Repository navigation
Update github actions (release-v0.8) (minor) - #3674
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
|
🤖 Finished Review · ✅ Success · Started 1:29 AM UTC · Completed 1:41 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.72 |
|
Risk Assessment: moderate (2/5) DetailsAnchored to prior score of 2: Tier 1 signals unchanged (9 CI workflow files modified by renovate bot, PROTECTED_PATH_COUNT=9, CI_WORKFLOW_CHANGED=true, zero security-sensitive or dependency changes), Tier 2 confirms minimal 30-day churn and no fix/revert patterns, yielding weighted composite ~1.86 (62% Tier1=2.125 + 38% Tier2=1.43), consistent with prior moderate assessment. Previous run<!-- fullsend:risk-assessment --> DetailsAnchored to prior score of 2: Tier 1 signals unchanged (9 CI workflow files modified by renovate bot, PROTECTED_PATH_COUNT=9, CI_WORKFLOW_CHANGED=true, zero security-sensitive or dependency changes), Tier 2 confirms minimal 30-day churn, yielding weighted composite ~2.1 (62% Tier1 + 38% Tier2), consistent with prior moderate assessment. Previous run (2)<!-- fullsend:risk-assessment --> DetailsAnchored to prior score of 2: Tier 1 signals unchanged (9 CI workflow files, bot author, no dependency changes, PROTECTED_PATH_COUNT=9, CI_WORKFLOW_CHANGED=true), Tier 2 confirms zero regression history and minimal churn, yielding weighted composite ~2.2 (62% Tier1 + 38% Tier2), consistent with prior moderate assessment. Previous run (3)<!-- fullsend:risk-assessment --> DetailsAnchored to prior score of 2: Tier 1 signals are unchanged (same 9 CI workflow files, bot author, no dependency changes, high protected-path count of 9, CI_WORKFLOW_CHANGED=true), and Tier 2 confirms low churn and zero regression history, yielding a weighted composite of ~2.2, consistent with the prior moderate assessment. Previous run (4)<!-- fullsend:risk-assessment --> DetailsRenovate bot PR making minor GitHub Actions version bumps across 9 CI workflow files remains moderate risk: bot authorship, low 30-day churn, zero fix/revert history, and no security-sensitive or dependency changes offset the high protected-path count (9) and CI workflow change signal, yielding a composite of ~2.3, consistent with and anchored to the prior assessment. Previous run (5)<!-- fullsend:risk-assessment --> DetailsRenovate bot PR making minor GitHub Actions version bumps across 9 CI workflow files keeps risk moderate: bot authorship, small line count (80 lines), and no security-sensitive or dependency changes offset the high protected-path count and elevated churn in historically active files like release.yaml. |
ReviewFindingsHigh
Next steps:
Previous run<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W119 --> ReviewFindingsHigh
Labels: Renovate bot PR updating GitHub Actions versions across CI workflow files. Next steps:
Previous run (2)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W119 --> ReviewFindingsHigh
Next steps:
Previous run (3)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W119 --> ReviewFindingsHigh
Next steps:
Previous run (4)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W119 --> ReviewFindingsHigh
Labels: All changed files are CI workflow files; adding ci to complement existing github_actions label. Next steps:
Previous run (5)<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJhY3Rpb24iOiJyZXF1ZXN0LWNoYW5nZXMiLCJmaW5kaW5ncyI6W119 --> ReviewFindingsHigh
Labels: PR updates GitHub Actions dependencies across CI workflow files Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
e41d17f to
4572154
Compare
|
🤖 Finished Review · ✅ Success · Started 10:04 PM UTC · Completed 10:15 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.66 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
4572154 to
3b6b66a
Compare
|
🤖 Finished Review · ✅ Success · Started 5:43 AM UTC · Completed 5:58 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.19 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
3b6b66a to
299b989
Compare
|
🤖 Finished Review · ✅ Success · Started 4:13 AM UTC · Completed 4:26 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.61 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
299b989 to
bb175d2
Compare
|
🤖 Finished Review · ✅ Success · Started 11:48 AM UTC · Completed 11:58 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.40 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
bb175d2 to
2acda56
Compare
|
🤖 Finished Review · ❌ Failure (validation failed after 1 iteration(s)) · Started 9:19 AM UTC · Completed 9:28 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.39 |
2acda56 to
b934357
Compare
|
🤖 Finished Review · ✅ Success · Started 2:07 PM UTC · Completed 2:21 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.51 |
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v5.0.5→v5.1.0v6.0.3→v6.1.0v6.3.0→v6.5.0v6.2.0→v6.5.0e049ae9→cc8da96e049ae9→cc8da96v1.0.0→v1.2.0v4.32.6→v4.39.2v4.39.3v2.4.4→v2.5.0a06a81a→3bb1273v2.15.1→v2.22.3v2.22.4Release Notes
actions/cache
v5.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.1.0
actions/checkout
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
actions/setup-go
v6.5.0Compare Source
What's Changed
Dependency update
New Contributors
Full Changelog: actions/setup-go@v6...v6.5.0
v6.4.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation update
New Contributors
Full Changelog: actions/setup-go@v6...v6.4.0
actions/setup-node
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
v6.4.0Compare Source
What's Changed
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v6...v6.4.0
v6.3.0Compare Source
What's Changed
Enhancements:
devEnginesfield by @susnux in #1283Dependency updates:
Bug fixes:
New Contributors
Full Changelog: actions/setup-node@v6...v6.3.0
conforma/pr-size-label-action
v1.2.0Compare Source
What's Changed
Full Changelog: conforma/pr-size-label-action@v1...v1.2.0
v1.1.0Compare Source
Highlights
@actions/corev2 — updated from v1package.jsonsrc/main.jsentrypoint,src/index.jsexportsrun()for testabilitysize:prefix (with trailing space) to avoid collisions.nvmrcandenginesfield addedWhat's Changed
What's Changed
New Contributors
Full Changelog: conforma/pr-size-label-action@v1.0.0...v1.1.0
github/codeql-action
v4.39.2Compare Source
CODEQL_ACTION_CLEANUP_TRAP_CACHESenvironment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. TheanalyzeAction now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing thetrap-caching: falseinput to theinitAction. #4243v4.39.1Compare Source
v4.39.0Compare Source
codeql-action/analyzestep now validates that a correct argument for thecheckout_pathinput has been provided. Thecheckout_pathinput must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used bycodeql-action/init, then the CodeQL Action now produces a warning. #4148codeql-action/start-proxystep that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic ascodeql-action/init. This primarily benefits customers who are using GitHub instances other thangithub.comwhere thecodeql-action/start-proxystep may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198v4.38.3Compare Source
v4.38.2Compare Source
v4.38.1Compare Source
v4.38.0Compare Source
linux-arm64CodeQL bundle when available. #4072v4.37.9Compare Source
v4.37.8Compare Source
No user facing changes.
v4.37.7Compare Source
v4.37.6Compare Source
.github/codeql-config.ymlto align it with the suggested path that is used elsewhere. #4070v4.37.5Compare Source
initAction instead of falling back to downloading the bundle before extracting it. #4061v4.37.4Compare Source
toolsinput for thecodeql-action/initstep to be specified using agithub-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value totoolcacheto always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided fortoolsin the workflow definition always takes precedence unless the value of the repository property starts with!. #4037v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
v4.36.2Compare Source
v4.36.1Compare Source
No user facing changes.
v4.36.0Compare Source
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892v4.35.4Compare Source
v4.35.3Compare Source
GETrequests instead ofHEADfor better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853v4.35.2Compare Source
CODEQL_ACTION_CLEANUP_TRAP_CACHESenvironment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing thetrap-caching: falseinput to theinitAction. #3795v4.35.1Compare Source
v4.35.0Compare Source
v4.34.1Compare Source
v4.34.0Compare Source
none. We expect this rollout to be complete by the end of April 2026. #3584v4.33.0Compare Source
Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562
To opt out of this change:
github-codeql-file-coverage-on-prsand the type "True/false", then set this property totruein the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set theCODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as
github-codeql-disable-overlaythat was previously only available on GitHub.com. #3559Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570
ossf/scorecard-action
v2.5.0Compare Source
What's Changed
This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.
For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.
@justaugustus in #1716
cmd/installer) now creates.github/workflows/scorecard.yml, and stillrecognizes existing
scorecards.ymlandscorecards-analysis.ymlworkflows. by @justaugustus in #1716with. by @justaugustus in #1718
@arpitjain099 in #1709
results_formatacceptsintoto, which wraps the JSON results in an in-toto attestationstatement. by @puerco in #1702
Other
RELEASE.md by @justaugustus in #1716
New Contributors
Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0
step-security/harden-runner
v2.22.3Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3
v2.22.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2
v2.22.1Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1
v2.22.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0
v2.21.1Compare Source
What's Changed
disable-sudofeature./usrfilesystem layout (for example Debian 11), where/usr/bin/echodoes not exist. This mainly affected self-hosted runners.Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1
v2.21.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0
v2.20.1Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1
v2.20.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0
v2.19.4Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4
v2.19.3Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3
[
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.