chore(deps): all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
crate-ci/typos	action	minor	v1.19.0 -> v1.21.0
docker/login-action	action	minor	v3.1.0 -> v3.2.0
docker/setup-buildx-action	action	minor	v3.2.0 -> v3.3.0
rhysd/actionlint		minor	1.6.27 -> 1.7.1

---

Release Notes

crate-ci/typos (crate-ci/typos)

v1.21.0

Compare Source

[1.21.0] - 2024-04-30

Fixes

• Updated the dictionary with the April 2024 changes

v1.20.10

Compare Source

[1.20.10] - 2024-04-23

Fixes

• Don't correct doas, the OpenBSD command

v1.20.9

Compare Source

[1.20.9] - 2024-04-16

Fixes

• Don't correct the unit dBA (as an identifier to limit to that case)

v1.20.8

Compare Source

[1.20.8] - 2024-04-12

Fixes

• Don't correct kms
• Don't correct inout

v1.20.7

Compare Source

[1.20.7] - 2024-04-09

Fixes

• Treat .pyi files as Python

v1.20.6

Compare Source

[1.20.6] - 2024-04-09

Fixes

• Don't correct automations

v1.20.5

Compare Source

[1.20.5] - 2024-04-09

Fixes

• Don't correct hd

v1.20.4

Compare Source

[1.20.4] - 2024-04-04

Fixes

• Don't correct ans

v1.20.3

Compare Source

[1.20.3] - 2024-04-02

• Don't correct arange in Python
• Don't correct EOFError in Python

v1.20.2

Compare Source

[1.20.2] - 2024-04-02

Fixes

• Don't correct ang ('angle' abbreviation)
• Don't correct dur ('duration' abbreviation)
• Don't correct lst (used in place of 'list' when its a built-in)
• Don't correct GUID acronym
• Don't correct IIS acronym
• Don't correct IME acronym
• Don't correct IOT acronym
• Don't correct ro acronym
• Don't correct ws abbreviation
• Don't correct JST timezone
• Also correct donw to done

v1.20.1

Compare Source

[1.20.1] - 2024-04-01

Fixes

• Don't correct og (OpenGraph's namespace), a regression from 1.20.0

Fixes

• Don't correct eof, a regression from 1.20.0

v1.20.0

Compare Source

[1.20.0] - 2024-04-01

Fixes

• Updated the dictionary with the March 2024 changes
• Pull in typos from another source
• Don't correct spile

docker/login-action (docker/login-action)

v3.2.0

Compare Source

• Improve missing username/password by @​Frankkkkk in https://github.com/docker/login-action/pull/706
• Bump @​docker/actions-toolkit from 0.18.0 to 0.24.0 in https://github.com/docker/login-action/pull/715 https://github.com/docker/login-action/pull/721
• Bump aws-sdk-dependencies to 3.583.0 in https://github.com/docker/login-action/pull/720
• Bump undici from 5.28.3 to 5.28.4 in https://github.com/docker/login-action/pull/694

Full Changelog: docker/login-action@v3.1.0...v3.2.0

docker/setup-buildx-action (docker/setup-buildx-action)

v3.3.0

Compare Source

rhysd/actionlint (rhysd/actionlint)

v1.7.1

Compare Source

v1.7.0

Compare Source

• From this version, actionlint starts to check action metadata file action.yml (or action.yaml). At this point, only very basic checks are implemented and contents of steps: are not checked yet.
  • It checks properties under runs: section (e.g. main: can be specified when it is a JavaScript action), branding: properties, and so on.

    name: 'My action'
    author: '...'

ERROR: 'description' section is missing

branding:

ERROR: Invalid icon name

  icon: dog

runs:

ERROR: Node.js runtime version is too old

  using: 'node12'

ERROR: The source file being run by this action does not exist

  main: 'this-file-does-not-exist.js'

ERROR: 'env' configuration is only allowed for Docker actions

  env:
    SOME_VAR: SOME_VALUE
```

• actionlint still focuses on checking workflow files. So there is no way to directly specify action.yml as an argument of actionlint command. actionlint checks all local actions which are used by given workflows. If you want to use actionlint for your action development, prepare a test/example workflow which uses your action, and check it with actionlint instead.
• Checks for steps: contents are planned to be implemented. Since several differences are expected between steps: in workflow file and steps: in action metadata file (e.g. available contexts), the implementation is delayed to later version. And the current implementation of action metadata parser is ad hoc. I'm planning a large refactorying and breaking changes Go API around it are expected.
• Add runner.environment property. (#​412)

  - run: echo 'Run by GitHub-hosted runner'
    if: runner.environment == 'github-hosted'

• Using outdated popular actions is now detected at error. See the document for more details.
  • Here 'outdated' means actions which use runtimes no longer supported by GitHub-hosted runners such as node12.

ERROR: actions/checkout@v2 is using the outdated runner 'node12'

- uses: actions/checkout@v2
```

• Support attestations permission which was recently added to GitHub Actions as beta. (#​418, thanks @​bdehamer)

  permissions:
    id-token: write
    contents: read
    attestations: write

• Check comparison expressions more strictly. Arbitrary types of operands can be compared as the official document explains. However, comparisons between some types are actually meaningless because the values are converted to numbers implicitly. actionlint catches such meaningless comparisons as errors. Please see the check document for more details.

  on:
    workflow_call:
      inputs:
        timeout:
          type: boolean
  
  jobs:
    test:
      runs-on: ubuntu-latest
      steps:
        - run: echo 'called!'

ERROR: Comparing string to object is always evaluated to false

      if: ${{ github.event == 'workflow_call' }}
    - run: echo 'timeout is too long'

ERROR: Comparing boolean value with > doesn't make sense

      if: ${{ inputs.timeout > 60 }}

- Follow the update that `macos-latest` is now an alias to `macos-14` runner.
- Support a custom python shell by `pyflakes` rule.
- Add workaround actionlint reports that `dorny/paths-filter`'s `predicate-quantifier` input is not defined. ([#​416](https://togithub.com/rhysd/actionlint/issues/416))
- Fix the type of a conditional expression by comparison operators is wider than expected by implementing type narrowing. ([#​384](https://togithub.com/rhysd/actionlint/issues/384))
- For example, the type of following expression should be `number` but it was actually `string | number` and actionlint complained that `timeout-minutes` must take a number value.
  ```yaml
  timeout-minutes: ${{ env.FOO && 10 || 60 }}
  ```
- Fix `${{ }}` placeholder is not available at `jobs.<job_id>.services`. ([#&#8203;402](https://togithub.com/rhysd/actionlint/issues/402))
```yaml
jobs:
  test:
    services: ${{ fromJSON('...') }}
    runs-on: ubuntu-latest
    steps:
      - run: ...

• Do not check outputs of google-github-actions/get-secretmanager-secrets because this action sets outputs dynamically. (#​404)
• Fix defaults.run is ignored on detecting the shell used in run:. (#​409)

  defaults:
    run:
      shell: pwsh
  jobs:
    test:
      runs-on: ubuntu-latest
      steps:

This was wrongly detected as bash script

    - run: $Env:FOO = "FOO"

- Fix parsing a syntax error reported from pyflakes when checking a Python script in `run:`. ([#​411](https://togithub.com/rhysd/actionlint/issues/411))
```yaml
- run: print(
  shell: python

• Skip checking exclude: items in matrix: when they are constructed from ${{ }} dynamically. (#​414)

  matrix:
    foo: ['a', 'b']
    exclude:

actionlint complained this value didn't exist in matrix combinations

  - foo: ${{ env.EXCLUDE_FOO }}

- Fix checking `exclude:` items when `${{ }}` is used in items of nested arrays.
```yaml
matrix:
  foo:
    - ["${{ fromJSON('...') }}"]
  exclude:
### actionlint complained this value didn't match to any matrix combinations
    - foo: ['foo']

• Update popular actions data set. New major versions are added and the following actions are newly added.
  • peaceiris/actions-hugo
  • actions/attest-build-provenance
  • actions/add-to-project
  • octokit/graphql-action
• Update Go dependencies to the latest.
• Reduce the size of actionlint executable by removing redundant data from popular actions data set.
  • x86_64 executable binary size was reduced from 6.9MB to 6.7MB (2.9% smaller).
  • Wasm binary size was reduced from 9.4MB to 8.9MB (5.3% smaller).
• Describe how to integrate actionlint to Pulsar Edit in the document. (#​408, thanks @​mschuchard)
• Update outdated action versions in the usage document. (#​413, thanks @​naglis)

[Changes][v1.7.0]

---

• If you want to rebase/retry this PR, check this box