ci(deps): bump azure/trusted-signing-action from 0.5.11 to 1.0.0#1608
ci(deps): bump azure/trusted-signing-action from 0.5.11 to 1.0.0#1608dependabot[bot] wants to merge 1 commit intodevelopfrom
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
.github/workflows/beta-release.yml
Outdated
| - name: Sign Windows executable with Azure Trusted Signing | ||
| if: env.AZURE_CLIENT_ID != '' | ||
| uses: azure/trusted-signing-action@v0.5.11 | ||
| uses: azure/trusted-signing-action@v1.0.0 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
54abd5f to
21d5df3
Compare
ce227d7 to
7822e4d
Compare
7822e4d to
c709ab2
Compare
| - name: Sign Windows executable with Azure Trusted Signing | ||
| if: env.AZURE_CLIENT_ID != '' | ||
| uses: azure/trusted-signing-action@v0.5.11 | ||
| uses: azure/trusted-signing-action@v1.1.0 |
There was a problem hiding this comment.
Bug: The release workflow uses a deprecated repository path and input parameter for the code signing action, which will cause the build to fail.
Severity: CRITICAL
Suggested Fix
Update the workflow to use the new action path Azure/artifact-signing-action@v1.1.0 and replace the deprecated input trusted-signing-account-name with signing-account-name.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/beta-release.yml#L282
Potential issue: The workflow file `beta-release.yml` uses an outdated configuration for
the code signing GitHub Action. The action's repository has been moved from
`azure/trusted-signing-action` to `Azure/artifact-signing-action`, and the input
parameter `trusted-signing-account-name` has been deprecated in favor of
`signing-account-name`. This misconfiguration will cause the signing step to fail during
the release workflow, preventing the creation and distribution of signed Windows
binaries.
Bumps [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) from 0.5.11 to 1.0.0. - [Release notes](https://github.com/azure/trusted-signing-action/releases) - [Commits](https://github.com/azure/trusted-signing-action/compare/v0.5.11...v1.0.0) --- updated-dependencies: - dependency-name: azure/trusted-signing-action dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
c709ab2 to
b012fb6
Compare
|
Superseded by #1931. |
Bumps azure/trusted-signing-action from 0.5.11 to 1.0.0.
Release notes
Sourced from azure/trusted-signing-action's releases.
Commits
db7a3a6Rebrand trusted signing into artifact signing (#108)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)