Repository: kubernetes-sigs/security-profiles-operator
Pull request #2104 (2024-02-01 23:52:52)

build(deps): bump codecov/codecov-action from 4.0.0 to 4.0.1
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4.0.0 to 4.0.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p>
<blockquote>
<h2>v4.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1243">codecov/codecov-action#1243</a></li>
<li>Add all args by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1245">codecov/codecov-action#1245</a></li>
<li>fix: show both token uses in readme by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1250">codecov/codecov-action#1250</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v4.0.0...v4.0.1">https://github.com/codecov/codecov-action/compare/v4.0.0...v4.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/codecov/codecov-action/commit/e0b68c6749509c5f83f984dd99a76a1c1a231044"><code>e0b68c6</code></a> fix: show both token uses in readme (<a href="https://redirect.github.com/codecov/codecov-action/issues/1250">#1250</a>)</li>
<li><a href="https://github.com/codecov/codecov-action/commit/1f9f5573d12d0967fe14551018a4b25610226551"><code>1f9f557</code></a> Add all args (<a href="https://redirect.github.com/codecov/codecov-action/issues/1245">#1245</a>)</li>
<li><a href="https://github.com/codecov/codecov-action/commit/09686fcfcb6453414a5acd7f3a939670a7a77826"><code>09686fc</code></a> Update README.md (<a href="https://redirect.github.com/codecov/codecov-action/issues/1243">#1243</a>)</li>
<li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/f30e4959ba63075080d4f7f90cacc18d9f3fafd7...e0b68c6749509c5f83f984dd99a76a1c1a231044">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=codecov/codecov-action&package-manager=github_actions&previous-version=4.0.0&new-version=4.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

k8s-ci-robot: Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2104#" title="Author self-approved">dependabot[bot]</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign [ccojocar](https://github.com/ccojocar) for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["ccojocar"]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2104#pullrequestreview-1858965304" title="Approved">ccojocar</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/2104#" title="Author self-approved">dependabot[bot]</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [ccojocar]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/dependencies.yaml b/dependencies.yaml
index fbb66da57..15854a708 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -164,7 +164,7 @@ dependencies:
       match: baseProfileNameCrun
 
   - name: runc
-    version: v1.1.11
+    version: v1.1.12
     refPaths:
     - path: examples/baseprofile-runc.yaml
       match: name
diff --git a/examples/baseprofile-runc.yaml b/examples/baseprofile-runc.yaml
index 883cb7287..d1a48eda1 100644
--- a/examples/baseprofile-runc.yaml
+++ b/examples/baseprofile-runc.yaml
@@ -2,7 +2,7 @@
 apiVersion: security-profiles-operator.x-k8s.io/v1beta1
 kind: SeccompProfile
 metadata:
-  name: runc-v1.1.11
+  name: runc-v1.1.12
 spec:
   defaultAction: SCMP_ACT_ERRNO
   architectures:
@@ -31,6 +31,7 @@ spec:
         - fstat
         - fstatfs
         - futex
+        - getcwd
         - getdents64
         - getpid
         - getppid
diff --git a/go.mod b/go.mod
index 468a3237c..112495b41 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/aquasecurity/libbpfgo v0.6.0-libbpf-1.3
 	github.com/blang/semver/v4 v4.0.0
 	github.com/cert-manager/cert-manager v1.14.0
-	github.com/containers/common v0.57.3
+	github.com/containers/common v0.57.4
 	github.com/go-logr/logr v1.4.1
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.19.0
diff --git a/go.sum b/go.sum
index 7d4ece3a0..7f5c8898d 100644
--- a/go.sum
+++ b/go.sum
@@ -209,8 +209,8 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
-github.com/containers/common v0.57.3 h1:g4NqE/4iqunqgp7htfJLPKAFKf1PAXkv2I65a7+lQJI=
-github.com/containers/common v0.57.3/go.mod h1:o3L3CyOI9yr+JC8l4dZgvqTxcjs3qdKmkek00uchgvw=
+github.com/containers/common v0.57.4 h1:kmfBad92kUjP5X44BPpOwMe+eZQqaKETfS+ASeL0g+g=
+github.com/containers/common v0.57.4/go.mod h1:o3L3CyOI9yr+JC8l4dZgvqTxcjs3qdKmkek00uchgvw=
 github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
 github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
diff --git a/hack/ci/Vagrantfile-ubuntu b/hack/ci/Vagrantfile-ubuntu
index 93bb12643..aceb78094 100644
--- a/hack/ci/Vagrantfile-ubuntu
+++ b/hack/ci/Vagrantfile-ubuntu
@@ -56,7 +56,7 @@ Vagrant.configure("2") do |config|
       apt-get autoremove -y
 
       # Some tests require runc
-      RUNC_VERSION=v1.1.11
+      RUNC_VERSION=v1.1.12
       RUNC_BINARY=/usr/bin/crio-runc
       curl -sSfL --retry 5 --retry-delay 3 "https://github.com/opencontainers/runc/releases/download/$RUNC_VERSION/runc.amd64" -o "$RUNC_BINARY"
       chmod +x "$RUNC_BINARY"
diff --git a/installation-usage.md b/installation-usage.md
index e979465c1..a7c036286 100644
--- a/installation-usage.md
+++ b/installation-usage.md
@@ -519,7 +519,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: runc-v1.1.9
+  baseProfileName: runc-v1.1.12
   syscalls:
     - action: SCMP_ACT_ALLOW
       names:
@@ -555,7 +555,7 @@ metadata:
   name: profile1
 spec:
   defaultAction: SCMP_ACT_ERRNO
-  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.11
+  baseProfileName: oci://ghcr.io/security-profiles/runc:v1.1.12
 ```
 
 The resulting profile `profile1` will then contain all base syscalls from the
@@ -1962,18 +1962,18 @@ The `spoc` client is able to pull security profiles from OCI artifact compatible
 registries. To do that, just run `spoc pull`:
 
 ```console
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+16:32:29.795597 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 16:32:29.795610 Verifying signature
 
-Verification for ghcr.io/security-profiles/runc:v1.1.11 --
+Verification for ghcr.io/security-profiles/runc:v1.1.12 --
 The following checks were performed on each of these signatures:
   - Existence of the claims in the transparency log was verified offline
   - The code-signing certificate was verified using trusted certificate authority certificates
 
 [{"critical":{"identity":{"docker-reference":"ghcr.io/security-profiles/runc"},…}}]
 16:32:33.208695 Creating file store in: /tmp/pull-3199397214
-16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.11
+16:32:33.208713 Verifying reference: ghcr.io/security-profiles/runc:v1.1.12
 16:32:33.208718 Creating repository for ghcr.io/security-profiles/runc
 16:32:33.208742 Using tag: v1.1.4
 16:32:33.208743 Copying profile from repository
@@ -2107,15 +2107,15 @@ The Security Profiles Operator will try to pull the correct profile by using
 way, for example if a profile does not support any platform:
 
 ```
-> spoc pull ghcr.io/security-profiles/runc:v1.1.11
-11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.11
+> spoc pull ghcr.io/security-profiles/runc:v1.1.12
+11:07:14.788840 Pulling profile from: ghcr.io/security-profiles/runc:v1.1.12
 11:07:14.788852 Verifying signature
 …
 11:07:17.559037 Copying profile from repository
 11:07:18.359152 Trying to read profile: profile-linux-amd64.yaml
 11:07:18.359209 Trying to read profile: profile.yaml
 11:07:18.359224 Trying to unmarshal seccomp profile
-11:07:18.359728 Got SeccompProfile: runc-v1.1.9
+11:07:18.359728 Got SeccompProfile: runc-v1.1.12
 11:07:18.359732 Saving profile in: /tmp/profile.yaml
 ```
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 40a060557..9d5b2c230 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -395,7 +395,7 @@ github.com/common-nighthawk/go-figure
 ## explicit; go 1.19
 github.com/containerd/stargz-snapshotter/estargz
 github.com/containerd/stargz-snapshotter/estargz/errorutil
-# github.com/containers/common v0.57.3
+# github.com/containers/common v0.57.4
 ## explicit; go 1.18
 github.com/containers/common/pkg/seccomp
 # github.com/coreos/go-oidc/v3 v3.9.0


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3ef4e8abc..ec8127f15 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -38,7 +38,7 @@ jobs:
           sudo apt install -y libseccomp-dev libelf-dev libapparmor-dev
           sudo hack/install-libbpf.sh
       - run: make test-unit
-      - uses: codecov/codecov-action@f30e4959ba63075080d4f7f90cacc18d9f3fafd7
+      - uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044
         with:
           files: build/coverage.out
           flags: unittests
@@ -200,6 +200,6 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v3.5.2
-      - uses: crate-ci/typos@v1.17.2
+      - uses: crate-ci/typos@v1.18.0
         with:
           config: .typos.toml
diff --git a/test/tc_base_profiles_test.go b/test/tc_base_profiles_test.go
index fe4cd2487..7925e890d 100644
--- a/test/tc_base_profiles_test.go
+++ b/test/tc_base_profiles_test.go
@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	baseProfileNameRunc = "runc-v1.1.11"
+	baseProfileNameRunc = "runc-v1.1.12"
 	baseProfileNameCrun = "crun-v1.14"
 )