Bump docker/build-push-action from 2 to 4 #31190
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2 to 4. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v2...v4) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
requested review from
klizhentas,
russjones,
r0mant and
zmb3
as code owners
dependabot
bot
added
dependencies
|
Needs review to assess risk. I'll handle the initial triage of this and ping folks once I'm confident it is safe. |
|
There is risk here. Copying some analysis from https://github.com/gravitational/teleport.e/pull/2088#issuecomment-1710582912 Looks like the big change here is enabling SLSA provenance by default: https://slsa.dev/spec/v1.0/provenance This was rolled back in v3 (docker/build-push-action#781), due to breaking pull operations on some registries:
We'll need some testing here. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
bot
deleted the
dependabot/github_actions/docker/build-push-action-4
branch
Bumps docker/build-push-action from 2 to 4.
Release notes
Sourced from docker/build-push-action's releases.
... (truncated)
Commits
2eb1c19Merge pull request #880 from crazy-max/fix-inputlist27376feupdate generated contentc933000test: build-arg with hashdac08d4chore(deps): Bump@docker/actions-toolkitfrom 0.3.0 to 0.5.044ea916Merge pull request #875 from docker/dependabot/npm_and_yarn/docker/actions-to...0167eefupdate generated content91bf8bfchore(deps): Bump@docker/actions-toolkitfrom 0.2.0 to 0.3.0a799b4dMerge pull request #860 from docker/dependabot/npm_and_yarn/docker/actions-to...87480bdupdate generated contentf9efed5Merge pull request #871 from dvdksn/fix/secret-example-linkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)