Skip to content

🚨 Update github actions (release-v0.7) (major) #1684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: release-v0.7
Choose a base branch
from
Open

🚨 Update github actions (release-v0.7) (major) #1684

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ jobs:
disable-telemetry: true

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] commit SHA verification

actions/checkout updated to SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 (commented as v7.0.0). Verify against the official repository. Same change applies across all five workflow files.


# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pre-merge-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Setup Go environment
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
Expand Down Expand Up @@ -71,7 +71,7 @@ jobs:
# run: ./hack/validate-acceptable-bundles.sh

- name: Upload test coverage report
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] major-version-jump

codecov/codecov-action is bumped from v5.5.2 to v7.0.0, skipping v6 entirely. Verify the CODECOV_TOKEN env-var pattern and input parameters are still compatible with v7.

if: always()
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
2 changes: 1 addition & 1 deletion .github/workflows/push-bundles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# So we can see in which commit a bundle's content was
# most recently updated
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand Down Expand Up @@ -81,7 +81,7 @@ jobs:
disable-telemetry: true

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand Down Expand Up @@ -114,7 +114,7 @@ jobs:
Also save the release notes in a file named "release-notes.md".

- name: Upload artifact
uses: actions/upload-artifact@v6
uses: actions/upload-artifact@v7

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] pinning-inconsistency

actions/upload-artifact@v7 uses a mutable tag reference instead of a SHA-pinned commit hash. The same PR already pins this action to a SHA in scorecards.yml (actions/upload-artifact@043fb46 # v7.0.1), making the inconsistency clear.

Suggested fix: Pin to actions/upload-artifact@043fb46 # v7.0.1

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] supply-chain integrity

upload-artifact is referenced by mutable tag (@v7) instead of a pinned commit SHA, inconsistent with the SHA-pinning convention used for other actions in this repository. Pre-existing condition carried forward from @v6.

Suggested fix: Pin to actions/upload-artifact@043fb46 # v7.0.1 (matching scorecards.yml).

with:
name: release-notes
path: release-notes.md
Expand All @@ -137,7 +137,7 @@ jobs:
disable-telemetry: true

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0

Expand All @@ -152,12 +152,12 @@ jobs:
git push -f --tags

- name: Download artifact
uses: actions/download-artifact@v7
uses: actions/download-artifact@v8

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] pinning-inconsistency

actions/download-artifact@v8 uses a mutable tag reference instead of a SHA-pinned commit hash. All other action references in this repository use SHA pinning. This workflow has contents:write permissions, making the supply-chain risk more impactful.

Suggested fix: Pin to the specific commit SHA for actions/download-artifact v8, e.g. actions/download-artifact@ # v8.0.1

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] supply-chain integrity

download-artifact is referenced by mutable tag (@v8) instead of a pinned commit SHA, inconsistent with the SHA-pinning convention used for other actions in this repository. Pre-existing condition carried forward from @v7.

Suggested fix: Pin to actions/download-artifact@ # v8.0.x.

with:
name: release-notes

- name: Create a release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
with:

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] major-version-jump

softprops/action-gh-release is bumped from v2.5.0 to v3.0.0. The step uses body, name, tag_name, make_latest, and generate_release_notes inputs. Verify v3 still supports these parameters with the same semantics.

name: ${{ needs.get_info.outputs.next_version }}

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] commit SHA verification

softprops/action-gh-release updated to SHA 718ea10b132b3b2eba29c1007bb80653f286566b (commented as v3.0.1). Verify this SHA against the official repository.

tag_name: ${{ needs.get_info.outputs.next_version }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/scorecards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
disable-telemetry: true

- name: "Checkout code"
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false

Expand All @@ -81,7 +81,7 @@ jobs:
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: SARIF file
path: results.sarif
Expand Down
Loading