github-actions: bump oras-project/setup-oras from 1 to 2#607
Conversation
Bumps [oras-project/setup-oras](https://github.com/oras-project/setup-oras) from 1 to 2. - [Release notes](https://github.com/oras-project/setup-oras/releases) - [Commits](oras-project/setup-oras@v1...v2) --- updated-dependencies: - dependency-name: oras-project/setup-oras dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
bgentry
left a comment
bgentry
left a comment
There was a problem hiding this comment.
🤖 Codex review: Security review looks good to me.
I reviewed this as a dependency-upgrade supply-chain/security pass for the oras-project/setup-oras update at head 4dff8cd8605178aafd915bcbadf85acce4b5d103.
Scope reviewed:
- Workflow changes in
docker-riverproui.yaml. - Upstream action trust and behavior change from
oras-project/setup-oras@v1to@v2. - Security-relevant action metadata changes, including runtime, default ORAS CLI version, binary install behavior, permissions, and credential exposure paths.
- CI status, with the known Dependabot
riverprouiimage-publish/OIDC failure treated separately from dependency safety.
No blocking supply-chain issue found. The action remains in the trusted public ORAS project repository, the workflow references remain in the same action repository, and this PR does not add permissions, secrets, registries, or new workflow steps.
The notable upstream action changes are the expected Node runtime move from Node 20 to Node 24 and the default ORAS CLI update from 1.3.0 to 1.3.1. The residual risk is the normal action-managed ORAS binary download path; I did not find unexpected credential handling or new workflow trust expansion.
The remaining failed riverproui image checks are consistent with the known Dependabot OIDC/publish limitation, while the ordinary JS/Go checks and riverui image jobs passed.
1 participant
Bumps oras-project/setup-oras from 1 to 2.
Release notes
Sourced from oras-project/setup-oras's releases.
... (truncated)
Commits
38de303chore: release v2.0.0 (#160)bbd8d79chore(deps): bump@actions/coreto 3.x and@actions/tool-cacheto 4.x (#159)44d83f3chore(deps): Bump@types/nodefrom 24.12.0 to 25.5.2 (#158)dd86831fix: pin undici to >=6.24.1 to address CVEs (#157)be45691feat: migrate action runtime from node20 to node24 (#153)f0fe559Add version 1.3.1 with checksums from … (#150)0db6c65chore(deps): Bump@types/nodefrom 25.0.3 to 25.5.0 (#149)8a0db1echore(deps): Bump typescript from 5.9.3 to 6.0.2 (#151)bd8ffedchore: add TerryHowe to owners and code owners (#152)c33dd38chore(deps): Bump@types/nodefrom 25.0.2 to 25.0.3 (#131)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)