[renovate]

This PR contains the following updates:

Package	Type	Update	Change
suzuki-shunsuke/pinact-action	action	minor	v3.0.0 → v3.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

suzuki-shunsuke/pinact-action

v3.1.0

Compare Source

Issues | Pull Requests | suzuki-shunsuke/pinact-action@v3.0.0...v3.1.0 | Base revision

This release includes all changes in v3.0.1.

Features

#​1217 Sign JSON Web Tokens with AWS KMS

A GitHub App private key stored in GitHub Secrets never expires, and anyone who obtains it can generate access tokens as long as the key stays registered.
You can now keep the private key in AWS KMS instead. The key can never be exported, and only the JSON Web Token signing is delegated to KMS.

- uses: suzuki-shunsuke/pinact-action@v3.1.0
  with:
    client_id: ${{vars.APP_CLIENT_ID}}
    aws_kms_key_id: ${{vars.KMS_KEY_ID}}
    aws_role_to_assume: ${{vars.AWS_ROLE_ARN}}

New inputs:

purpose	app	Securefix app
identify the app	client_id (new) or app_id	securefix_client_id (new) or securefix_app_id
KMS key	aws_kms_key_id	securefix_aws_kms_key_id
IAM role	aws_role_to_assume	securefix_aws_role_to_assume
region	aws_region	securefix_aws_region

• client_id and securefix_client_id can be used instead of app_id and securefix_app_id. GitHub recommends the Client ID. When both are set, the Client ID takes precedence.
• aws_role_to_assume assumes the IAM role with the GitHub OIDC token inside the action, so the AWS credentials are never exported to later steps of the job. The job needs the permission id-token: write. If it's not set, the standard AWS credential environment variables are used, so aws-actions/configure-aws-credentials also works.
• The securefix_ role and region fall back to the unprefixed ones.

Existing workflows using app_id and app_private_key need no change.

Fixes

#​1227 Install pinact when the caller has no aqua configuration

In a repository without its own aqua configuration, the action failed before running pinact:

ERR aqua failed exe_name=pinact error="command is not found"

The action's bundled aqua configuration wasn't found correctly, so the action only worked when the caller's repository had an aqua configuration to fall back to.
This has been broken since the action was rewritten in JavaScript (#​838).

Behavior change

If app_private_key or aws_kms_key_id is set without client_id or app_id, the action now fails with an error.
Previously it silently ignored the private key and used default_github_token.

Others

• Update pinact used by the action from v4.1.1 to v5.0.2. The action passes flags with two dashes, so pinact v5's breaking change about single-dash long flags doesn't affect it. If pinact is already installed on the runner, the installed one is used as before.
• #​1302 #​1303 Update aqua installed by the action from v2.62.3 to v2.65.2, and let Renovate keep it up to date
• Update reviewdog used by the action from v0.21.0 to v0.21.2
• #​1222 Update @​suzuki-shunsuke/github-app-token to ^0.1.0
• #​1278 Use the shared workflows for building and releasing JavaScript Actions

v3.0.1

Compare Source

[!WARNING]
This release has a bug. If pinact isn't installed and the caller repository has no aqua configuration, the action fails with aqua exec -- pinact reporting command is not found.
Please use v3.1.0 or later.
#​1209 #​1227

Fixes

#​1183 Fail the step when pinact errors in skip_push + review mode

Previously, when skip_push and review were enabled, pinact's exit code was ignored and the step's result was decided entirely by reviewdog.
If pinact stopped part way through (e.g. a GitHub API error), reviewdog received partial or empty results and the step passed even though nothing was verified.

Now the step fails when pinact exits with 3 or above.
Violations (exit codes 1 and 2) are still reported by reviewdog and governed by reviewdog_fail_level as before.
reviewdog still runs before the step fails, so the findings pinact did produce are posted to the pull request.

#​1181 Report the pinact failure reason based on its exit code

The error message now tells why pinact failed instead of a fixed GitHub Actions aren't pinned. or pinact run failed:

• 1: GitHub Actions aren't pinned.
• 2: pinact found problems that it can't fix automatically.
• 3: pinact failed due to a GitHub API error or an internal error.
• Others: pinact failed with an unexpected exit code N.

Only the messages changed. The set of runs that fail is the same as before.

Others

• #​1198 Update @​aquaproj/aqua-installer to 0.0.3. This removes the vulnerable nested undici@5.29.0 from dependencies.
• #​1179 Update aqua installed by the action from v2.56.1 to v2.62.3
• Update pinact used by the action from v4.0.0 to v4.1.1

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud