chore(deps): bump the github-actions group with 5 updates - #1222
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe pull request updates pinned GitHub Actions revisions across CI, security, deployment, publishing, dependency review, and smoke-test workflows. It also disables checkout credential persistence in selected workflows and updates the Docker publishing governance assertion. ChangesActions governance
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
PR governance metadata gate update for PR governance metadata gate is waiting on current-head requirements; see the latest check for pending reasons. |
|
Closing this grouped GitHub Actions update because its proposed release set is not supported by the authoritative action sources. In particular, the group proposes Regenerate the update from signed upstream tags and pin every action to a verified full commit SHA. The replacement should also include a contract test that verifies each configured SHA exists in the expected upstream repository before it reaches the merge queue. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
|
Correction after direct authoritative verification: This grouped Actions update should be restored to the review queue. Before merge, each changed action must remain pinned to a verified full upstream commit SHA and the current-head workflow/security suite must pass. |
|
@jules Fix the current Application CI failure in this dependency PR without adding workflow files and without merging. The action upgrades themselves pass frontend, security, Semgrep, Bandit, dependency, and Docker validation. Backend CI fails only because Required change:
Do not suppress the test, weaken SHA pinning, or merge the PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/pr-1222-finalize-actions-governance.yml (1)
77-98: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd exact assertions for every updated action.
test_github_actions_are_pinned_to_exact_shachecks only SHA and comment format. It does not verify the expectedactions/checkout,actions/setup-python,actions/setup-node,github/codeql-action/upload-sarif, ordocker/login-actionvalues.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-1222-finalize-actions-governance.yml around lines 77 - 98, Extend the governance validation around test_github_actions_are_pinned_to_exact_sha to assert the exact expected SHA and version comment for actions/checkout, actions/setup-python, actions/setup-node, github/codeql-action/upload-sarif, and docker/login-action. Reuse the canonical expected values already applied by this workflow, including the docker/login-action update, and fail explicitly when any expected action reference is missing or differs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-1222-finalize-actions-governance.yml:
- Around line 101-128: Expand the “Verify release governance” step before the
commit in “Commit verified governance fix and remove temporary workflow” to run
the full required validation: the complete backend test suite with
PYTHONWARNINGS=error, YAML safe-load checks, and actionlint, in addition to the
existing Ruff checks and focused test. Ensure every check succeeds before the
workflow reaches git commit or push.
---
Nitpick comments:
In @.github/workflows/pr-1222-finalize-actions-governance.yml:
- Around line 77-98: Extend the governance validation around
test_github_actions_are_pinned_to_exact_sha to assert the exact expected SHA and
version comment for actions/checkout, actions/setup-python, actions/setup-node,
github/codeql-action/upload-sarif, and docker/login-action. Reuse the canonical
expected values already applied by this workflow, including the
docker/login-action update, and fail explicitly when any expected action
reference is missing or differs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 99b2b6dd-2901-4d93-b131-c8e19a369fca
📒 Files selected for processing (7)
.github/workflows/app-ci.yml.github/workflows/bandit.yml.github/workflows/dependency-review.yml.github/workflows/deploy.yml.github/workflows/docker-publish.yml.github/workflows/mail-smoke.yml.github/workflows/pr-1222-finalize-actions-governance.yml
ff2ab93 to
23e6edb
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/bandit.yml:
- Line 25: Update the trailing checkout release comments from “# v6” to “#
v7.0.1” at all three sites: .github/workflows/bandit.yml lines 25-25,
.github/workflows/docker-publish.yml lines 57-57, and
.github/workflows/docker-publish.yml lines 181-181. Leave the pinned SHA values
unchanged.
- Line 25: Update the actions/checkout step in the Bandit workflow to set
persist-credentials to false, ensuring pull-request scans do not leave the
GITHUB_TOKEN available to contributor-controlled build or package-install code.
In @.github/workflows/pr-1222-align-governance-test.yml:
- Line 33: Update all actions/checkout references using SHA
3d3c42e5aac5ba805825da76410c181273ba90b1 to comment # v7.0.1 instead of # v6.
Extend the governance test in the workflow to detect and reject mismatched
checkout SHA/version-comment pairs, while preserving validation of existing
supported versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 76dfe245-2c15-41d4-8953-5a4130b7709b
📒 Files selected for processing (7)
.github/workflows/app-ci.yml.github/workflows/bandit.yml.github/workflows/dependency-review.yml.github/workflows/deploy.yml.github/workflows/docker-publish.yml.github/workflows/mail-smoke.yml.github/workflows/pr-1222-align-governance-test.yml
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/dependency-review.yml
- .github/workflows/app-ci.yml
- .github/workflows/deploy.yml
- .github/workflows/mail-smoke.yml
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent @cwl-noema-review review Please review exact head |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/tests/test_release_governance.py`:
- Line 719: Add exact SHA and version-comment assertions in the release
governance tests alongside the existing docker/login-action assertion, covering
actions/checkout, actions/setup-python, actions/setup-node, and
github/codeql-action/upload-sarif. Ensure each updated action is validated
against its complete pinned reference and expected version comment.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a62fe5a0-6043-4035-95ed-6291fb01c2d7
📒 Files selected for processing (6)
.github/workflows/app-ci.yml.github/workflows/bandit.yml.github/workflows/deploy.yml.github/workflows/docker-publish.yml.github/workflows/mail-smoke.ymlbackend/tests/test_release_governance.py
🚧 Files skipped from review as they are similar to previous changes (3)
- .github/workflows/app-ci.yml
- .github/workflows/bandit.yml
- .github/workflows/docker-publish.yml
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact current head only. Verify every GitHub Action is pinned to the intended immutable revision, release-governance assertions match production workflows, actionlint and repository hygiene pass, and no workflow permission or credential scope is broadened. |
|
|
|
@dependabot rebase |
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
|
@opencode-agent review Required exact-head review refresh for |
2 participants
Bumps the github-actions group with 5 updates:
7.0.07.0.16.3.07.0.06.4.07.0.04.37.04.37.44.4.04.6.0Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-pythonfrom 6.3.0 to 7.0.0Release notes
Sourced from actions/setup-python's releases.
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
github/codeql-action/upload-sariffrom 4.37.0 to 4.37.4Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
f205ea1Merge pull request #4053 from github/update-v4.37.4-9130ce0f7e40d079Update changelog for v4.37.49130ce0Merge pull request #4051 from github/update-bundle/codeql-bundle-v2.26.2c62d824Add changelog noteda0c190Update default bundle to codeql-bundle-v2.26.218420e3Merge pull request #4043 from github/mbg/ts/changelog7e8d897Merge pull request #4046 from github/mbg/repo-prop/code-quality2d4c474Log!analysisKindSupportedcase98c05a1Fix argument validation inrollback-changelog.ts8289a49Ignore repository property for unsupported analysis kindsUpdates
docker/login-actionfrom 4.4.0 to 4.6.0Release notes
Sourced from docker/login-action's releases.
Commits
dbcb813Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...5bcb015[dependabot skip] chore: update generated contentb30b2f2build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...9087f1eMerge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.20009830[dependabot skip] chore: update generated content2325523build(deps): bump js-yaml from 5.2.1 to 5.2.24ec1d4aMerge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.225fc99baMerge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...e512bd5Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...a146c91Merge pull request #1059 from crazy-max/harden-buildx-scope-pathsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit
Chores
Tests