chore(deps): bump actions/setup-python from 5.0.0 to 5.3.0

[dependabot]

Bumps actions/setup-python from 5.0.0 to 5.3.0.

Release notes

Sourced from actions/setup-python's releases.

v5.3.0

What's Changed

• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/setup-python#941
• Upgrade IA publish by @​Jcambass in actions/setup-python#943

Bug Fixes:

• Normalise Line Endings to Ensure Cross-Platform Consistency by @​priya-kinthali in actions/setup-python#938
• Revise isGhes logic by @​jww3 in actions/setup-python#963
• Bump pillow from 7.2 to 10.2.0 by @​aparnajyothi-y in actions/setup-python#956

Enhancements:

• Enhance workflows and documentation updates by @​priya-kinthali in actions/setup-python#965
• Bump default versions to latest by @​jeffwidman in actions/setup-python#905

New Contributors

• @​Jcambass made their first contribution in actions/setup-python#941
• @​jww3 made their first contribution in actions/setup-python#963

Full Changelog: actions/setup-python@v5...v5.3.0

v5.2.0

What's Changed

Bug fixes:

• Add .zip extension to Windows package downloads for Expand-Archive Compatibility by @​priyagupta108 in actions/setup-python#916 This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly.
• Add arch to cache key by @​Zxilly in actions/setup-python#896 This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts. Note: This change may break previous cache keys as they will no longer be compatible with the new format.

Documentation changes:

• Fix display of emojis in contributors doc by @​sciencewhiz in actions/setup-python#899
• Documentation update for caching poetry dependencies by @​gowridurgad in actions/setup-python#908

Dependency updates:

• Bump @​iarna/toml version from 2.2.5 to 3.0.0 by @​priya-kinthali in actions/setup-python#912
• Bump pyinstaller from 3.6 to 5.13.1 by @​aparnajyothi-y in actions/setup-python#923

New Contributors

• @​sciencewhiz made their first contribution in actions/setup-python#899
• @​priyagupta108 made their first contribution in actions/setup-python#916
• @​Zxilly made their first contribution in actions/setup-python#896
• @​aparnajyothi-y made their first contribution in actions/setup-python#923

Full Changelog: actions/setup-python@v5...v5.2.0

v5.1.1

What's Changed

Bug fixes:

• fix(ci): update all failing workflows by @​mayeut in actions/setup-python#863 This update ensures compatibility and optimal performance of workflows on the latest macOS version.

Documentation changes:

• Documentation update for cache by @​gowridurgad in actions/setup-python#873

Dependency updates:

• Bump braces from 3.0.2 to 3.0.3 and undici from 5.28.3 to 5.28.4 by @​dependabot in actions/setup-python#893

... (truncated)

Commits

• 0b93645 Enhance workflows: Add macOS 13 support, upgrade publish-action, and update d...
• 9c76e71 Bump pillow from 7.2 to 10.2.0 in /tests/data (#956)
• f4c5a11 Revise isGhes logic (#963)
• 19dfb7b Bump default versions to latest (#905)
• e9675cc Merge pull request #943 from actions/Jcambass-patch-1
• 3226af6 Upgrade IA publish
• 70dcb22 Merge pull request #941 from actions/Jcambass-patch-1
• 65b48c7 Create publish-immutable-actions.yml
• 29a37be initial commit (#938)
• f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided code changes focus on improving the security and reliability of the Janssen Project's build, deployment, and testing processes, including secure token and key management, dependency management, cryptographic signing, runner hardening, and comprehensive testing.

Expand for full summary

Summary:

The provided code changes cover several GitHub Actions workflows for the Janssen Project, an open-source identity and access management (IAM) platform. The changes focus on improving the security and reliability of the project's build, deployment, and testing processes.

Key security-related aspects of the changes include:

1. Secure Token and Key Management: The workflows use GitHub Secrets to store and manage sensitive information, such as authentication tokens and GPG keys, to ensure they are not exposed in the workflow files.
2. Dependency Management: The workflows update the versions of the GitHub Actions used, such as actions/setup-python, to keep dependencies up-to-date and address potential security vulnerabilities.
3. Cryptographic Signing: The workflows import and use GPG keys to sign Git commits and Docker images, ensuring the integrity of the code and artifacts.
4. Runner Hardening: The workflows use the step-security/harden-runner action to improve the security of the GitHub Actions runner environment, reducing the attack surface.
5. Comprehensive Testing: The workflows include thorough testing of the Janssen Project's components, such as the Linux installer and the Terraform provider, to catch potential security and functional issues.

Overall, the code changes demonstrate a strong focus on security best practices, including secure handling of sensitive information, dependency management, cryptographic signing, and comprehensive testing. These improvements help ensure the ongoing security and reliability of the Janssen Project.

Files Changed:

1. .github/workflows/build-docs.yml: This workflow is responsible for building and deploying the Janssen Project's documentation. It includes several security-conscious practices, such as using a secret token, importing a GPG key, and hardening the runner environment.
2. .github/workflows/docs.yml: This workflow handles the documentation-related changes, including automatic merging of pull requests that only modify files in the docs/ directory, commit message checks, and Markdown linting.
3. .github/workflows/build-packages.yml: This workflow builds and publishes packages for the Janssen Project, including Debian, RPM, and Python packages. It incorporates security measures such as package signing and checksumming.
4. .github/workflows/docker_build_image.yml: This workflow handles the build and publication of Docker images for the Janssen Project, with features like image signing using cosign.
5. .github/workflows/flake8-lint.yml: This workflow runs the Flake8 linter on the Python code, which helps maintain code quality and catch potential issues.
6. .github/workflows/test_cedarling.yml: This workflow runs tests for the "Cedarling Testcases" project, with a minor update to the Python version used.
7. .github/workflows/sync.yml: This workflow synchronizes changes between the "jans" repository and the "terraform-provider-jans" repository, using secure Git operations and sensitive information handling.
8. .github/workflows/label_pr_issues.yml: This workflow automatically labels pull requests and issues in the "JanssenProject/jans" repository, with a focus on maintaining the workflow and keeping dependencies up-to-date.
9. .github/workflows/testcases.yml: This workflow runs test cases for the jans-pycloudlib project, with a routine update to the actions/setup-python GitHub Action.
10. .github/workflows/test_docker_linux_installer.yml: This workflow tests the Linux installer for the Janssen Project, incorporating security practices such as runner hardening and GPG key management.

Code Analysis

We ran 9 analyzers against 10 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[moabu]

@dependabot recreate