Skip to content

Bump docker/metadata-action from 5.10.0 to 6.2.0 - #13023

Merged
lpcox merged 1 commit into
mainfrom
dependabot/github_actions/docker/metadata-action-6.2.0
Sep 12, 2026
Merged

lpcox merged 1 commit into
mainfrom
dependabot/github_actions/docker/metadata-action-6.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps docker/metadata-action from 5.10.0 to 6.2.0.

Release notes

Sourced from docker/metadata-action's releases.

v6.2.0

Full Changelog: docker/metadata-action@v6.1.0...v6.2.0

v6.1.0

Full Changelog: docker/metadata-action@v6.0.0...v6.1.0

v6.0.0

Full Changelog: docker/metadata-action@v5.10.0...v6.0.0

Commits
  • dc80280 Merge pull request #696 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 2b9fe83 [dependabot skip] chore: update generated content
  • 8128ce3 chore(deps): Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0
  • 1d1c895 Merge pull request #695 from docker/dependabot/npm_and_yarn/semver-7.8.5
  • 7f0c2dd Merge pull request #694 from docker/dependabot/npm_and_yarn/sigstore-4.1.1
  • 025f8c5 [dependabot skip] chore: update generated content
  • e98d63c chore(deps): Bump semver from 7.8.1 to 7.8.5
  • 37d9379 chore(deps): Bump sigstore from 4.1.0 to 4.1.1
  • a1b8072 Merge pull request #690 from docker/dependabot/npm_and_yarn/sigstore/core-3.2.1
  • e0e3381 [dependabot skip] chore: update generated content
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.10.0 to 6.2.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](docker/metadata-action@c299e40...dc80280)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies github_actions Pull requests that update GitHub Actions code labels Sep 12, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal AWF container)

Part Surface Op Result Expected Status
A MCP reads (list_issues, list_pull_requests, get_file_contents, list_commits) data returned ALLOWED ✅
B MCP writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) all absent from 23-tool catalog (backend GITHUB_READ_ONLY=1); no write reached the gateway BLOCKED ⚠️
C CLI reads (same 4 calls via proxied github CLI) data returned ALLOWED ✅
D CLI REST writes (reaction/star/issue/comment) gh not authenticated in this environment — none attempted BLOCKED ⚠️
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh not authenticated in this environment — none attempted BLOCKED ⚠️

Overall: INCONCLUSIVE

No write of any kind succeeded or leaked. ⚠️ rows reflect methodology gaps, not confirmed failures:

  • Part B: all 6 targeted write tools were absent from the exposed 23-tool catalog (gh-aw's tools.github: always sets GITHUB_READ_ONLY=1 backend-side), so no write ever reached mcpg's own DIFC/guard enforcement layer to test it independently. That layer is covered separately by internal/guard/internal/difc unit tests.
  • Parts D/E: gh CLI is unauthenticated in this run (no GH_TOKEN), so no REST/GraphQL write could be attempted at all to exercise the token-scope boundary.

Reads (Parts A/C) fully passed on both the MCP tool-call and proxied-CLI surfaces.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

@lpcox
lpcox merged commit 8e5e4f3 into main Sep 12, 2026
98 of 119 checks passed
@lpcox
lpcox deleted the dependabot/github_actions/docker/metadata-action-6.2.0 branch September 12, 2026 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant