ci: Update CI tool dependencies by renovate[bot] · Pull Request #1703 · Aureliolo/synthorg

renovate · 2026-05-02T05:57:03Z

This PR contains the following updates:

Package	Type	Update	Change
CodSpeedHQ/action	action	minor	`v4.14.0` → `v4.15.0`
actions/setup-python	action	minor	`v6.1.0` → `v6.2.0`
chainguard-dev/actions	action	patch	`v1.6.15` → `v1.6.17`
github/codeql-action	action	patch	`v4.35.2` → `v4.35.3`
goreleaser/goreleaser-action	action	minor	`v7.1.0` → `v7.2.1`
python	uses-with	pin	`3.14` → `3.14.4`

Release Notes

CodSpeedHQ/action (CodSpeedHQ/action)

`v4.15.0`

Compare Source

Release Notes

This release adds first support for macOS walltime.

Please note that profiling and other instruments are not yet available on macOS and will come in a later update.

Minimum integration versions

🚀 Features

Revert logo changes by @GuillaumeLagrange
Display N/A rather than NaN/inf in the benchmarks results table by @GuillaumeLagrange in #314
Only wrap walltime command with sudo on linux by @GuillaumeLagrange
Add --with-token flag to read token from stdin by @fargito in #313
Warn when libc debug info is not found by @not-matthias in #310
Resolve debug info and symbols from separate debug files by @not-matthias in #303

🧪 Testing

Add libc debuglink/build-id fixtures by @not-matthias
Add stripped binary and debug file test fixtures by @not-matthias

⚙️ Internals

chore: bump runner version to 4.15.0 by @github-actions[bot] in #204
Bump exec-harness version
Add macos basic run test by @GuillaumeLagrange in #319
Remove DumpPerfMapAtExit in favor of custom dumper by @not-matthias in #295

Install codspeed-runner 4.15.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/CodSpeedHQ/codspeed/releases/download/v4.15.0/codspeed-runner-installer.sh | sh

Download codspeed-runner 4.15.0

File	Platform	Checksum
codspeed-runner-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
codspeed-runner-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
codspeed-runner-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Full Runner Changelog: https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

Full Changelog: CodSpeedHQ/action@v4.14.0...v4.15.0

actions/setup-python (actions/setup-python)

`v6.2.0`

Compare Source

chainguard-dev/actions (chainguard-dev/actions)

`v1.6.17`

Compare Source

What's Changed

build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.16 in /wolfi-build-pkg by @dependabot[bot] in #876
build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.16 in /melange-build by @dependabot[bot] in #875
build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.16 in /inky-build-pkg by @dependabot[bot] in #874
build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.16 in /goimports by @dependabot[bot] in #873
build(deps): bump chainguard-dev/actions from 1.6.15 to 1.6.16 in /gofmt by @dependabot[bot] in #872
fix(setup-knative): make resource_blaster fail loudly on HTTP errors by @jml in #878
otel-export: use RUNNER_NAME for the current job by @joshrwolf in #877

New Contributors

@jml made their first contribution in #878

Full Changelog: chainguard-dev/actions@v1.6.16...v1.6.17

`v1.6.16`

Compare Source

What's Changed

build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 in /wolfi-build-pkg by @dependabot[bot] in #867
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 in /melange-build by @dependabot[bot] in #866
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 in /inky-build-pkg by @dependabot[bot] in #865
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 in /goimports by @dependabot[bot] in #864
build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #861
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 by @dependabot[bot] in #862
build(deps): bump chainguard-dev/actions from 1.6.14 to 1.6.15 in /gofmt by @dependabot[bot] in #863
build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 in /githubapp-token by @dependabot[bot] in #869
build(deps): bump step-security/harden-runner from 2.18.0 to 2.19.0 by @dependabot[bot] in #868

Full Changelog: chainguard-dev/actions@v1.6.15...v1.6.16

github/codeql-action (github/codeql-action)

`v4.35.3`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

goreleaser/goreleaser-action (goreleaser/goreleaser-action)

`v7.2.1`

Compare Source

This fully removes the usage of the old nightly moving tag.

Full Changelog: goreleaser/goreleaser-action@v7.2.0...v7.2.1

`v7.2.0`

Compare Source

What's Changed

test: cover install across release eras by @caarlos0 in #555
feat: add version-file input by @caarlos0 in #556
feat: resolve nightly to latest vX.Y.Z--nightly release by @caarlos0 in #558

Full Changelog: goreleaser/goreleaser-action@v7...v7.2.0

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- Between 12:00 AM and 06:59 AM, only on Saturday (* 0-6 * * 6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-05-02T05:57:15Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/upload-sarif	e46ed2cbd01164d986452f91f178727624ae40d7	Unknown	Unknown

Scanned Files

.github/workflows/scorecard.yml

codspeed-hq · 2026-05-02T06:00:07Z

Merging this PR will not alter performance

✅ 54 untouched benchmarks

_{Comparing renovate/ci-tools (2c5fa49) with main (3d790d9)}

codecov · 2026-05-02T06:07:05Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.69%. Comparing base (3d790d9) to head (2c5fa49).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1703      +/-   ##
==========================================
- Coverage   84.69%   84.69%   -0.01%     
==========================================
  Files        1786     1786              
  Lines      102259   102259              
  Branches     8980     8980              
==========================================
- Hits        86613    86609       -4     
- Misses      13457    13459       +2     
- Partials     2189     2191       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

## Summary Adds a cross-PR file-overlap analysis step to the `/review-dep-pr` skill so that batch reviews surface merge conflicts upfront and the user can pick a sequencing strategy before triage. ### What changed - **New Phase 5 — Cross-PR File Overlap Analysis** (skipped for single-PR runs): - Pulls each PR's changed-file list via `gh pr view --json files`. - Builds a per-file conflict map and classifies overlaps as **none / lockfile-only / config / source**. - Treats `package-lock.json`, `pnpm-lock.yaml`, `uv.lock`, `go.sum`, `atlas.sum`, etc. as lockfile-only (rebase needed, not a hard blocker). - Groups PRs into merge **waves** (Wave 1 = parallel-safe, Wave 2+ = sequential after rebase). - **Phase 6 (Present Findings)** now leads with a "Batch Overlap Summary" header and adds a `Files touched / conflicts with` row to each per-PR card. - **Phase 7 (User Decision)** opens with a strategy question whenever ≥ 2 PRs share files: - Wave-based parallel - Strict sequential - Combine into one PR - Defer the conflicting subset - **Phase 8 (Execute Decisions)** honours the chosen strategy when sequencing merges (parallel waves, rebase between waves, etc.). - New rule: multi-PR runs always compute the conflict map; lockfile-only overlaps are acceptable but expect rebase between merges. ### Why Without this, the skill would propose merging in parallel any PRs whose CI is green, then run into surprise conflicts on the second/third merge — most often on workflow YAMLs and lockfiles. The new phase makes the conflict surface explicit before the user picks a strategy, and the strategy choice is then carried through to execution. ### Test plan Dogfooded against the 8 open Renovate PRs in this repo (#1698-#1705). Surfaced three conflict clusters (`docker.yml` between #1698/#1701/#1703, `cli.yml` between #1702/#1703, `web/package.json` between #1700/#1704) plus the expected lockfile-only overlaps. The Wave-based strategy successfully merged 5 PRs sequentially with `--squash --admin` and the lockfile PR (#1705) was rebased via Renovate. ### Review coverage `/pre-pr-review quick` — docs-only change to a `.claude/` skill file, no code/agents required. Pre-commit hooks passed (trailing whitespace, EOF, secrets, em-dashes).

@Ontology

## Highlights > _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub Models). Commit-based changelog below._ ### What you'll notice - Frontend and UX polishing improves user interface responsiveness and visual consistency. - API hygiene and validation enhancements provide smoother and more reliable interactions. ### What's new - Introduced typed-boundary helpers enabling better type safety and parse_typed workflows. - Added codebase-audit skill prompt tuning for improved project auditing. ### Under the hood - Eliminated flaky tests caused by module-level state for more stable test outcomes. - Unified image tag management under CLI and Renovate for consistent dependency updates. - Added cross-PR file-overlap analysis to the review dependency pull request skill. - Updated multiple dependencies including Python, Web, CLI, and container libraries. - Improved CI tooling and lock file maintenance for better build reliability.  :robot: I have created a release *beep* *boop* --- ## [0.7.8](v0.7.7...v0.7.8) (2026-05-03) ### Features * **api:** typed-boundary helper + codebase-audit skill prompt tuning ([#1712](#1712)) ([40ee65b](40ee65b)) * **boundary:** RFC [#1711](#1711) Phases 2 + 3 — typed boundaries via parse_typed ([#1720](#1720)) ([7b9f409](7b9f409)) ### Bug Fixes * **api:** audit cleanup B -- API hygiene & validation ([#1719](#1719)) ([3d790d9](3d790d9)) * audit cleanup C - persistence, concurrency & data integrity ([#1708](#1708)) ([#1717](#1717)) ([bcce097](bcce097)) * **test:** exterminate xdist-flaky tests with module-level state ([#1713](#1713)) ([#1721](#1721)) ([8d258dd](8d258dd)) * **web:** audit cleanup E -- frontend & UX polish ([#1710](#1710)) ([#1718](#1718)) ([3a3591a](3a3591a)) ### Refactoring * **cli:** single source of truth for DHI image tags + Renovate manager ([#1723](#1723)) ([57980a2](57980a2)) ### Documentation * audit cleanup D -- public-facing & docs sync ([#1709](#1709)) ([#1715](#1715)) ([ade03b7](ade03b7)) ### Tests * **engine:** make TestDrainTimeout deterministic + preserve subclass type in [@Ontology](https://github.com/ontology)_entity ([#1729](#1729)) ([b00fb05](b00fb05)) ### CI/CD * Update CI tool dependencies ([#1703](#1703)) ([355a9ff](355a9ff)) ### Maintenance * add cross-PR file-overlap analysis to review-dep-pr skill ([#1722](#1722)) ([3861d8a](3861d8a)) * **ci:** unify apko-version under workflow env so Renovate manages it everywhere ([#1724](#1724)) ([9c0a7fd](9c0a7fd)) * consolidate DHI image-pin custom regex managers ([#1726](#1726)) ([b8b0cba](b8b0cba)) * **deps:** update dependency chainguard-dev/melange to v0.50.4 ([#1701](#1701)) ([8cbf83a](8cbf83a)) * Lock file maintenance ([#1705](#1705)) ([414cfea](414cfea)) * Lock file maintenance ([#1727](#1727)) ([5cb1212](5cb1212)) * Update CLI dependencies ([#1702](#1702)) ([9fb57b9](9fb57b9)) * Update Container dependencies ([#1698](#1698)) ([6d24fd6](6d24fd6)) * Update dependency @eslint-react/eslint-plugin to v5 ([#1704](#1704)) ([1cb1294](1cb1294)) * Update Python dependencies ([#1699](#1699)) ([8e7af3a](8e7af3a)) * Update Python dependencies to v4.15.0 ([#1725](#1725)) ([69164c8](69164c8)) * Update Web dependencies ([#1700](#1700)) ([715300d](715300d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

renovate Bot requested a review from Aureliolo as a code owner May 2, 2026 05:57

renovate Bot added dependencies Pull requests that update a dependency file type:infra CI/CD, tooling, project setup labels May 2, 2026

renovate Bot temporarily deployed to atlas May 2, 2026 05:57 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 05:58 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from 3b2c912 to d3a51dc Compare May 2, 2026 07:25

renovate Bot temporarily deployed to atlas May 2, 2026 07:26 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 07:28 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from d3a51dc to 4692d7b Compare May 2, 2026 10:14

renovate Bot temporarily deployed to atlas May 2, 2026 10:16 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 10:18 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from 4692d7b to a2feeef Compare May 2, 2026 12:13

renovate Bot temporarily deployed to atlas May 2, 2026 12:13 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 12:14 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from a2feeef to 5d19099 Compare May 2, 2026 13:04

renovate Bot temporarily deployed to atlas May 2, 2026 13:05 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 13:07 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from 5d19099 to 9b4ef20 Compare May 2, 2026 16:13

renovate Bot temporarily deployed to atlas May 2, 2026 16:14 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 16:16 Inactive

renovate Bot force-pushed the renovate/ci-tools branch from 9b4ef20 to c514228 Compare May 2, 2026 18:48

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 18:50 Inactive

renovate Bot temporarily deployed to atlas May 2, 2026 18:50 Inactive

ci: Update CI tool dependencies

2c5fa49

renovate Bot force-pushed the renovate/ci-tools branch from c514228 to 2c5fa49 Compare May 2, 2026 20:06

renovate Bot temporarily deployed to atlas May 2, 2026 20:08 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 2, 2026 20:09 Inactive

Aureliolo merged commit 355a9ff into main May 3, 2026
87 checks passed

Aureliolo deleted the renovate/ci-tools branch May 3, 2026 07:38

Aureliolo temporarily deployed to cloudflare-preview May 3, 2026 07:38 — with GitHub Actions Inactive

synthorg-repo-bot Bot mentioned this pull request May 3, 2026

chore(main): release 0.7.8 #1714

Merged

Aureliolo mentioned this pull request May 3, 2026

chore: add cross-PR file-overlap analysis to review-dep-pr skill #1722

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Update CI tool dependencies#1703

ci: Update CI tool dependencies#1703
Aureliolo merged 1 commit into
mainfrom
renovate/ci-tools

renovate Bot commented May 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 2, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented May 2, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.15.0

Release Notes

Minimum integration versions

🚀 Features

🧪 Testing

⚙️ Internals

Install codspeed-runner 4.15.0

Install prebuilt binaries via shell script

Download codspeed-runner 4.15.0

v6.2.0

v1.6.17

What's Changed

New Contributors

v1.6.16

What's Changed

v4.35.3

v7.2.1

v7.2.0

What's Changed

Configuration

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

codspeed-hq Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

codecov Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 2, 2026 •

edited

Loading

`v4.15.0`

`v6.2.0`

`v1.6.17`

`v1.6.16`

`v4.35.3`

`v7.2.1`

`v7.2.0`

github-actions Bot commented May 2, 2026 •

edited

Loading

codspeed-hq Bot commented May 2, 2026 •

edited

Loading

codecov Bot commented May 2, 2026 •

edited

Loading