Skip to content

action-allowlist-review: bump runs-on/action from 2.1.0 to 2.1.2 in /.github/actions/for-dependabot-triggered-reviews#825

Merged
potiuk merged 1 commit intomainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/runs-on/action-2.1.2
May 9, 2026
Merged

action-allowlist-review: bump runs-on/action from 2.1.0 to 2.1.2 in /.github/actions/for-dependabot-triggered-reviews#825
potiuk merged 1 commit intomainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/runs-on/action-2.1.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 8, 2026

Bumps runs-on/action from 2.1.0 to 2.1.2.

Release notes

Sourced from runs-on/action's releases.

v2.1.2

Full Changelog: runs-on/action@v2.1.1...v2.1.2

v2.1.1

What's Changed

Full Changelog: runs-on/action@v2.1.0...v2.1.1

Commits
  • d141ef8 dist: rebuild binaries for v2.1.2
  • c5df553 Add manual release workflow with gpg signing and checksums
  • e46a3c6 dist: rebuild binaries
  • 88629fc Send runtime token to Magic Cache config
  • 6e9cb2b Update actions
  • 408de89 dist: rebuild binaries
  • e8a2e6d Remove dead code: unused MetricSummary fields and calculateMin/calculateMax f...
  • 3a86586 dist: rebuild binaries
  • 61a7be1 build: upgrade to go 1.26
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [runs-on/action](https://github.com/runs-on/action) from 2.1.0 to 2.1.2.
- [Release notes](https://github.com/runs-on/action/releases)
- [Commits](runs-on/action@742bf56...d141ef8)

---
updated-dependencies:
- dependency-name: runs-on/action
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 8, 2026
@dependabot dependabot Bot requested a review from dfoulks1 as a code owner May 8, 2026 13:25
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 8, 2026
@dependabot dependabot Bot requested a review from potiuk as a code owner May 8, 2026 13:25
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label May 8, 2026
@potiuk
Copy link
Copy Markdown
Member

potiuk commented May 9, 2026

Quick update on the verification path: runs-on/action's maintainer (@crohr) shipped the chain we asked for in issue #36 via PR #37. v2.1.2's release now carries:

  • SLSA build provenance via actions/attest-build-provenance (verifiable with gh attestation verify)
  • A SHA256SUMS release asset

I've extended verify-action-build's in-tree binary check to use either chain (#819). Running locally against this PR's SHA on top of #819:

In-tree binary check  ✓  no in-tree binaries (or all verified via attestation / SHA256SUMS)
  ✓ 3 binary(ies) verified via gh attestation (SLSA provenance):
    ✓ main-linux-amd64
    ✓ main-linux-arm64
    ✓ main-windows-amd64.exe
RESULT: All compiled JavaScript matches the rebuild

So once #819 merges, this PR's CI should go green and this is safe to approve.

@potiuk
Copy link
Copy Markdown
Member

potiuk commented May 9, 2026

Approved. The binaries are now build in GitHub and they are provided with full attestation of the build as checked in #819

@potiuk potiuk merged commit 9fa04fc into main May 9, 2026
10 checks passed
@potiuk potiuk deleted the dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/runs-on/action-2.1.2 branch May 9, 2026 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant