[renovate]

This PR contains the following updates:

Package	Type	Update	Change
datum-cloud/actions	workflow	minor	v1.14.0 → v1.23.1

---

Release Notes

datum-cloud/actions

v1.23.1: : Local vulnerability scan follows CI

Compare Source

The local vulnerability scan now follows the version of the workflow that CI runs, and the docs say more clearly how the scan picks its Go version.

What's new

• Local scan follows CI. The Taskfile snippet reads its version from the repository's uses: line for vuln-scan.yaml, so when Renovate bumps that line, the local scan moves with it. The line can pin a tag or a commit SHA. (#​108)
• Go version spelled out. The go-version input now says that a module with go 1.26.0 and no toolchain line is scanned with the latest 1.26 patch, and the workflow links to its README. (#​108)
• What adopters check. The README says the scan's failure on vulnerable dependencies is tested in this repository. An adopting repository checks instead that its targets show as scanned and that the check is required. (#​108)

[!NOTE]
To pick up the new local scan, replace the Taskfile tasks copied from the README. The snippet no longer sets ACTIONS_REF, and it fails if no workflow calls vuln-scan.yaml or if two call it at different versions. Copies of the old snippet keep working.

v1.23.0: : Shared vulnerability scanning

Compare Source

Repositories can now scan their dependencies for known vulnerabilities on every pull request and on a schedule, and run the same scan locally.

What's new

• Vulnerability scan workflow. vuln-scan finds Go modules, JavaScript, Python, and Rust lockfiles, and named container images, and fails on any known vulnerability that a reviewed ignore file doesn't cover. (#​102, #​106)
• Local scans. A Taskfile task runs the same scan on a workstation, using the Go version the repository ships. (#​102)
• Caller examples pin a real tag. The docs pinned v1, which was never published. Every example now pins this release. (#​105)

[!NOTE]
Go findings count only when the code calls the vulnerable function. Every suppression needs an ignoreUntil at most 12 months away. pnpm, yarn, bun, and Cargo lockfiles don't mark dev dependencies, so every package in them is scanned.

v1.22.0: : Keep NOTICE files current

Compare Source

Repositories with a NOTICE file can now keep it current automatically, and dependency pull requests get both their NOTICE and Nix hash commits.

What's new

• NOTICE refresh workflow. update-notice runs a repository's NOTICE task when Go dependencies change on a branch and commits the result to that branch. (#​100)
• Nix hash updates survive a race. nix-update-hash now rebases and retries its push when another workflow commits to the branch first, rather than failing. (#​100)
• UTC build dates in images. publish-docker stamps BUILD_DATE as the build time in UTC, and sets it on release builds, where it was empty. (#​94)
• Plugin catalog updates reuse open PRs. update-plugin-index refreshes the existing catalog pull request for a plugin instead of opening another one. (#​98)

[!NOTE]
The snyk-scan workflow is removed, because the Snyk account behind it is switched off. Its last caller was removed in datum-cloud/backstage#75, and callers pinned to an older commit or tag keep working. (#​96)

v1.21.0

Compare Source

What's Changed

• docs: point agent guidance at shared PR conventions by @​ecv in #​92
• feat: Use project Iteration field instead of Month by @​kevwilliams in #​93

New Contributors

• @​ecv made their first contribution in #​92

Full Changelog: datum-cloud/actions@v1.20.0...v1.21.0

v1.20.0

Compare Source

publish-kustomize-bundle: add a multi-image images input (a list of {path, name, tag}) so a bundle can pin several differently-named images across their overlays in one call. Backward-compatible — the existing single-image image-name / image-overlays inputs are unchanged and used when images is omitted. (#​89)

v1.19.0

Compare Source

Add a build-secrets input to publish-docker.yaml for forwarding BuildKit secrets (RUN --mount=type=secret,id=<name>) to the image build — e.g. authenticated apt/package repositories — without baking them into image layers or history. Passed via the caller's secrets: block. (#​87)

v1.18.0

Compare Source

update-plugin-index is now a composite action

The plugin-catalog updater from v1.17.0 shipped as a reusable workflow, but that form can't actually authenticate cross-repo: a GitHub App token minted in one job and handed to a reusable-workflow job arrives empty, because masked secret values don't survive the job-to-job hop. This release re-delivers it as a composite action so the token is minted and used in the same job.

Same job — same purpose: when a service publishes a release, open a PR against your datumctl plugin catalog that bumps the plugin's manifest to the new version, refreshing every per-platform download URL and checksum straight from the release's checksums.txt. Nothing about a specific plugin is hardcoded, and the manifest's formatting and comments are preserved.

Using it

Mint the catalog token and call the action in the same job:

- name: Mint catalog token
  id: app-token
  uses: actions/create-github-app-token@v2
  with:
    app-id: ${{ secrets.PLUGIN_INDEX_APP_ID }}
    private-key: ${{ secrets.PLUGIN_INDEX_APP_PRIVATE_KEY }}
    owner: your-org
    repositories: your-catalog

- name: Open the catalog PR
  uses: datum-cloud/actions/update-plugin-index@v1.18.0
  with:
    index-repo: your-org/your-catalog
    plugin-name: your-plugin
    version: ${{ github.event.release.tag_name }}
    token: ${{ steps.app-token.outputs.token }}

Migrating from v1.17.0

• Reference the action path datum-cloud/actions/update-plugin-index@v1.18.0, not the .github/workflows/... reusable-workflow path.
• The credential is now the token input (mint it in the same job) instead of the PLUGIN_INDEX_TOKEN secret.
• The generated PR now links back to the source release so reviewers can see what shipped.

The reusable-workflow form from v1.17.0 is superseded and should not be used.

Full Changelog: datum-cloud/actions@v1.17.0...v1.18.0

v1.17.0

Compare Source

Keep plugin catalogs in sync with releases — automatically

Adds the update-plugin-index reusable workflow. When a service publishes a release, it opens a PR against your datumctl plugin catalog that bumps the plugin's manifest to the new version — refreshing every per-platform download URL and checksum straight from the release's checksums.txt. No more hand-editing a catalog manifest after each release.

• Generic across plugins — it derives what to update from the manifest's existing platform list, so nothing about a specific plugin is hardcoded.
• Safe cross-repo — authenticates to the catalog repo with a token you supply, and preserves the manifest's formatting and comments (only version, URLs, and checksums change).
• Drop-in — leaves the rest of your release pipeline untouched; the catalog's own CI still validates the resulting PR.

Using it

uses: datum-cloud/actions/.github/workflows/update-plugin-index.yaml@v1.17.0
with:
  index-repo: your-org/your-catalog
  plugin-name: your-plugin
  version: ${{ github.event.release.tag_name }}
secrets:
  PLUGIN_INDEX_TOKEN: ${{ steps.app-token.outputs.token }}

Introduced in #​84.

Full Changelog: datum-cloud/actions@v1.16.0...v1.17.0

v1.16.0

Compare Source

What's Changed

• chore(deps): update docker/login-action action to v4.2.0 by @​renovate[bot] in #​74
• feat(nix): add nix-update-hash reusable workflow by @​drewr in #​75
• chore(deps): update peter-evans/create-pull-request action to v8 by @​renovate[bot] in #​76
• fix(nix): push hash update directly to triggering branch by @​drewr in #​77
• feat(validate-kustomize): build with LoadRestrictionsNone by default by @​scotwells in #​80

Full Changelog: datum-cloud/actions@v1.15.0...v1.16.0

v1.15.0

Compare Source

What's Changed

• chore(deps): update pnpm/action-setup action to v6 by @​renovate[bot] in #​68
• feat: add reusable generate-doc-toc workflow by @​drewr in #​69
• fix(generate-doc-toc): open PR instead of pushing to main by @​drewr in #​70
• fix(bump-npm-version): land bump commit on main, not detached HEAD by @​kevwilliams in #​72

Full Changelog: datum-cloud/actions@v1.14.0...v1.15.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.