[dependabot]

Bumps the actions-minor-and-patch group with 3 updates in the / directory: jdx/mise-action, getplumber/plumber and ossf/scorecard-action.

Updates jdx/mise-action from 5.1.1 to 5.1.2

Release notes

Sourced from jdx/mise-action's releases.

v5.1.2: mise_dir now sets MISE_DATA_DIR; auto_update handles a locked mise binary

The mise_dir input now also sets where mise installs tools, so those tools end up in the cache. With auto_update: true, the action no longer crashes on Windows when the mise binary is still in use.

Fixed

• mise_dir now exports MISE_DATA_DIR. Before this release, mise_dir moved the mise binary and the cache path, but mise kept installing tools to ~/.local/share/mise. The saved cache didn't include the tools. On runners where ~/.local isn't writable, the step failed with EACCES: permission denied. When mise_dir is set, the action now exports MISE_DATA_DIR=<mise_dir>, so tools are installed into the directory that gets cached. If your workflow sets a different MISE_DATA_DIR, the mise_dir input overrides it. If mise_dir isn't set, nothing changes. mise's state directory (~/.local/state/mise) stays where it is. If that path also can't be written, set MISE_STATE_DIR yourself. (#672 by @​jdx, fixes #668)

  - uses: jdx/mise-action@v5
    with:
      mise_dir: ${{ runner.tool_cache }}/mise/data

• auto_update no longer crashes when it can't replace mise.exe. On Windows, the step used to fail with a bare EPERM: operation not permitted, unlink '…\mise.exe' if another process was still using the binary. Now, if version isn't pinned and the existing binary passes verification against its recorded version, the action prints a warning and continues with that version. In any other case, the step fails with a message that says the file is in use and how to fix it. A pinned version never quietly keeps an older binary. (#665 by @​jdx, fixes #664)

Documentation

• The README explains how to use mise's MISE_ENABLE_TOOLS setting as a job-level allowlist. Unlike install_args, the allowlist applies to the action's install and to later mise commands. If jobs use different allowlists, add the value to a custom cache_key. (#667 by @​zeitlinger)
• The Rust cache section is updated for mise 2026.9.2 and later, where mise install repairs a restored toolchain instead of leaving rustfmt missing. Swatinem/rust-cache now works alongside mise-managed Rust. (#670 by @​jdx)

Full Changelog: jdx/mise-action@v5.1.1...v5.1.2

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

---

5.2.1 - 2026-10-16

🐛 Bug Fixes

• require the signed packslip for mise 2026.9.3 and later (#695) by @​jdx in #695

---

5.2.0 - 2026-10-16

🚀 Features

• (cache) rebuild the cache every 30 days by default (#689) by @​jdx in #689
• (cache) retry throttled cache restores and saves (#692) by @​jdx in #692
• verify the mise binary against its signed packslip (#693) by @​jdx in #693

🐛 Bug Fixes

• export the PATH entries mise reports with mise env --paths (#685) by @​jdx in #685

🔍 Other Changes

• Use monorepo install when configured (#679) by @​zeitlinger in #679
• Change minimum age for auto-merging release PRs by @​jdx in b511e8d

📚 Documentation

• tell release workflows not to use the cache (#682) by @​jdx in #682
• explain caching mise downloads instead of installs (#686) by @​zeitlinger in #686
• use resolved Windows downloads cache path (#690) by @​zeitlinger in #690

⚙️ Miscellaneous Tasks

• stop restoring caches in release jobs (#683) by @​jdx in #683
• replace prettier with oxfmt (#694) by @​jdx in #694

---

5.1.2 - 2026-10-12

🐛 Bug Fixes

• continue with the existing mise when auto-update cannot replace it (#665) by @​jdx in #665
• export mise_dir as MISE_DATA_DIR so mise installs tools there (#672) by @​jdx in #672

📚 Documentation

• explain MISE_ENABLE_TOOLS in GitHub Actions (#667) by @​zeitlinger in #667
• update the Rust cache section for mise 2026.9.2 (#670) by @​jdx in #670

... (truncated)

Commits

• 08ae2a0 chore: release v5.1.2 (#660)
• 4c1c6f9 chore(ci): switch to jactionlint v2 and drop zizmor (#674)
• 58185d8 chore(ci): lint workflows with jactionlint (#673)
• 0e078e4 fix: export mise_dir as MISE_DATA_DIR so mise installs tools there (#672)
• 64b792f docs: update the Rust cache section for mise 2026.9.2 (#670)
• d7c6373 ci: fix the upload-artifact version comment (#671)
• 3df3d8b docs: explain MISE_ENABLE_TOOLS in GitHub Actions (#667)
• 1ea734b chore(deps): update jdx/renovate-config action to v1.0.2 (#666)
• 6a90a24 fix: continue with the existing mise when auto-update cannot replace it (#665)
• b3d6388 chore(deps): update github/codeql-action action to v4.38.2 (#662)
• Additional commits viewable in compare view

Updates getplumber/plumber from 0.6.0 to 0.6.1

Release notes

Sourced from getplumber/plumber's releases.

v0.6.1

0.6.1 (2026-10-12)

✨ Features

• conf: trust Plumber's own GitLab component by default (b400431)
• controls: components and functions must come from authorized sources (b2bb03a)
• gitlab: collect run: step functions and the registry host in the IR (59c9ddd)
• score: component and function sources in the contextual score (44c5d28)

🐛 Bug Fixes

• build: move to the Go 1.26.9 toolchain (6449f05)

Changelog

Sourced from getplumber/plumber's changelog.

0.7.6 (2026-10-19)

🐛 Bug Fixes

• github: read a local action's entrypoint within the repository (018074a)
• github: resolve only well-formed action references (b06e171)
• gitlab: bound variable and local-include expansion (13a6f97)

0.7.5 (2026-10-19)

✨ Features

• capability: the declarations from the context or .plumber.yaml, and the defaults command (6686e3f)
• capability: the first recognizer and the five evidence rules (31b1782)
• capability: user-declared capabilities, the built-in list and the glob matcher (024cce3)
• ir: a job carries the keys of its artifacts.reports and the include that defined it (8482d15)
• pbom: the bill carries the recognized capabilities from the push and the --pbom artifact (5541574)

0.7.4 (2026-10-18)

🔧 Chores

• deps: bump the go-dependencies group across 1 directory with 6 updates (d8b6b08)

0.7.3 (2026-10-18)

🔧 Chores

• ci: bump the github-actions group across 1 directory with 14 updates (c5b9cf0)

0.7.2 (2026-10-17)

✨ Features

• github: resolve composite actions and cross-repository reusable workflows into the pipeline with their provenance (1ba603c)

🐛 Bug Fixes

• control,identity: nested findings carry their chain, remediation and identity, the bill names nested includes (35459d5), closes #533

✅ Tests

• github,cmd: goldens from the nested-actions reproduction, docs and the e2e recipe (620b4de), closes d/action.yml#L8

... (truncated)

Commits

• 4804289 chore(release): 0.6.1 [skip ci]
• 6449f05 fix(build): move to the Go 1.26.9 toolchain
• b400431 feat(conf): trust Plumber's own GitLab component by default
• 44c5d28 feat(score): component and function sources in the contextual score
• b2bb03a feat(controls): components and functions must come from authorized sources
• 59c9ddd feat(gitlab): collect run: step functions and the registry host in the IR
• See full diff in compare view

Updates ossf/scorecard-action from 2.4.4 to 2.5.0

Release notes

Sourced from ossf/scorecard-action's releases.

v2.5.0

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @​justaugustus in ossf/scorecard-action#1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in ossf/scorecard-action#1716
• The Scorecard version in results now always matches the Scorecard release the action is built with. by @​justaugustus in ossf/scorecard-action#1718
• The action no longer prints the GitHub token variable while validating its options. by @​arpitjain099 in ossf/scorecard-action#1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation statement. by @​puerco in ossf/scorecard-action#1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in ossf/scorecard-action#1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in ossf/scorecard-action#1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update RELEASE.md by @​justaugustus in ossf/scorecard-action#1716
• Bump Scorecard to v5.6.0 by @​justaugustus in ossf/scorecard-action#1719

New Contributors

• @​arpitjain099 made their first contribution in ossf/scorecard-action#1709
• @​puerco made their first contribution in ossf/scorecard-action#1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

Commits

• fa7117d Bump action tag for v2.5.0 release (#1720)
• cef4eb5 🌱 Bump Scorecard to v5.6.0 (#1719)
• bedb16e ✨ Add intoto results format (#1702)
• de70347 Remove the leftover debug print of the auth token (#1709)
• 950873d 🌱 Derive the reported Scorecard version from go.mod (#1718)
• 2ce8ee4 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 (#1695)
• aabdf5a 🌱 Bump the github-actions group across 1 directory with 7 updates (#...
• b4b9adf 🌱 CodeQL: Analyze workflows instead of a placeholder JavaScript file
• 4e9f2a2 📖 RELEASE.md: Document drafting release notes
• f618e8b 🌱 Build the image with Go 1.27.2 and refresh distroless
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.