Bump the action-packages group across 1 directory with 4 updates

[dependabot]

Bumps the action-packages group with 4 updates in the / directory: actions/setup-python, actions/upload-artifact, actions/download-artifact and sigstore/gh-action-sigstore-python.

Updates actions/setup-python from 3 to 5

Release notes

Sourced from actions/setup-python's releases.

v5.0.0

What's Changed

In scope of this release, we update node version runtime from node16 to node20 (actions/setup-python#772). Besides, we update dependencies to the latest versions.

Full Changelog: actions/setup-python@v4.8.0...v5.0.0

v4.8.0

What's Changed

In scope of this release we added support for GraalPy (actions/setup-python#694). You can use this snippet to set up GraalPy:

steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v4 
  with:
    python-version: 'graalpy-22.3' 
- run: python my_script.py

Besides, the release contains such changes as:

• Trim python version when reading from file by @​FerranPares in actions/setup-python#628
• Use non-deprecated versions in examples by @​jeffwidman in actions/setup-python#724
• Change deprecation comment to past tense by @​jeffwidman in actions/setup-python#723
• Bump @​babel/traverse from 7.9.0 to 7.23.2 by @​dependabot in actions/setup-python#743
• advanced-usage.md: Encourage the use actions/checkout@v4 by @​cclauss in actions/setup-python#729
• Examples now use checkout@v4 by @​simonw in actions/setup-python#738
• Update actions/checkout to v4 by @​dmitry-shibanov in actions/setup-python#761

New Contributors

• @​FerranPares made their first contribution in actions/setup-python#628
• @​timfel made their first contribution in actions/setup-python#694
• @​jeffwidman made their first contribution in actions/setup-python#724

Full Changelog: actions/setup-python@v4...v4.8.0

v4.7.1

What's Changed

• Bump word-wrap from 1.2.3 to 1.2.4 by @​dependabot in actions/setup-python#702
• Add range validation for toml files by @​dmitry-shibanov in actions/setup-python#726

Full Changelog: actions/setup-python@v4...v4.7.1

v4.7.0

In scope of this release, the support for reading python version from pyproject.toml was added (actions/setup-python#669).

      - name: Setup Python
        uses: actions/setup-python@v4
</tr></table> 

... (truncated)

Commits

• f677139 Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)
• 2bd53f9 Documentation update for caching poetry dependencies (#908)
• 80b49d3 fix: add arch to cache key (#896)
• 036a523 Fix: Add .zip extension to Windows package downloads for Expand-Archive C...
• 04c1311 Fix display of emojis in contributors doc (#899)
• cb68456 Updated @​iarna/toml version to 3.0.0 (#912)
• 39cd149 Documentation update for cache (#873)
• a0d74c0 fix(ci): update all failing workflows (#863)
• 4eb7dbc Bump braces from 3.0.2 to 3.0.3 (#893)
• 82c7e63 Documentation changes for avoiding rate limit issues on GHES (#835)
• Additional commits viewable in compare view

Updates actions/upload-artifact from 3 to 4

Release notes

Sourced from actions/upload-artifact's releases.

v4.0.0

What's Changed

The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.

ℹ️ However, this is a major update that includes breaking changes. Artifacts created with versions v3 and below are not compatible with the v4 actions. Uploads and downloads must use the same major actions versions. There are also key differences from previous versions that may require updates to your workflows.

For more information, please see:

1. The changelog post.
2. The README.
3. The migration documentation.
4. As well as the underlying npm package, @​actions/artifact documentation.

New Contributors

• @​vmjoseph made their first contribution in actions/upload-artifact#464

Full Changelog: actions/upload-artifact@v3...v4.0.0

v3.2.1

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0

• Ensure hidden files input is used by @​joshmgross in actions/upload-artifact#609

Full Changelog: actions/upload-artifact@v3.2.0...v3.2.1

v3.2.1-node20

What's Changed

This fixes the include-hidden-files input introduced in https://github.com/actions/upload-artifact/releases/tag/v3.2.0-node20

• Ensure hidden files input is used by @​joshmgross in actions/upload-artifact#608

Full Changelog: actions/upload-artifact@v3.2.0-node20...v3.2.1-node20

v3.2.0

Notice: Breaking Changes ⚠️

We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.

See "Notice of upcoming deprecations and breaking changes in GitHub Actions runners" changelog and this issue for more details.

What's Changed

• V3 backport: Exclude hidden files by default by @​SrRyan in actions/upload-artifact#604

... (truncated)

Commits

• 5076954 Merge pull request #598 from actions/joshmgross/exclude-hidden-files
• d52396a Add a warning about enabling include-hidden-files
• 710f362 Remove "merged" from include-hidden-files input description
• 3b315f2 npm run release again 🙂
• 3be2180 Remove another trailing comma
• 453e8d0 Update glob license
• 0a398c1 npm run release
• a0c40cf Update to latest @actions/glob and fix tests
• acb59e4 lint
• cb6558b Exclude hidden files by default
• Additional commits viewable in compare view

Updates actions/download-artifact from 4.1.7 to 4.1.8

Release notes

Sourced from actions/download-artifact's releases.

v4.1.8

What's Changed

• Update @​actions/artifact version, bump dependencies by @​robherley in actions/download-artifact#341

Full Changelog: actions/download-artifact@v4...v4.1.8

Commits

• fa0a91b Merge pull request #341 from actions/robherley/bump-pkgs
• b54d088 Update @​actions/artifact version, bump dependencies
• See full diff in compare view

Updates sigstore/gh-action-sigstore-python from 2.1.1 to 3.0.0

Release notes

Sourced from sigstore/gh-action-sigstore-python's releases.

v3.0.0

Added

• inputs now allows recursive globbing with ** (#106)

Removed

• The following settings have been removed: fulcio-url, rekor-url, ctfe, rekor-root-pubkey (#140)
• The following output settings have been removed: signature, certificate, bundle (#146)

Changed

• inputs is now parsed according to POSIX shell lexing rules, improving the action's consistency when used with filenames containing whitespace or other significant characters (#104)

• inputs is now optional if release-signing-artifacts is true and the action's event is a release event. In this case, the action takes no explicit inputs, but signs the source archives already attached to the associated release (#110)

• The default suffix has changed from .sigstore to .sigstore.json, per Sigstore's client specification (#140)

• release-signing-artifacts now defaults to true (#142)

Fixed

• The release-signing-artifacts setting no longer causes a hard error when used under the incorrect event (#103)

• Various deprecations present in sigstore-python's 2.x series have been resolved (#140)

• This workflow now supports CI runners that use PEP 668 to constrain global package prefixes (#145)

... (truncated)

Changelog

Sourced from sigstore/gh-action-sigstore-python's changelog.

[3.0.0]

Added

• inputs now allows recursive globbing with ** (#106)

Removed

• The following settings have been removed: fulcio-url, rekor-url, ctfe, rekor-root-pubkey (#140)
• The following output settings have been removed: signature, certificate, bundle (#146)

Changed

• inputs is now parsed according to POSIX shell lexing rules, improving the action's consistency when used with filenames containing whitespace or other significant characters (#104)

• inputs is now optional if release-signing-artifacts is true and the action's event is a release event. In this case, the action takes no explicit inputs, but signs the source archives already attached to the associated release (#110)

• The default suffix has changed from .sigstore to .sigstore.json, per Sigstore's client specification (#140)

• release-signing-artifacts now defaults to true (#142)

Fixed

• The release-signing-artifacts setting no longer causes a hard error when used under the incorrect event (#103)

• Various deprecations present in sigstore-python's 2.x series have been resolved (#140)

• This workflow now supports CI runners that use PEP 668 to constrain global package prefixes (#145)

... (truncated)

Commits

• f514d46 Prep 3.0.0 (#143)
• da238ad Cleanup workflows (#148)
• 551a497 action: remove old output settings (#146)
• 16fbe9a action: flip release-signing-artifacts (#142)
• 1ddeb82 action: use a venv to prevent PEP 668 errors (#145)
• 9466100 requirements: sigstore ~3.0 (#140)
• 26de745 schedule-selftest: reduce nagging (#134)
• 4dde77f build(deps): bump the actions group with 1 update (#111)
• 08a568c Allow empty inputs with release artifacts (#110)
• 8579d48 build(deps): bump the actions group with 1 update (#107)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[wolearyc]

@dependabot rebase dev-cleanup

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[wolearyc]

@dependabot rebase

[dependabot]

The base commit for this pull request has not changed.