[renovate]

This PR contains the following updates:

Package	Type	Update	Change
datum-cloud/actions	workflow	minor	v1.18.0 → v1.23.1

---

Release Notes

datum-cloud/actions

v1.23.1: : Local vulnerability scan follows CI

Compare Source

The local vulnerability scan now follows the version of the workflow that CI runs, and the docs say more clearly how the scan picks its Go version.

What's new

• Local scan follows CI. The Taskfile snippet reads its version from the repository's uses: line for vuln-scan.yaml, so when Renovate bumps that line, the local scan moves with it. The line can pin a tag or a commit SHA. (#​108)
• Go version spelled out. The go-version input now says that a module with go 1.26.0 and no toolchain line is scanned with the latest 1.26 patch, and the workflow links to its README. (#​108)
• What adopters check. The README says the scan's failure on vulnerable dependencies is tested in this repository. An adopting repository checks instead that its targets show as scanned and that the check is required. (#​108)

[!NOTE]
To pick up the new local scan, replace the Taskfile tasks copied from the README. The snippet no longer sets ACTIONS_REF, and it fails if no workflow calls vuln-scan.yaml or if two call it at different versions. Copies of the old snippet keep working.

v1.23.0: : Shared vulnerability scanning

Compare Source

Repositories can now scan their dependencies for known vulnerabilities on every pull request and on a schedule, and run the same scan locally.

What's new

• Vulnerability scan workflow. vuln-scan finds Go modules, JavaScript, Python, and Rust lockfiles, and named container images, and fails on any known vulnerability that a reviewed ignore file doesn't cover. (#​102, #​106)
• Local scans. A Taskfile task runs the same scan on a workstation, using the Go version the repository ships. (#​102)
• Caller examples pin a real tag. The docs pinned v1, which was never published. Every example now pins this release. (#​105)

[!NOTE]
Go findings count only when the code calls the vulnerable function. Every suppression needs an ignoreUntil at most 12 months away. pnpm, yarn, bun, and Cargo lockfiles don't mark dev dependencies, so every package in them is scanned.

v1.22.0: : Keep NOTICE files current

Compare Source

Repositories with a NOTICE file can now keep it current automatically, and dependency pull requests get both their NOTICE and Nix hash commits.

What's new

• NOTICE refresh workflow. update-notice runs a repository's NOTICE task when Go dependencies change on a branch and commits the result to that branch. (#​100)
• Nix hash updates survive a race. nix-update-hash now rebases and retries its push when another workflow commits to the branch first, rather than failing. (#​100)
• UTC build dates in images. publish-docker stamps BUILD_DATE as the build time in UTC, and sets it on release builds, where it was empty. (#​94)
• Plugin catalog updates reuse open PRs. update-plugin-index refreshes the existing catalog pull request for a plugin instead of opening another one. (#​98)

[!NOTE]
The snyk-scan workflow is removed, because the Snyk account behind it is switched off. Its last caller was removed in datum-cloud/backstage#75, and callers pinned to an older commit or tag keep working. (#​96)

v1.21.0

Compare Source

What's Changed

• docs: point agent guidance at shared PR conventions by @​ecv in #​92
• feat: Use project Iteration field instead of Month by @​kevwilliams in #​93

New Contributors

• @​ecv made their first contribution in #​92

Full Changelog: datum-cloud/actions@v1.20.0...v1.21.0

v1.20.0

Compare Source

publish-kustomize-bundle: add a multi-image images input (a list of {path, name, tag}) so a bundle can pin several differently-named images across their overlays in one call. Backward-compatible — the existing single-image image-name / image-overlays inputs are unchanged and used when images is omitted. (#​89)

v1.19.0

Compare Source

Add a build-secrets input to publish-docker.yaml for forwarding BuildKit secrets (RUN --mount=type=secret,id=<name>) to the image build — e.g. authenticated apt/package repositories — without baking them into image layers or history. Passed via the caller's secrets: block. (#​87)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Ask Polylane for an impact assessment of this pull request: