From fff1664e3d7f75cffaf241f9d78c89306e245a5d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 2 Apr 2026 00:04:08 -0400
Subject: [PATCH] build(deps): bump the actions group across 1 directory with 2
updates (#1105)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bumps the actions group with 2 updates in the / directory:
[actions/setup-go](https://github.com/actions/setup-go) and
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).
Updates `actions/setup-go` from 6.3.0 to 6.4.0
Release notes
Sourced from actions/setup-go's
releases.
v6.4.0
What's Changed
Enhancement
Dependency update
Documentation update
New Contributors
Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.4.0
Commits
Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
Release notes
Sourced from sigstore/cosign-installer's
releases.
v4.1.1
What's Changed
Full Changelog: https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1
Commits
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
.github/workflows/ci.yml | 4 ++--
.github/workflows/deploy-production.yml | 2 +-
.github/workflows/deploy-staging.yml | 4 ++--
.github/workflows/release.yml | 6 +++---
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1863041..1bc20d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'go.mod'
cache: true
@@ -53,7 +53,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'go.mod'
cache: true
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
index fc72c6d..0ca5224 100644
--- a/.github/workflows/deploy-production.yml
+++ b/.github/workflows/deploy-production.yml
@@ -26,7 +26,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Setup Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'deploy/go.mod'
cache: true
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index f2208fb..dd0589f 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -25,7 +25,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'go.mod'
cache: true
@@ -73,7 +73,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Setup Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'deploy/go.mod'
cache: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e07ba3..ea606b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,13 +19,13 @@ jobs:
fetch-depth: 0
- name: Set up Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'go.mod'
cache: true
- name: Install cosign
- uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+ uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
- name: Install Syft
uses: anchore/sbom-action/download-syft@v0.24.0
@@ -48,7 +48,7 @@ jobs:
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Set up Go
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+ uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
with:
go-version-file: 'go.mod'
cache: true