Conversation
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.32.0 to 0.33.0. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@0.32.0...0.33.0) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
We use the `bandit` hook twice in the pre-commit configuration: once for the `tests/` subdirectory and once for everything _except_ the `tests/` subdirectory. These two hooks should be using the same version of the `bandit` hook, but the second use was missed when updating hook versions from upstream.
…s/download-artifact-5 Bump actions/download-artifact from 4 to 5
…curity/trivy-action-0.33.0 Bump aquasecurity/trivy-action from 0.32.0 to 0.33.0
Sync the versions of `bandit` used by pre-commit
dv4harr10 approved these changes Sep 4, 2025
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR updates dependencies across pre-commit configuration and GitHub Actions workflows to incorporate upstream changes from the skeleton-docker repository.
- Updated bandit security linter from version 1.7.10 to 1.8.3
- Updated GitHub Actions dependencies including download-artifact and trivy-action to newer versions
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .pre-commit-config.yaml | Updates bandit security linter version for improved security scanning |
| .github/workflows/build.yml | Updates GitHub Actions dependencies for artifact handling and vulnerability scanning |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
jsf9k approved these changes Sep 4, 2025
cisagovbot pushed a commit that referenced this pull request Jan 1, 2026
…s/checkout-6 Bump actions/checkout from 5 to 6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lineage Pull Request
Lineage has created this pull request to incorporate new changes found in an upstream repository:
Upstream repository:
https://github.com/cisagov/skeleton-docker.gitRemote branch:
HEADCheck the changes in this pull request to ensure they won't cause issues with your project.
✅ Pre-approval checklist
Remove any of the following that do not apply. If you're unsure about any of these, don't hesitate to ask. We're here to help!
Note
You are seeing this because one of this repository's maintainers has configured Lineage to open pull requests.
For more information:
🛠 Lineage configurations for this project are stored in
.github/lineage.yml📚 Read more about Lineage