build(deps): Bump orhun/git-cliff-action from 3.2.0 to 4.0.0

[dependabot]

Bumps orhun/git-cliff-action from 3.2.0 to 4.0.0.

Release notes

Sourced from orhun/git-cliff-action's releases.

Release v4.0.0

Gotta go fast 🧗

git-cliff-action is now waaaaaaaay faster.

We switched to a classic bash script to download the git-cliff binary instead of a Docker action. So, no more building images, it just downloads and runs. Vroooom! 💨

Thanks @​M0NsTeRRR for the implementation in orhun/git-cliff-action#26

Version input ✨

Also, you can now specify a git-cliff version to run:

- name: Generate a changelog
  uses: orhun/git-cliff-action@v4
  with:
    version: latest
    config: cliff.toml
    args: --verbose

The default is v2.5.0 as of now, but you can also use latest.

Release v3.3.0

[3.3.0] - 2024-07-27

Chore

docker

• Update git-cliff to 2.4.0

Docs

readme

• Add note about fetch-depth (#25)
• Reword the checkout note

Commits

• 8720f56 docs(readme): update action input version
• 290a349 chore(action): pin the git-cliff version to v2.5.0
• 7b3c32f docs(readme): remove credits due to the recent changes
• 44415ff feat: add version input variable (#27)
• ad11732 chore(deps): bump orhunp/git-cliff from 2.4.0 to 2.5.0 in the minor group (#28)
• cb015de chore(dependabot): track docker dependencies (#26)
• b946ed2 chore(docker): update git-cliff to 2.4.0
• 3963642 docs(readme): reword the checkout note
• 16d19c9 docs(readme): add note about fetch-depth (#25)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 6063802.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/update-on-push.yml

Package	Version	License	Issue Type
orhun/git-cliff-action	8720f565e14eb8f89de1c1399d3a5f75027957ff	GPL-3.0	Incompatible License

Allowed Licenses: Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, MIT

OpenSSF Scorecard

Package	Version	Score	Details
actions/orhun/git-cliff-action	8720f565e14eb8f89de1c1399d3a5f75027957ff	🟢 4.3	Details Check Score Reason Maintained 🟢 5 5 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5 Code-Review ⚠️ 1 Found 4/29 approved changesets -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy ⚠️ 0 security policy file not detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

.github/workflows/update-on-push.yml

• orhun/git-cliff-action@8720f56
• orhun/git-cliff-action@5594a53