spectolabs / hoverfly-github-action Goto Github PK

We have pinned the linux dependencies in the devcontainer Dockerfile, but there is no mechanism to automatically update them, currently. It looks like it's on Dependabot's roadmap, so this GitHub Issue gets automatically created every 6 months to:

• update the dependencies manually:
  1. Temporarily unpin the versions (i.e. remove =<version> from each package in the Dockerfile)
  2. Execute the Dockerfile (e.g. if it's a remote container Dockerfile build the remote container)
  3. Run apt-cache policy <package> for each package, to see the version installed
  4. Pin all the versions, replacing any old versions with new ones
• see if Dependabot now offer this functionality (in which case we can do it automatically, from then on)

The workflow check-commit-message.yml is referencing action mristin/opinionated-commit-message using references v2.1.2. However this reference is missing the commit 65fbfc6161d2379c9e3c58859aa7c7f0814b1462 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

Blocked currently as Github-integrated Dependabot badges aren't available yet: dependabot/dependabot-core#1960

Will create an issue in https://github.com/mristin/opinionated-commit-message for this to be fixed.

My team would like to be able to run this on windows-latest. Would it be possible to make this cross-platform?

This is because we have transferred the repo from agilepathway to the SpectoLabs organisation.

Replace the references to agilepathway

• in the README examples
• in our tests
• anywhere else that we find

This Hoverfly GitHub Action requires an owner of the SpectoLabs GitHub org to accept the latest GitHub Marketplace Developer Agreement, before any new versions of the Action can be published to the Marketplace.

See https://github.com/SpectoLabs/hoverfly-github-action/releases/edit/v1.1.41

Very grateful if you can accept it, @JohnFDavenport or @tommysitu 🙏🏻

Hopefully this will fix the problem where new releases have the entire commit history instead of just the commits pertaining to the release.

There is a new major (i.e. non-backwards compatible) version of goreleaser, so will need to be careful to make sure we don't break anything.

https://github.com/goreleaser/goreleaser-action/releases

We have pinned the linux dependencies in the devcontainer Dockerfile, but there is no mechanism to automatically update them, currently. It looks like it's on Dependabot's roadmap, so this GitHub Issue gets automatically created every 6 months to:

• update the dependencies manually:
  1. Temporarily unpin the versions (i.e. remove =<version> from each package in the Dockerfile)
  2. Execute the Dockerfile (e.g. if it's a remote container Dockerfile build the remote container)
  3. Run apt-cache policy <package> for each package, to see the version installed
  4. Pin all the versions, replacing any old versions with new ones
• see if Dependabot now offer this functionality (in which case we can do it automatically, from then on)

• Notify the core maintainers if the tests fail

Ubuntu releases annually in April.

In 2020 the GitHub Actions team supported the April release for that year by mid June, so this GitHub Issue gets automatically created annually each year on 15 July for us to do the update (as hopefully GitHub Actions will support the new version by then each year).

We can find out if we can update yet here.

When we do the update to the new version it involves e.g. for 2021, simply replacing every case of ubuntu-20.04 with ubuntu-21.04.

• when we have updated and merged the change to the main branch, this search should return zero results (NB it may take 5 minutes before the search index will show the right results)
• update this issue template so that it corresponds to the following year (e.g. in July 2021, replace all cases of 20.04 with 21.04)

• Update the CONTRIBUTING.md to indicate that tests should be added/amended when contributing

Test for:

• happy path using default version (no version passed in)
• happy path with valid version (different to default version) passed in
• an invalid runner github workspace path passed in
• an invalid version passed in (a version that doesn't exist)
• an invalid version passed in (missing the initial v]
• no github runner workspace path passed in
• an invalid github runner workspace path passed in

• Look at both GitHub Dependabot and Renovate

• dependency PRs should be labelled with:

  • dependencies
  • patch

Dependencies to keep up to date:

• default Hoverfly version in the action.yml
• example Hoverfly version in the README
• shellcheck version in the devcontainer Dockerfile
• other dependencies in the devcontainer Dockerfile
• all the versions in my actions (in the .github/workflows dir)
• the go version in github_tag_and_release.yml
• the (latest) hoverfly version in the tests.yml
• the version of Ubuntu in the GitHub Actions
• the Docker image in the FROM command