Bump ministryofjustice/hmpps-github-actions from 1.0.4 to 2.0.0

[dependabot]

Bumps ministryofjustice/hmpps-github-actions from 1.0.4 to 2.0.0.

Release notes

Sourced from ministryofjustice/hmpps-github-actions's releases.

v2.0.0

What's Changed

• Update name of the security_trivy job by @​smcveigh941 in ministryofjustice/hmpps-github-actions#40
• Node version for node related tasks now derive versions based on a version file. This defaults to .nvmrc

Note

There is a non-backwards compatible change included in this release which is the removal of the ability to specify a given node version using the node_version option.

Full Changelog: ministryofjustice/hmpps-github-actions@v1...v2.0.0

node_build update to (hopefully) limit old cache being reused

No release notes provided.

FIX: take account of multimode projects when running Trivy scans

Raised in https://dsdmoj.atlassian.net/browse/HEAT-455

This fix includes yaml files in subfolders, with an extra bit of logic identifying the subproject if there is one.

Add modifier to Trivy scans to use both ghcr.io as well as quay.io package repos

Extra line added to the Trivy scan workflow to send a custom package repo location.

Changelog

Sourced from ministryofjustice/hmpps-github-actions's changelog.

0.1

First release

0.2

Finessing of workflows - better Sarif file for typescript reports

If no Slack channel is included, no messages will be sent.

v0.3

Semantic versioning

This also uses inherited secrets in the template workflows to avoid having to add the local secrets to each one.

v0.7

Inline python scripts to avoid having to run them locally (benefit: keeps any fixes/improvements inside the shared actions)

v0.7.1

Change to .github/workflows/security_veracode_policy_scan.yml. Updated scan identifier string so it now includes the github action ID, github branch, github commit sha. This makes it easier to link the veracode scan results with a commit in the dev portal.

v1

Initial release

v2.0.0

Node version for node related tasks now derive versions based on a version file. This defaults to .nvmrc.

There is a non-backwards compatible change included in this release which is the removal of the ability to specify a given node version using the node_version option.

Commits

• ca5e866 Update missing references and add release notes (#42)
• b2be4d7 Derive node version from nvmrc (#41)
• 0136433 Update name of the security_trivy job (#40)
• e2737d6 Update node_build.yml (#34)
• 3d1ece5 HEAT-455 Fix trivy scan for multimode projects (#38)
• 5dd128f Allowing script to be run remotely (#39)
• 2017141 HEAT-455 - fix for trivy scans on a ghcr.io repository (#37)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)