[PR #587] [MERGED] chore(deps): update slsa-framework/slsa-github-generator action to v2.1.0 #590

New issue

Closed

opened 2026-03-03 14:31:52 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 14:31:52 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/konstruktoid/hardening/pull/587
Author: @renovate[bot]
Created: 2/28/2025
Status: ✅ Merged
Merged: 2/28/2025
Merged by: @renovate[bot]

Base: master ← Head: renovate/slsa-framework-slsa-github-generator-2.x

📝 Commits (1)

7ce6649 chore(deps): update slsa-framework/slsa-github-generator action to v2.1.0

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 .github/workflows/slsa.yml (+1 -1)

📄 Description

This PR contains the following updates:

Package	Type	Update	Change
slsa-framework/slsa-github-generator	action	minor	`v2.0.0` -> `v2.1.0`

Release Notes

slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)

`v2.1.0`

Compare Source

v2.1.0: Sigstore Bundles for Generic Generator and Go Builder

The workflows generator_generic_slsa3.yml and builder_go_slsa3.yml
have been updated to produce signed Sigstore Bundles, just like all the other builders
that use the BYOB framework.

The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on
https://search.sigstore.dev/.

v2.1.0: Vars context recorded in provenance

Updated: GitHub vars context is now recorded in provenance for the generic and
container generators. The vars context cannot affect the build in the Go
builder so it is not recorded.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/konstruktoid/hardening/pull/587 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 2/28/2025 **Status:** ✅ Merged **Merged:** 2/28/2025 **Merged by:** [@renovate[bot]](https://github.com/apps/renovate) **Base:** `master` ← **Head:** `renovate/slsa-framework-slsa-github-generator-2.x` --- ### 📝 Commits (1) - [`7ce6649`](https://github.com/konstruktoid/hardening/commit/7ce6649b6a2e498b243013ff157cd08e94d503dd) chore(deps): update slsa-framework/slsa-github-generator action to v2.1.0 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/slsa.yml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [slsa-framework/slsa-github-generator](https://redirect.github.com/slsa-framework/slsa-github-generator) | action | minor | `v2.0.0` -> `v2.1.0` | --- ### Release Notes <details> <summary>slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)</summary> ### [`v2.1.0`](https://redirect.github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v210) [Compare Source](https://redirect.github.com/slsa-framework/slsa-github-generator/compare/v2.0.0...v2.1.0) ##### v2.1.0: Sigstore Bundles for Generic Generator and Go Builder The workflows `generator_generic_slsa3.yml` and `builder_go_slsa3.yml` have been updated to produce signed Sigstore Bundles, just like all the other builders that use the BYOB framework. The workflow logs will now print a LogIndex, rather than a LogUUID. Both are equally searchanble on https://search.sigstore.dev/. ##### v2.1.0: Vars context recorded in provenance - **Updated**: GitHub `vars` context is now recorded in provenance for the generic and container generators. The `vars` context cannot affect the build in the Go builder so it is not recorded. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/konstruktoid/hardening).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>