Repository navigation
chore(deps): bump anchore/sbom-action from 0.17.8 to 0.24.3 - #154
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.17.8 to 0.24.3. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@55dc4ee...66cbf4b) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
the
github_actions
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update the SBOM action pin .github/workflows/release.yml |
The workflow pins anchore/sbom-action to v0.24.3 instead of v0.17.8. The step’s inputs are unchanged. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Possibly related issues
- opensawce/kaasu#147 — The action pin change relates to the release workflow’s SBOM generation, which is part of the issue’s broader SBOM and checksum requirements.
Possibly related PRs
- opensawce/kaasu#111 — This PR adds the release workflow and SBOM step whose action pin is updated here.
Suggested reviewers: manish-9245, scoder5
Merge Risk: 
a448c
-
The SBOM action update preserves the release workflow’s configured behavior and introduces no established merge blocker.
Architecture risk: 
a448c
-
The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.
Changed systems: None identified.
Architecture concerns
No architecture-level concerns identified.Review details
-
Before / after behavior
- observed — Modified behavior in .github/workflows/release.yml: The
anchore/sbom-actionpin changes from v0.17.8 to v0.24.3; the step’s inputs remain unchanged.
- observed — Modified behavior in .github/workflows/release.yml: The
-
Pre-merge checks: 
-
Check name Status Explanation Resolution Description check The description explains the dependency update and includes release notes, but it does not use the required template sections or provide the required checklist, change type, money-path assessment, AI-… Rewrite the description using the repository template. Complete ## What,## Type,## Money path,## AI assistance,## Checklist, and## Screenshots / notes. State why the dependency update needs no additional validation if appli…-
Check name Status Explanation Title check The title clearly describes the main change: updating the pinned anchore/sbom-actionversion from 0.17.8 to 0.24.3.Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Description check
-
Explanation
The description explains the dependency update and includes release notes, but it does not use the required template sections or provide the required checklist, change type, money-path assessment, AI-assistance declaration, issue reference, or screenshots and notes section.
Resolution
Rewrite the description using the repository template. Complete
## What,## Type,## Money path,## AI assistance,## Checklist, and## Screenshots / notes. State why the dependency update needs no additional validation if applicable, and provide aCloses #reference or explain why no issue applies.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Bumps anchore/sbom-action from 0.17.8 to 0.24.3.
Release notes
Sourced from anchore/sbom-action's releases.
... (truncated)
Commits
66cbf4bchore(deps): update Syft to latest release (#735)6b31fa7chore(deps-dev): bump type-fest from 5.9.0 to 5.10.0 (#742)85bda36chore(deps-dev): bump@types/nodefrom 26.5.1 to 26.6.1 (#741)7b97c1echore(deps): bump github.com/anchore/go-make in /.make (#738)891b055chore(deps): bump anchore/go-make/.github/actions/setup (#740)f73cf48chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#739)13576dbchore(deps-dev): bump@types/nodefrom 26.4.1 to 26.5.1 (#737)924e83bchore(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 (#736)274555fchore(deps-dev): bump type-fest from 5.8.0 to 5.9.0 (#732)48fb538chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#734)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit