable sbom and provenance
...
Disabled SBOM/provenance embedding and stopped uploading build attestations. Those were creating untagged OCI referrers in GHCR. Still sign with cosign with signatures as referrers.
2025-09-10 04:02:28 +09:00
fc24ab44fc
fix: only add tag latest on git version tag
2025-09-10 03:55:02 +09:00
8608ba2520
chore: use build arg for image description
2025-09-05 09:56:42 +02:00
99e6e46b04
chore: add static env for opencontainer description
2025-09-05 09:48:52 +02:00
8ddd9270b3
fix: update Dockerfile to specify MIT license directly and remove unused ARG
2025-09-05 09:39:49 +02:00
47d8122a7f
fix: ensure manifest creation is quoted
2025-09-04 13:08:48 +02:00
a2caf0ae5a
fix: correct empty manifest description
2025-09-04 13:04:56 +02:00
27244295fe
feature: add opencontainers annotations
2025-09-04 12:58:43 +02:00
f003b8fcfe
fix: use native runners for arm64 and amd64
...
Should significantly reduce build time as we won't be emulating with QEMU.
2025-09-04 12:48:06 +02:00
6efb901637
fix: use locked versions on ci to prevent issues in the future
2025-09-04 12:30:59 +02:00
ecb0ecaccf
feature(ci): add actions workflow to publish Docker image to GHCR
2025-09-04 12:26:00 +02:00
df76a227dc
Hello world
...
First open source release of Campfire 🎉
2025-08-21 09:31:59 +01:00
dependabot[bot]
Jeremy Daer
Stanko K.R.
Mike Dalessio
Alexander Nicholson 4584443+DragonStuff@users.noreply.github.com
Kevin McConnell