[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
EnricoMi/publish-unit-test-result-action	action	minor	v2.24.0 → v2.25.0
actions/download-artifact	action	patch	v8.0.1 → v8.0.2
actions/upload-artifact	action	patch	v7.0.1 → v7.0.2
ni/python-actions	action	minor	v0.8.0 → v0.9.0
zizmorcore/zizmor-action	action	minor	v0.6.2 → v0.7.0	v0.8.0 (+1)

---

Release Notes

EnricoMi/publish-unit-test-result-action

v2.25.0

Compare Source

Adds the following improvements:

• Pin docker action, add dependabot (#​764)
• Upgrade python dependencies (#​793, #​796, #​799, #​800)
• Upgrading GitHub Actions across platforms (#​794)
• Make Python dependency files sort-stable (#​795)

Full Changelog: EnricoMi/publish-unit-test-result-action@v2.24.0...v2.25.0

actions/download-artifact

v8.0.2

Compare Source

What's Changed

• Update the readme by @​danwkennedy in #​473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in #​492
• Prepare download-artifact v8.0.2 by @​tunc-d in #​493

New Contributors

• @​tunc-d made their first contribution in #​492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

ni/python-actions

v0.9.0: ni/python-actions v0.9.0

Compare Source

What's Changed

• Add check-project-links action (#​93)
  • This action searches a project tree for pyproject.toml files, extracts https:// links from those files, and validates each discovered URL by making an HTTP request in a Docker container. It fails only when a checked URL returns a 4xx response. 2xx and 3xx responses are treated as successful and logged without failing the action.
• Update dependencies to new major versions
  • actions/setup-python: v7.0.0
  • actions/cache: v6.1.0
  • actions/checkout: v7.0.0

Full Changelog: ni/python-actions@v0.8.0...v0.9.0

zizmorcore/zizmor-action

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#​2437)

• The self-hosted-runner audit is now significantly more precise (#​2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

• zizmor is now aware of the image_version workflow trigger (#​2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

• The cache-poisoning audit is now aware of pnpm/setup (#​2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

• Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

  Many thanks to @​marcalexiei for implementing this improvement!

• Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

• Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

• Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

• Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

• Bootstrap zizmor without Docker by @​potiuk in #​169
• Bump sync-zizmor-versions.py to Python 3.11 for locking by @​woodruffw in #​174
• Sync zizmor versions by @​github-actions[bot] in #​175

New Contributors

• @​potiuk made their first contribution in #​169

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

v0.6.4

Compare Source

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1301

v0.6.3

Compare Source

zizmor 1.30.0 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1300

---

Configuration

📅 Schedule: (in timezone US/Central)

• Branch creation
  • Only on Sunday (* * * * 0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

    50 files  ±0      50 suites  ±0   17m 42s ⏱️ +13s
 2 313 tests ±0   2 313 ✅ ±0  0 💤 ±0  0 ❌ ±0 
59 628 runs  ±0  59 628 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 407e835. ± Comparison against base commit ce6c511.

♻️ This comment has been updated with latest results.