Bump crazy-max/ghaction-import-gpg from 6 to 7 by dependabot[bot] · Pull Request #270 · senzing-factory/build-resources

dependabot · 2026-03-02T19:44:16Z

Bumps crazy-max/ghaction-import-gpg from 6 to 7.

Release notes

Sourced from crazy-max/ghaction-import-gpg's releases.

v7.0.0

Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @crazy-max in crazy-max/ghaction-import-gpg#241

Switch to ESM and update config/test wiring by @crazy-max in crazy-max/ghaction-import-gpg#239

Bump @actions/core from 1.11.1 to 3.0.0 in crazy-max/ghaction-import-gpg#232

Bump @actions/exec from 1.1.1 to 3.0.0 in crazy-max/ghaction-import-gpg#242

Bump brace-expansion from 1.1.11 to 1.1.12 in crazy-max/ghaction-import-gpg#221

Bump minimatch from 3.1.2 to 3.1.5 in crazy-max/ghaction-import-gpg#240

Bump openpgp from 6.1.0 to 6.3.0 in crazy-max/ghaction-import-gpg#233

Full Changelog: crazy-max/ghaction-import-gpg@v6.3.0...v7.0.0

v6.3.0

Bump openpgp from 5.11.2 to 6.1.0 in crazy-max/ghaction-import-gpg#215

Bump cross-spawn from 7.0.3 to 7.0.6 in crazy-max/ghaction-import-gpg#212

Full Changelog: crazy-max/ghaction-import-gpg@v6.2.0...v6.3.0

v6.2.0

Bump @actions/core from 1.10.1 to 1.11.1 in crazy-max/ghaction-import-gpg#209

Bump braces from 3.0.2 to 3.0.3 in crazy-max/ghaction-import-gpg#203

Bump ip from 2.0.0 to 2.0.1 in crazy-max/ghaction-import-gpg#196

Bump micromatch from 4.0.4 to 4.0.8 in crazy-max/ghaction-import-gpg#207

Bump openpgp from 5.11.0 to 5.11.2 in crazy-max/ghaction-import-gpg#205

Bump tar from 6.1.14 to 6.2.1 in crazy-max/ghaction-import-gpg#198

Full Changelog: crazy-max/ghaction-import-gpg@v6.1.0...v6.2.0

v6.1.0

Bump @actions/core from 1.10.0 to 1.10.1 in crazy-max/ghaction-import-gpg#186

Bump @babel/traverse from 7.17.3 to 7.23.2 in crazy-max/ghaction-import-gpg#191

Bump debug from 4.1.1 to 4.3.4 in crazy-max/ghaction-import-gpg#190

Bump openpgp from 5.10.1 to 5.11.0 in crazy-max/ghaction-import-gpg#192

Full Changelog: crazy-max/ghaction-import-gpg@v6.0.0...v6.1.0

Commits

2dc316d Merge pull request #242 from crazy-max/dependabot/npm_and_yarn/actions/exec-3...
5812792 chore: update generated content
ceb906e build(deps): bump @actions/exec from 1.1.1 to 3.0.0
a9dffd9 Merge pull request #241 from crazy-max/node24
36d49fc node 24 as default runtime
50c4e4f Merge pull request #233 from crazy-max/dependabot/npm_and_yarn/openpgp-6.3.0
c78fe49 chore: update generated content
8dbbb1e Merge pull request #221 from crazy-max/dependabot/npm_and_yarn/brace-expansio...
fc715b0 build(deps): bump openpgp from 6.1.0 to 6.3.0
9946916 build(deps): bump brace-expansion from 1.1.11 to 1.1.12
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 6 to 7. - [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases) - [Commits](crazy-max/ghaction-import-gpg@v6...v7) --- updated-dependencies: - dependency-name: crazy-max/ghaction-import-gpg dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-02T19:45:08Z

🤖 Claude Code Review

PR Code Review

Summary: This PR bumps crazy-max/ghaction-import-gpg from v6 to v7 in .github/workflows/make-go-github-file.yaml.

Code Quality

✅ Style guide: Single-line change is clean and consistent with the existing workflow format.
✅ No commented-out code: N/A.
✅ Meaningful variable names: N/A.
✅ DRY principle: N/A.
✅ Defects/bugs: No logic errors introduced. Dependency bump only. The v7 tag of crazy-max/ghaction-import-gpg is a valid release. The existing inputs (git_commit_gpgsign, git_user_signingkey, gpg_private_key, passphrase) remain unchanged — these are all still valid in v7 with no breaking changes to these parameters.
✅ CLAUDE.md: No issues with project config.

Testing

✅ No new functions or endpoints introduced — standard dependency bump, no unit/integration tests required.

Documentation

✅ README: No change required.
✅ API docs: N/A.
✅ Inline comments: N/A.
❌ CHANGELOG.md: The CHANGELOG has not been updated to reflect this dependency bump. The [Unreleased] section should include an entry for this change (e.g., under ### Changed or ### Security). Note: the current CHANGELOG also contains placeholder entries (Thing 4, Thing 5, placeholder dates yyyy-mm-dd) that appear to be template remnants rather than real entries — this should be addressed.

Security

✅ No hardcoded credentials: GPG key and passphrase are correctly passed via secrets (${{ secrets.GPG_PRIVATE_KEY }}, ${{ secrets.GPG_PASSPHRASE }}).
✅ Input validation: N/A.
✅ Error handling: N/A.
✅ No sensitive data in logs: N/A.
✅ No license files (.lic) or AQAAAD strings: None found.

Summary

Category	Status
Code Quality	✅ Pass
Testing	✅ Pass
Documentation	❌ CHANGELOG not updated
Security	✅ Pass

One issue to address:

CHANGELOG.md (CHANGELOG.md) — The [Unreleased] section should include an entry for this dependency bump (e.g., - Bump crazy-max/ghaction-import-gpg from 6 to 7). Also, the placeholder entries (Thing 4, Thing 5) and template dates (yyyy-mm-dd) in the CHANGELOG appear to be leftover from a template and should be replaced with real content.

Automated code review analyzing defects and coding standards

github-actions · 2026-03-02T19:46:17Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

…-import-gpg-7

github-actions · 2026-03-12T22:38:26Z

🤖 Claude Code Review

PR Code Review

Code Quality

✅ Style guide: Single-line change updating a GitHub Actions dependency version — no style concerns.
✅ No commented-out code
✅ Meaningful variable names: N/A
✅ DRY principle: N/A
✅ Defects: No bugs or logic errors. The version bump from v6 to v7 of crazy-max/ghaction-import-gpg is straightforward. The existing with: parameters (git_commit_gpgsign, git_user_signingkey) are compatible with v7.
✅ Project memory (CLAUDE.md): No concerns.

Testing

✅ N/A — dependency version bump in a workflow file; no unit/integration tests applicable.

Documentation

❌ CHANGELOG.md: No changelog entry included for this dependency bump. Per project standards, CHANGELOG.md should be updated for all changes.
✅ README/API docs: No updates needed.
✅ Markdown formatting: N/A

Security

✅ No hardcoded credentials
✅ No sensitive data
✅ No .lic files or AQAAAD strings
⚠️ Pinning: The action is referenced by a mutable tag (@v7) rather than an immutable commit SHA. For supply chain security, pinning to a specific SHA (e.g., crazy-max/ghaction-import-gpg@abc1234) is preferred. This is a pre-existing pattern in the file, not introduced by this PR, but worth noting.

Summary

The change is minimal and correct — a straightforward major version bump for a GitHub Actions dependency. The only actionable issue is:

CHANGELOG.md should be updated to record this dependency bump. ❌

Automated code review analyzing defects and coding standards

github-actions · 2026-03-12T22:39:45Z

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 2, 2026

dependabot bot requested a review from a team as a code owner March 2, 2026 19:44

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 2, 2026

docktermj approved these changes Mar 2, 2026

View reviewed changes

docktermj assigned kernelsam Mar 2, 2026

Merge branch 'main' into dependabot/github_actions/crazy-max/ghaction…

067387a

…-import-gpg-7

kernelsam enabled auto-merge (squash) March 12, 2026 22:37

kernelsam merged commit ab77909 into main Mar 12, 2026
22 checks passed

kernelsam deleted the dependabot/github_actions/crazy-max/ghaction-import-gpg-7 branch March 12, 2026 22:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump crazy-max/ghaction-import-gpg from 6 to 7#270

Bump crazy-max/ghaction-import-gpg from 6 to 7#270
kernelsam merged 2 commits intomainfrom
dependabot/github_actions/crazy-max/ghaction-import-gpg-7

dependabot bot commented on behalf of github Mar 2, 2026 •

edited by github-actions bot

Loading

Uh oh!

github-actions bot commented Mar 2, 2026

Uh oh!

github-actions bot commented Mar 2, 2026

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

github-actions bot commented Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot bot commented on behalf of github Mar 2, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

v6.3.0

v6.2.0

v6.1.0

Uh oh!

github-actions bot commented Mar 2, 2026

🤖 Claude Code Review

PR Code Review

Code Quality

Testing

Documentation

Security

Summary

Uh oh!

github-actions bot commented Mar 2, 2026

Super-linter summary

Uh oh!

github-actions bot commented Mar 12, 2026

🤖 Claude Code Review

PR Code Review

Code Quality

Testing

Documentation

Security

Summary

Uh oh!

github-actions bot commented Mar 12, 2026

Super-linter summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Mar 2, 2026 •

edited by github-actions bot

Loading