Repository navigation
build(deps): bump the github-actions group across 1 directory with 4 updates - #22412
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the github-actions group with 4 updates in the / directory: [docker/login-action](https://github.com/docker/login-action), [elastic/oblt-actions/google/auth](https://github.com/elastic/oblt-actions), [elastic/oblt-actions/aws/auth](https://github.com/elastic/oblt-actions) and [elastic/oblt-actions/test-report](https://github.com/elastic/oblt-actions). Updates `docker/login-action` from 4.6.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@dbcb813...8aa5831) Updates `elastic/oblt-actions/google/auth` from 1.42.1 to 1.44.0 - [Release notes](https://github.com/elastic/oblt-actions/releases) - [Changelog](https://github.com/elastic/oblt-actions/blob/main/docs/RELEASE.md) - [Commits](elastic/oblt-actions@fd3d4bb...37d142a) Updates `elastic/oblt-actions/aws/auth` from 1.42.1 to 1.44.0 - [Release notes](https://github.com/elastic/oblt-actions/releases) - [Changelog](https://github.com/elastic/oblt-actions/blob/main/docs/RELEASE.md) - [Commits](elastic/oblt-actions@fd3d4bb...37d142a) Updates `elastic/oblt-actions/test-report` from 1.42.1 to 1.44.0 - [Release notes](https://github.com/elastic/oblt-actions/releases) - [Changelog](https://github.com/elastic/oblt-actions/blob/main/docs/RELEASE.md) - [Commits](elastic/oblt-actions@fd3d4bb...37d142a) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: elastic/oblt-actions/google/auth dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: elastic/oblt-actions/aws/auth dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: elastic/oblt-actions/test-report dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
github_actions
Contributor
🤖 GitHub commentsJust comment with:
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for the pinned GitHub Actions dependency updates.
No open issues 🎉
What changed in this PR
Updates pinned GitHub Actions dependencies used by APM Server’s CI, testing, and maintenance workflows. Workflow logic and action inputs remain unchanged.
Changes:
- Bumps
docker/login-actionfrom 4.6.0 to 4.8.0. - Bumps Elastic’s Google authentication, AWS authentication, and test-report actions from 1.42.1 to 1.44.0, retaining commit-SHA pins.
| File | Description |
|---|---|
.github/workflows/update-compose.yml |
Updates Docker login for GHCR authentication. |
.github/workflows/test-reporter.yml |
Updates the test-report action. |
.github/workflows/smoke-tests-ess.yml |
Updates AWS and Google authentication actions. |
.github/workflows/functional-tests.yml |
Updates Google authentication for functional tests. |
.github/workflows/ci.yml |
Updates Docker login for the Elastic container registry. |
.github/workflows/benchmarks.yml |
Updates Docker login for benchmark registry access. |
Review effort: Balanced
Contributor
Dependency Update AnalysisSummary: This PR updates four SHA-pinned GitHub Actions ( docker/login-action
|
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | workflow_dispatch/schedule; ci.yml usage is guarded and skipped for Dependabot PRs |
| Commit verified | ✅ Yes (actions-commit-verification.json) |
| Pin format | ✅ SHA-pinned |
Changelog highlights (v4.6.0 → v4.8.0)
- Release notes include maintenance/dependency updates and Docker Hub OIDC token lifetime defaulting to 1 hour.
- No CVE/GHSA entries were listed in release notes for this range.
- Security posture impact for this repo usage is neutral-to-positive (shorter token lifetime reduces exposure window; no interface changes used here).
Usage in this repository
.github/workflows/benchmarks.yml(container registry login withregistry/username/password).github/workflows/ci.yml(same login inputs intest-package-and-pushjob).github/workflows/update-compose.yml(GHCR login withregistry/username/password)
Compatibility assessment
- Action metadata (
action.yml) is unchanged between the pinned SHAs for consumed inputs. - Current inputs in this repo (
registry,username,password) remain valid.
elastic/oblt-actions/google/auth 1.42.1 → 1.44.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | workflow_dispatch/schedule/workflow_call |
| Commit verified | ✅ Yes (actions-commit-verification.json) |
| Pin format | ✅ SHA-pinned |
Changelog highlights (1.42.1 → 1.44.0)
oblt-actionsreleases in this range show mainly docs/maintenance plus one new unrelated action (github/free-disk-space).- No CVE/GHSA/security-fix entries affecting
google/authwere called out. - Risk for this repo usage is preserved (no auth input/output contract changes observed).
Usage in this repository
Pinned SHA usage updated in:
.github/workflows/functional-tests.yml.github/workflows/smoke-tests-ess.yml
Additional repo usage also exists via mutable @v1 in other workflows/composite actions.
Compatibility assessment
google/auth/action.ymlcontent is unchanged between old/new pinned SHAs.- Consumed inputs (
project-number,project-id) remain compatible.
elastic/oblt-actions/aws/auth 1.42.1 → 1.44.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | workflow_dispatch/workflow_call workflow |
| Commit verified | ✅ Yes (actions-commit-verification.json) |
| Pin format | ✅ SHA-pinned |
Changelog highlights (1.42.1 → 1.44.0)
- No release-note items indicate
aws/authcontract/security behavior changes. - No CVE/GHSA entries were listed for this range.
- Vulnerability exposure is unchanged for this repo usage.
Usage in this repository
Pinned SHA usage updated in:
.github/workflows/smoke-tests-ess.yml
Additional repo usage also exists via mutable @v1 in other workflows.
Compatibility assessment
aws/auth/action.ymlis unchanged between old/new pinned SHAs.- Consumed input (
role-duration-seconds) remains compatible.
elastic/oblt-actions/test-report 1.42.1 → 1.44.0
Ecosystem: GitHub Actions
| Check | Result |
|---|---|
| Breaking changes | ✅ None found |
| Testable in PR | ✅ Yes — runs via workflow_run after ci completion (CI includes PR events) |
| Commit verified | ✅ Yes (actions-commit-verification.json) |
| Pin format | ✅ SHA-pinned |
Changelog highlights (1.42.1 → 1.44.0)
- No release-note items indicate
test-reportinterface changes. - No CVE/GHSA/security-fix entries were listed for this action in release notes.
- Security impact appears neutral for current usage.
Usage in this repository
.github/workflows/test-reporter.ymlwith inputs:artifactnamepathreporter
Compatibility assessment
test-report/action.ymlis unchanged between old/new pinned SHAs.- All consumed inputs remain valid.
Labels Applied
oblt-aw/ai/merge-ready— applied (low-to-moderate CI-only risk, verified SHA pins, no breaking usage changes found).
What is this? | From workflow: Observability Agentic Workflow — Pull Request
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Automerge eligibility gates satisfied; approving for merge.
What is this? | From workflow: Observability Agentic Workflow — Pull Request
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
Automerge could not complete for this pull request. REST merge failed with a non-retryable repository rule or required-check blocker (for example CODEOWNERS without Vault bypass). Check the linked workflow run for details, or ask a maintainer to merge this pull request manually. Workflow run: https://github.com/elastic/apm-server/actions/runs/42529462363 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 4 updates in the / directory: docker/login-action, elastic/oblt-actions/google/auth, elastic/oblt-actions/aws/auth and elastic/oblt-actions/test-report.
Updates
docker/login-actionfrom 4.6.0 to 4.8.0Release notes
Sourced from docker/login-action's releases.
Commits
8aa5831Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...043f81d[dependabot skip] chore: update generated content3ff6998build(deps): bump@docker/actions-toolkitfrom 0.107.0 to 0.109.0694ef6aMerge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...7c6e412[dependabot skip] chore: update generated contentaa2441fbuild(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...d6c10b0Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...319f1eeMerge pull request #1104 from docker/dependabot/github_actions/actions/setup-...b483b7fMerge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7dc7d67cMerge pull request #1070 from crazy-max/increase-oidc-default-expiryUpdates
elastic/oblt-actions/google/authfrom 1.42.1 to 1.44.0Release notes
Sourced from elastic/oblt-actions/google/auth's releases.
Commits
37d142afeat(github/free-disk-space): add our own free-disk-space action (#1186)a5537abfix(kibana-docker-image): read node version from .nvmrc (#1188)0683ba4build(deps): bump updatecli/updatecli-action (#1178)14945e9build(deps-dev): bump eslint from 10.12.0 to 10.13.0 in /snapshoty/run (#1185)70179e4build(deps-dev): bump undici (#1182)ca78088Docs: ephemeral labels-copier example only needs id-token: write. (#1179)208d03bDocument Vault token usage for mergify labels-copier (#1171)e173c96Document which release branches finalize leaves for the caller (#1156)9a95c8bReport a no-op preparation as a warning annotation in edot-release/prepare-st...7754a36docs: document GitHub Actions workflows (#1172)Updates
elastic/oblt-actions/aws/authfrom 1.42.1 to 1.44.0Release notes
Sourced from elastic/oblt-actions/aws/auth's releases.
Commits
37d142afeat(github/free-disk-space): add our own free-disk-space action (#1186)a5537abfix(kibana-docker-image): read node version from .nvmrc (#1188)0683ba4build(deps): bump updatecli/updatecli-action (#1178)14945e9build(deps-dev): bump eslint from 10.12.0 to 10.13.0 in /snapshoty/run (#1185)70179e4build(deps-dev): bump undici (#1182)ca78088Docs: ephemeral labels-copier example only needs id-token: write. (#1179)208d03bDocument Vault token usage for mergify labels-copier (#1171)e173c96Document which release branches finalize leaves for the caller (#1156)9a95c8bReport a no-op preparation as a warning annotation in edot-release/prepare-st...7754a36docs: document GitHub Actions workflows (#1172)Updates
elastic/oblt-actions/test-reportfrom 1.42.1 to 1.44.0Release notes
Sourced from elastic/oblt-actions/test-report's releases.
Commits
37d142afeat(github/free-disk-space): add our own free-disk-space action (#1186)a5537abfix(kibana-docker-image): read node version from .nvmrc (#1188)0683ba4build(deps): bump updatecli/updatecli-action (#1178)14945e9build(deps-dev): bump eslint from 10.12.0 to 10.13.0 in /snapshoty/run (#1185)70179e4build(deps-dev): bump undici (#1182)ca78088Docs: ephemeral labels-copier example only needs id-token: write. (#1179)208d03bDocument Vault token usage for mergify labels-copier (#1171)e173c96Document which release branches finalize leaves for the caller (#1156)9a95c8bReport a no-op preparation as a warning annotation in edot-release/prepare-st...7754a36docs: document GitHub Actions workflows (#1172)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions