chore(deps): batch GitHub Actions major bumps — 4 safe upgrades - #2245
Closed
HongmingWang-Rabbit wants to merge 1 commit into
Closed
chore(deps): batch GitHub Actions major bumps — 4 safe upgrades#2245HongmingWang-Rabbit wants to merge 1 commit into
HongmingWang-Rabbit wants to merge 1 commit into
Conversation
Consolidates the 4 dependabot PRs that were held back from the 2026-04-28 batch (#2235) for individual review. Research confirms each is safe for our specific usage: github/codeql-action v3 → v4.35.2 (#2228) actions/setup-node v4 → v6.4.0 (#2218) actions/upload-artifact v4 → v7.0.1 (#2216) actions/setup-python v5 → v6.2.0 (#2214) Why each is safe: setup-node v4 → v6: Every call site explicitly pins node-version ('20' or '22'); the bump cannot shift the actual Node version we use. v5 changed the default-version behavior, but pinned consumers are unaffected. setup-python v5 → v6: Same reasoning — every call pins python-version: '3.11'. v6's new default of 3.13 doesn't apply when the consumer overrides. codeql-action v3 → v4.35.2: Used as init/autobuild/analyze sub-actions in codeql.yml only. v4 bundles a newer CodeQL CLI; ubuntu-latest auto-updates the CLI so functional behavior is unchanged. The deprecated CODEQL_ACTION_CLEANUP_TRAP_CACHES env var noted in the v4.35.2 changelog is undocumented and we don't set it. upload-artifact v4 → v7.0.1: v6 introduced Node.js 24 runtime which requires Actions Runner >= 2.327.1. All our upload-artifact users (codeql.yml, e2e-staging-canvas.yml) run on `ubuntu-latest` (GitHub-hosted), which auto-updates the runner agent. Self-hosted runners are NOT used for these jobs (those are reserved for secret-scan and the private molecule-controlplane mirror, neither of which uses upload-artifact). All SHA-pinned per the org's "pin to SHA" convention (introduced in chore(security): pin Actions to SHAs, 2026-04-28). The sed-based update preserves the # vX.Y.Z comment so reviewers can verify the pin matches the version they expect without resolving the SHA. Closes (when this merges): #2228 github/codeql-action 3 → 4 #2218 actions/setup-node 4 → 6 #2216 actions/upload-artifact 4 → 7 #2214 actions/setup-python 5 → 6
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
April 29, 2026 00:34
HongmingWang-Rabbit
enabled auto-merge
April 29, 2026 00:34
HongmingWang-Rabbit
disabled auto-merge
April 29, 2026 00:40
Contributor
Author
|
Superseded by chore/all-deps-batch-2026-04-28-pt2 — single PR for all 6 safe upgrades per user request. |
5 tasks
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
The Create-workspace dialog blocked submission with "Provider credential
is required" for the platform-managed provider, even though platform-
managed mode injects its own usage token (MOLECULE_LLM_USAGE_TOKEN = the
tenant admin_token, set by the CP provisioner) and the user supplies no
key. The validation keyed only off envVars.length, with no exemption for
platform-managed; it also rendered a credential field for the internal
token and would have sent secrets:{MOLECULE_LLM_USAGE_TOKEN:""} on create,
clobbering the provisioner-injected token.
Add isPlatformManagedProvider() (vendor==="platform" ||
billingMode==="platform_managed") and gate the validation, the
credential-field render, and the secret-send on it. Platform-managed now
shows "no API key required" and sends no secret; BYOK is unchanged.
Tests: discriminating vitest (watch-it-fail verified red->green) — a
platform-managed provider WITH a declared auth env requires no credential,
hides the field, and sends no secret; BYOK still requires + renders the
field; + isPlatformManagedProvider unit cases. The prior mock masked the
bug by giving the platform provider required_env:[] — the new fixture
matches production (auth_env carries MOLECULE_LLM_USAGE_TOKEN).
Fixes #2245
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…2245) Independent review noted the integration test exercised only the legacy vendor==="platform" branch; production uses the registry-backed billingMode==="platform_managed" path. Add a registry fixture whose platform provider declares auth_env:[MOLECULE_LLM_USAGE_TOKEN] and assert end-to-end through buildProviderCatalogFromRegistry: field hidden, no error, no secret in the create payload. Watch-it-fail verified red->green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
… via bad rebase) HEAD 911d9ce was labeled test-only but its rebase took the pre-fix source blobs, deleting the isPlatformManagedProvider helper + its 3 call-sites that 21268f0 had correctly added — so the new #2245 tests ran against un-fixed source (6 reds: 'isPlatformManagedProvider is not a function' x4 + missing 'Platform-managed — no API key required.' copy x2). Mechanism = clobbered source, NOT a flake. Restores both files to 21268f0. SSOT: helper defined once in ProviderModelSelector, imported in the dialog. Canvas suite 3342 pass / 0 fail.
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…aged providers (#2248) MissingKeysModal and ConfigTab both showed credential input fields for MOLECULE_LLM_USAGE_TOKEN when a platform-managed provider was selected. This allowed users to overwrite the provisioner-injected token. Changes: - MissingKeysModal: filter MOLECULE_LLM_USAGE_TOKEN from envVars when the selected provider is platform-managed (mirrors #2245). Memoized with useMemo so the array reference is stable across renders and does not churn the entries useEffect (Researcher review 9318). - ConfigTab: filter the same token from required_env in the ProviderModelSelector onChange handler (mirrors #2245). - Add regression test covering suppression for platform-managed vs BYOK, render-churn guard, and provider-switch behavior. Fixes #2248.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the 4 dependabot action-major PRs that were held back from the 2026-04-28 batch (#2235) for individual review. Research below confirms each is safe for our specific usage.
Bumps
Why each is safe
`setup-node` v4 → v6
Every call site explicitly pins `node-version` (`'20'` in e2e-staging-canvas, `'22'` in ci.yml). The bump cannot shift the actual Node version we use — v5 changed default behavior, but pinned consumers are unaffected.
`setup-python` v5 → v6
Same reasoning. Every call pins `python-version: '3.11'`. v6's new default Python 3.13 doesn't apply when consumer overrides.
`codeql-action` v3 → v4.35.2
Used as `init`/`autobuild`/`analyze` sub-actions in `codeql.yml` only. v4 bundles a newer CodeQL CLI; ubuntu-latest auto-updates the CLI so functional behavior is unchanged. The deprecated `CODEQL_ACTION_CLEANUP_TRAP_CACHES` env var noted in the v4.35.2 changelog is undocumented and we don't set it.
`upload-artifact` v4 → v7.0.1
v6 introduced Node.js 24 runtime requiring Actions Runner ≥ 2.327.1. All our upload-artifact users (`codeql.yml`, `e2e-staging-canvas.yml`) run on `ubuntu-latest` (GitHub-hosted), which auto-updates the runner agent. Self-hosted runners are NOT used for these jobs.
Convention
All bumps preserve SHA pinning per the org convention (`chore(security): pin Actions to SHAs`, 2026-04-28). The `# vX.Y.Z` comment alongside each SHA lets reviewers verify the pin without resolving the hash.
Test plan
🤖 Generated with Claude Code