ci(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the actions-minor-patch group - #708
Merged
devops-thiago merged 1 commit intoAug 14, 2026
Conversation
Bumps the actions-minor-patch group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance). Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@0f67c3f...4d10147) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
devops-thiago
deleted the
dependabot/github_actions/actions-minor-patch-7497132acf
branch
August 14, 2026 21:29
6 tasks
devops-thiago
added a commit
that referenced
this pull request
Aug 14, 2026
…715) ## What type of PR is this? - [x] 📝 Documentation - [x] 🏗️ CI/CD ## Description Prepares the 0.6.2 release and clears the docs-versioning backlog that has now slipped four releases running. **Version and changelog.** `pom.xml` moves from `0.6.2-SNAPSHOT` to `0.6.2`, and `[Unreleased]` becomes `[0.6.2] — 2026-08-14`. The section covers what a 0.6.1 user gains: the refused-review handling (#704), delimiter-aware span stripping in the decline re-check (#697), mention triggers built from the configured bot login (#698), four further injection-sink floor defeaters (#696), and the release workflow failing loudly when the bump PR cannot be opened (#11). The SonarCloud pass on main is behaviour-neutral and carries no entry. A `Dependencies` section records the two bumps merged to main after this branch was cut: the Quarkus platform 3.38.0 → 3.38.1 (#706) and `actions/attest-build-provenance` 4.1.1 → 4.2.2 (#708). Both are merged in here, so the release builds on the same versions main is on. #707 (maven-minor-patch) is still open and is **not** included; if you want it in 0.6.2, merge it and say so and I will add the entry and re-merge. **Docs freeze, twice.** `versions.json` read `current: v0.6.0` with archives stopping at 0.5.0, while v0.6.1 was already released. Both 0.6.0 and 0.6.1 shipped without a freeze, so both are taken here. This is the third and fourth slip, after 0.4.0 was missed at the 0.5.0 cut and 0.5.0 at the 0.6.0 cut. Because `archive-docs-version.mjs` expands the include markers at archive time, each snapshot comes from its own tag rather than the working tree: README, `docs/`, `CONTRIBUTING.md` and the docs pages restored to `v0.6.0`, archived, restored to `v0.6.1`, archived, then returned to the live tree. One thing worth knowing: the doc sources are **byte-identical between v0.6.0 and v0.6.1**, so the two archives hold the same nine pages. That is correct rather than duplicated work — both are released versions and both belong in the picker — and it is why the 0.6.1 snapshot carries no `docs/RELEASING.md`, which arrived with #208 after the tag. Neither restore resurrected a deleted file, unlike the 0.4.0 archive. `current.label` moves to v0.6.2. **Release-triggered docs deploys now work.** The `github-pages` environment permitted only `main`, so the Docs workflow's `release: published` trigger — which runs against the tag ref — failed on every release. v0.6.0's deploy failed twice with: > Tag "v0.6.0" is not allowed to deploy to github-pages due to environment protection rules. and was worked around by dispatching from `main`, which publishes main's docs rather than the release's and contradicts the workflow's stated design ("Live site tracks GitHub Releases only"). A `v*` tag policy has been added alongside the existing `main` branch rule, so the next release deploys itself: ``` branch: main tag: v* ``` Both of these were undocumented, which is a large part of why the freeze slipped four times running. `docs/RELEASING.md` now carries them: the freeze as a named step in the release checklist, with the commands and the reason the snapshot has to come from the outgoing tag, and the `github-pages` tag policy with the error it produces and the command to inspect it. ## Related Issues Part 1 of #11 (the bump PR failing loudly) shipped in #208; this carries its changelog entry. ## How Has This Been Tested? - [x] Unit tests - [x] Manual testing - `./mvnw -B clean test` → `Tests run: 3248, Failures: 0, Errors: 0, Skipped: 0`, building `thrillhousebot 0.6.2` - `./mvnw -B clean compile spotbugs:check spotless:check` → `BugInstance size is 0` - `npm ci && npm run build` in `website/` → **93 pages** (up from 75; the two archives add 18), all internal links valid - Archive content verified in both directions: `docs/RELEASING.md` is absent from the 0.6.1 snapshot and present in the live tree; nine pages in each archive with matching assets and version metadata - `git status` after the tag restores showed nothing outside the new archive directories and `versions.json` No production code changes. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions-minor-patch group with 1 update: actions/attest-build-provenance.
Updates
actions/attest-build-provenancefrom 4.1.1 to 4.2.2Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions