Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 3, 2025

Bumps lfreleng-actions/gerrit-change-info from 542b2b4d78b75e430f64237b2b2b24d9f8dc0d77 to 1f90b0c29398e50d3f81b8fff34f805b428b996c.

Changelog

Sourced from lfreleng-actions/gerrit-change-info's changelog.

CHANGELOG

[Unreleased]

Added

  • path_prefix support: New path_prefix input parameter to set the directory for action execution
    • Allows execution in repository subdirectories
    • Works with nested paths like "projects/backend"
    • Keeps backward compatibility (defaults to ".")
    • Creates missing directories automatically
    • Includes security checks against directory traversal

Security

  • Path validation: Added security checks for path_prefix parameter
    • Blocks parent directory references with ..
    • Prevents absolute paths starting with /
    • Checks for dangerous characters
    • Creates directories in workspace

Enhanced

  • Script execution: Updated scripts to work with the path_prefix directory
  • File operations: Output files now go to the path_prefix directory
  • Error handling: Improved error messages for path-related issues
  • Documentation: Comprehensive documentation and examples for the new feature

Testing

  • Integration tests: Added comprehensive test suite for path_prefix functionality
  • Security tests: Validation tests for dangerous path patterns
  • Compatibility tests: Backward compatibility verification
  • Error handling tests: Tests for common error conditions

Documentation

  • README updates: Added usage examples and parameter documentation
  • Feature documentation: Detailed explanation in docs/path-prefix.md
  • Contributing guide: Updated with testing instructions for new feature
  • Troubleshooting: Added common issues and solutions for path_prefix

Files Modified

... (truncated)

Commits
  • 1f90b0c Merge pull request #47 from lfreleng-actions/dependabot/github_actions/lfit/r...
  • eb8bdfe Merge pull request #45 from lfreleng-actions/pre-commit-ci-update-config
  • 99f6aaa Chore: Bump lfit/releng-reusable-workflows from 0.2.22 to 0.2.24
  • 6ae1739 Chore: pre-commit autoupdate
  • 752b845 Merge pull request #42 from lfreleng-actions/pre-commit-ci-update-config
  • 5dc2e56 Merge pull request #44 from lfreleng-actions/dependabot/github_actions/lfit/r...
  • 855f442 Chore: Bump lfit/releng-reusable-workflows from 0.2.19 to 0.2.22
  • 1b1c7fd Chore: pre-commit autoupdate
  • 71a9ba9 Merge pull request #40 from lfreleng-actions/dependabot/github_actions/lfit/r...
  • ce31825 Merge pull request #41 from askb/main
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [lfreleng-actions/gerrit-change-info](https://github.com/lfreleng-actions/gerrit-change-info) from 542b2b4d78b75e430f64237b2b2b24d9f8dc0d77 to 1f90b0c29398e50d3f81b8fff34f805b428b996c.
- [Release notes](https://github.com/lfreleng-actions/gerrit-change-info/releases)
- [Changelog](https://github.com/lfreleng-actions/gerrit-change-info/blob/main/CHANGELOG.md)
- [Commits](lfreleng-actions/gerrit-change-info@542b2b4...1f90b0c)

---
updated-dependencies:
- dependency-name: lfreleng-actions/gerrit-change-info
  dependency-version: 1f90b0c29398e50d3f81b8fff34f805b428b996c
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 10, 2025

Superseded by #26.

@dependabot dependabot bot closed this Nov 10, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/lfreleng-actions/gerrit-change-info-1f90b0c29398e50d3f81b8fff34f805b428b996c branch November 10, 2025 02:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Development

Successfully merging this pull request may close these issues.

1 participant