chore: update obsolete GitHub Actions to latest major versions

[Victoremepunto]

Summary

• Bump actions/checkout from v4/v6/v6.0.2 to v7 (Node 24, safer pull_request_target defaults)
• Bump actions/setup-go from v5 to v6
• Bump actions/upload-artifact from v4 to v7
• Bump actions/download-artifact from v4 to v8
• Bump actions/stale from v9 to v10
• Bump actions/github-script from v8 to v9
• Bump google-github-actions/auth from v2 to v3 (e2e.yml only; setup-gcp already on v3)
• Bump sigstore/cosign-installer from v3 to v4
• Bump codecov/codecov-action from v5 to v7

SHA-pinned refs in sandbox-images.yml are intentionally left unchanged (supply-chain pinning for container builds).

Motivation

Node 20 reached EOL in April 2026. actions/checkout@v7 runs on Node 24 and adds safer pull_request_target defaults to prevent pwn request vulnerabilities. GitHub will backport enforcement to older major versions on July 16, 2026 — updating now avoids a forced migration.

The actions/cache/restore@v4 Node 20 deprecation warning is also resolved by this PR, since it was triggered transitively by actions/setup-go@v5 (now bumped to v6).

Test plan

• CI passes with updated action versions
• pull_request_target workflows (e2e.yml) still check out correctly with v7's new defaults
• Reusable workflows called from .fullsend repos still function correctly
• Container builds in sandbox-images.yml are unaffected (SHA-pinned, not changed)

Signed-off-by: Víctor M. Múgica vmugicag@redhat.com

🤖 Generated with Claude Code

[github-actions]

E2E tests did not run

The ok-to-test label was removed because new commits landed after it was applied. A maintainer must re-apply ok-to-test after reviewing the latest changes.

Note: ok-to-test was cleared due to new commits.

See E2E testing guide for details.

[qodo-code-review]

PR Summary by Qodo

Update GitHub Actions to latest major versions (Node 24 readiness)
⚙️ Configuration changes 🕐 20-40 Minutes

Description

• Bump core GitHub Actions (checkout/setup-go/artifacts/github-script) to latest majors to avoid
 Node 20 EOL.
• Update release, CI, deploy, and reusable workflows to use the new action versions consistently.
• Keep SHA-pinned refs unchanged where intentional for supply-chain pinning (sandbox images).

Diagram

graph TD
WT["Build/Test workflows"] --> CO["actions/checkout@v7"] --> SG["actions/setup-go@v6"] --> AC["Artifacts + Coverage"]
WO["Deploy/Ops workflows"] --> CO --> AC
WO --> GS["github-script@v9"]
WO --> AS["Auth + Signing"]
WO --> ST["actions/stale@v10"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. SHA-pin all third-party actions

• ➕ Maximizes supply-chain integrity and reproducibility
• ➕ Reduces risk from upstream tag retargeting
• ➖ Higher maintenance overhead (must regularly refresh SHAs)
• ➖ Harder to audit/understand which upstream release is in use at a glance

2. Enable/expand Dependabot for GitHub Actions

• ➕ Automates major/minor version update PRs and changelog visibility
• ➕ Reduces chances of drift across many workflow files
• ➖ Can create PR noise without good grouping/labels
• ➖ Still requires human review for security-sensitive workflows (e.g., pull_request_target)

3. Centralize common steps into reusable workflows

• ➕ Single place to update action versions for many pipelines
• ➕ Reduces duplication and version skew across workflow files
• ➖ Bigger refactor than a version bump; changes execution boundaries
• ➖ May complicate repo-specific exceptions (deploy vs CI vs reusable workflows)

Recommendation: The PR’s approach (bump to latest majors now) is the right near-term move given Node 20 EOL and upcoming GitHub enforcement, especially for checkout@v7 pull_request_target hardening. Consider adding/adjusting Dependabot for ongoing updates, and selectively SHA-pin the most security-sensitive actions over time (as already done for sandbox image build pins) if your threat model warrants it.

Files changed (15) +40 / -40

Other (15) +40 / -40

branch-cleanup.ymlBump checkout to v7 for branch cleanup job +1/-1

Bump checkout to v7 for branch cleanup job

• Updates the workflow to use actions/checkout@v7. Aligns maintenance automation with the repo-wide move to Node 24-based actions.

.github/workflows/branch-cleanup.yml

e2e.ymlModernize e2e workflow actions (checkout/go/auth/artifacts) +5/-5

Modernize e2e workflow actions (checkout/go/auth/artifacts)

• Updates actions/checkout to v7 in both gate and test jobs, actions/setup-go to v6, google-github-actions/auth to v3, and upload-artifact to v7. This is the most security-sensitive workflow due to pull_request_target usage and checkout semantics.

.github/workflows/e2e.yml

lint.ymlUpdate lint workflow to checkout v7, setup-go v6, and Codecov v7 +5/-5

Update lint workflow to checkout v7, setup-go v6, and Codecov v7

• Bumps actions/checkout across lint/test/web jobs to v7 and updates actions/setup-go to v6. Also upgrades codecov/codecov-action to v7 for coverage upload.

.github/workflows/lint.yml

pat-cleanup.ymlUpdate PAT cleanup workflow to checkout v7 and setup-go v6 +2/-2

Update PAT cleanup workflow to checkout v7 and setup-go v6

• Upgrades the workflow’s checkout step to actions/checkout@v7 and Go setup to actions/setup-go@v6. Keeps cleanup automation aligned with the new action runtime versions.

.github/workflows/pat-cleanup.yml

release.ymlUpdate release workflow to checkout v7 and cosign-installer v4 +2/-2

Update release workflow to checkout v7 and cosign-installer v4

• Bumps actions/checkout to v7 and sigstore/cosign-installer to v4. Reduces risk of Node runtime deprecation affecting releases and signing steps.

.github/workflows/release.yml

reusable-code.ymlStandardize reusable code workflow on checkout v7 +3/-3

Standardize reusable code workflow on checkout v7

• Updates all checkout steps (config repo, upstream defaults, target repo) to actions/checkout@v7. Helps avoid inconsistent checkout behavior across reusable workflows.

.github/workflows/reusable-code.yml

reusable-dispatch.ymlUpdate reusable dispatch workflow to checkout v7 +1/-1

Update reusable dispatch workflow to checkout v7

• Bumps the caller repository checkout step from actions/checkout@v6 to v7. Keeps reusable dispatch behavior compatible with Node 24-based actions.

.github/workflows/reusable-dispatch.yml

reusable-fix.ymlStandardize reusable fix workflow on checkout v7 +3/-3

Standardize reusable fix workflow on checkout v7

• Updates checkout steps for config repo, upstream defaults, and target repo to actions/checkout@v7. Ensures PR-head checkout for fixes uses the updated checkout behavior consistently.

.github/workflows/reusable-fix.yml

reusable-prioritize.ymlUpdate reusable prioritize workflow to checkout v7 +2/-2

Update reusable prioritize workflow to checkout v7

• Bumps checkout steps (config repo and upstream defaults) from v6 to v7. Reduces version drift across reusable workflows.

.github/workflows/reusable-prioritize.yml

reusable-retro.ymlUpdate reusable retro workflow to checkout v7 +3/-3

Update reusable retro workflow to checkout v7

• Upgrades all checkout steps (config, defaults, and target repo) to actions/checkout@v7. Keeps retro workflow aligned with the new checkout major version.

.github/workflows/reusable-retro.yml

reusable-review.ymlUpdate reusable review workflow to checkout v7 +3/-3

Update reusable review workflow to checkout v7

• Moves checkout steps (config repo, upstream defaults, target repo) to actions/checkout@v7. Helps prevent mixed checkout behaviors across reusable pipelines.

.github/workflows/reusable-review.yml

reusable-triage.ymlUpdate reusable triage workflow to checkout v7 +3/-3

Update reusable triage workflow to checkout v7

• Upgrades checkout steps (config repo, upstream defaults, target repo) to actions/checkout@v7. Standardizes the action versions used by triage automation.

.github/workflows/reusable-triage.yml

site-build.ymlUpdate site build workflow to checkout v7 and upload-artifact v7 +2/-2

Update site build workflow to checkout v7 and upload-artifact v7

• Bumps actions/checkout to v7 and actions/upload-artifact to v7. Keeps site bundle publishing compatible with updated GitHub-hosted action runtimes.

.github/workflows/site-build.yml

site-deploy.ymlUpdate site deploy workflow artifacts and scripting actions +4/-4

Update site deploy workflow artifacts and scripting actions

• Upgrades actions/checkout to v7, actions/download-artifact to v8, and actions/github-script to v9. This impacts deployment metadata/preview comment scripting and artifact retrieval on deploy runners.

.github/workflows/site-deploy.yml

stale.ymlBump stale automation action to v10 +1/-1

Bump stale automation action to v10

• Updates actions/stale from v9 to v10. Keeps issue/PR stale automation on a supported major version.

.github/workflows/stale.yml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:23 AM UTC · Completed 11:36 AM UTC
Commit: 9811649 · View workflow run →

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 51 rules

✅ Skills: writing-user-docs, writing-adrs

1. Unpinned write-scope actions 🐞 Bug ⛨ Security

Description

Reusable workflows that run with broad write permissions (e.g., contents: write, `pull-requests:
write) invoke actions via mutable major tags like actions/checkout@v7`, so a tag
retarget/compromise could execute unreviewed code with write-scoped tokens. This PR increases that
exposure by moving from more specific tags (e.g., checkout@v6.0.2) to moving major tags in
multiple workflows.

Code

.github/workflows/reusable-code.yml[56]

+        uses: actions/checkout@v7

Evidence

reusable-code.yml explicitly grants write permissions and then runs actions/checkout@v7 (a
mutable major tag), and the same pattern appears in other reusable workflows like
reusable-fix.yml; these jobs therefore run third-party action code with elevated tokens.

.github/workflows/reusable-code.yml[46-57]
.github/workflows/reusable-fix.yml[58-83]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Several reusable workflows run with broad write permissions but use GitHub Actions by major tag (e.g., `actions/checkout@v7`). Major tags are mutable pointers, so if an upstream tag is moved/compromised, this repo would execute that code with elevated workflow tokens.

## Issue Context
This matters most in reusable workflows that are designed to operate with write privileges (create commits/PRs/issues, etc.).

## Fix Focus Areas
- .github/workflows/reusable-code.yml[43-57]
- .github/workflows/reusable-fix.yml[55-83]
- .github/workflows/reusable-review.yml[42-70]

## What to change
- Replace `uses: <owner>/<repo>@vN` with `uses: <owner>/<repo>@<full_commit_sha>` for the actions upgraded in this PR (at least in the write-permission reusable workflows).
- Optionally add a short comment next to each pin noting the original release tag (e.g., `# v7.?.?`) to preserve readability.
- If you rely on automated updates, configure Dependabot (or Renovate) to keep these SHA pins updated.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/* — All 15 modified files are under .github/ (a protected path). The PR has no linked issue to authorize changes to governance/infrastructure files. The PR body provides clear motivation (Node 20 EOL and upcoming GitHub enforcement deadline), but human approval is always required for protected-path changes. Affected files: branch-cleanup.yml, e2e.yml, lint.yml, pat-cleanup.yml, release.yml, reusable-code.yml, reusable-dispatch.yml, reusable-fix.yml, reusable-prioritize.yml, reusable-retro.yml, reusable-review.yml, reusable-triage.yml, site-build.yml, site-deploy.yml, stale.yml.
  Remediation: Link a tracking issue to provide an audit trail for this dependency update sweep.

Low

• [stale-reference] internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml, repo-maintenance.yml, prioritize-scheduler.yml — Scaffold templates still reference actions/checkout@v6. New repos created from these templates will use the old version while the main repo workflows are bumped to @v7.
  Remediation: Update the scaffold templates to actions/checkout@v7 for consistency, either in this PR or a follow-up.

• [api-contract] .github/workflows/site-build.yml → .github/workflows/site-deploy.yml — upload-artifact is bumped to @v7 but download-artifact is bumped to @v8. These actions form a producer-consumer pair for the site artifact across the build→deploy pipeline. While GitHub documents cross-version compatibility for artifact actions v4+, the asymmetric major version bump should be verified against the v8 changelog.
  Remediation: Verify cross-version compatibility, or align both to the same major version.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/* — All 15 modified files are under .github/ (a protected path). The PR has no linked issue to authorize changes to governance/infrastructure files. The PR body provides clear motivation (Node 20 EOL and upcoming GitHub enforcement deadline), but human approval is always required for protected-path changes. Affected files: branch-cleanup.yml, e2e.yml, lint.yml, pat-cleanup.yml, release.yml, reusable-code.yml, reusable-dispatch.yml, reusable-fix.yml, reusable-prioritize.yml, reusable-retro.yml, reusable-review.yml, reusable-triage.yml, site-build.yml, site-deploy.yml, stale.yml.
  Remediation: Link a tracking issue to provide an audit trail for this dependency update sweep.

Low

• [stale-reference] internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml, repo-maintenance.yml, prioritize-scheduler.yml — Scaffold templates still reference actions/checkout@v6. New repos created from these templates will use the old version while the main repo workflows are bumped to @v7.
  Remediation: Update the scaffold templates to actions/checkout@v7 for consistency, either in this PR or a follow-up.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/* — All 15 modified files are under .github/ (a protected path). The PR has no linked issue to authorize changes to governance/infrastructure files. The PR body provides clear motivation (Node 20 EOL), but human approval is always required for protected-path changes. Affected files: branch-cleanup.yml, e2e.yml, lint.yml, pat-cleanup.yml, release.yml, reusable-code.yml, reusable-dispatch.yml, reusable-fix.yml, reusable-prioritize.yml, reusable-retro.yml, reusable-review.yml, reusable-triage.yml, site-build.yml, site-deploy.yml, stale.yml.
  Remediation: Link a tracking issue to provide an audit trail for this dependency update sweep.

Low

• [stale-reference] internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml, repo-maintenance.yml, prioritize-scheduler.yml — Scaffold templates still reference actions/checkout@v6. New repos created from these templates will use the old version while the main repo workflows use @v7.
  Remediation: Update the scaffold templates to actions/checkout@v7 for consistency.

• [api-contract] .github/workflows/site-build.yml → .github/workflows/site-deploy.yml — upload-artifact is bumped to @v7 but download-artifact is bumped to @v8. These actions are independently versioned and likely cross-compatible, but the version skew across the build→deploy artifact handoff pipeline should be verified against the v8 changelog.
  Remediation: Verify cross-version compatibility, or align both to the same major version.

---

Labels: PR updates GitHub Actions versions across CI workflow files — maintenance chore touching CI dependencies.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/* — All 15 modified files are under .github/ (a protected path). The PR has no linked issue to authorize changes to governance/infrastructure files. The PR body provides clear motivation (Node 20 EOL and upcoming GitHub enforcement deadline), but human approval is always required for protected-path changes. Affected files: branch-cleanup.yml, e2e.yml, lint.yml, pat-cleanup.yml, release.yml, reusable-code.yml, reusable-dispatch.yml, reusable-fix.yml, reusable-prioritize.yml, reusable-retro.yml, reusable-review.yml, reusable-triage.yml, site-build.yml, site-deploy.yml, stale.yml.
  Remediation: Link a tracking issue to provide an audit trail for this dependency update sweep.

Low

• [stale-reference] internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml, repo-maintenance.yml, prioritize-scheduler.yml — Scaffold templates still reference actions/checkout@v6. New repos created from these templates will use the old version while the main repo workflows are bumped to @v7.
  Remediation: Update the scaffold templates to actions/checkout@v7 for consistency, either in this PR or a follow-up.

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/* — All 15 modified files are under .github/ (a protected path). The PR has no linked issue to authorize changes to governance/infrastructure files. The PR body provides clear motivation (Node 20 EOL), but human approval is always required for protected-path changes. Affected files: branch-cleanup.yml, e2e.yml, lint.yml, pat-cleanup.yml, release.yml, reusable-code.yml, reusable-dispatch.yml, reusable-fix.yml, reusable-prioritize.yml, reusable-retro.yml, reusable-review.yml, reusable-triage.yml, site-build.yml, site-deploy.yml, stale.yml.
  Remediation: Link a tracking issue to provide an audit trail for this dependency update sweep.

Low

• [stale-reference] internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml, repo-maintenance.yml, prioritize-scheduler.yml — Scaffold templates still reference actions/checkout@v6. New repos created from these templates will use the old version while the main repo workflows use @v7.
  Remediation: Update the scaffold templates to actions/checkout@v7 for consistency.

• [api-contract] .github/workflows/site-build.yml → .github/workflows/site-deploy.yml — upload-artifact is bumped to @v7 but download-artifact is bumped to @v8. These actions are independently versioned and likely cross-compatible, but the version skew across the build→deploy artifact handoff pipeline should be verified against the v8 changelog.
  Remediation: Verify cross-version compatibility, or align both to the same major version.

---

Labels: PR updates GitHub Actions versions across CI workflow files — maintenance chore touching CI dependencies.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] api-contract

upload-artifact is bumped to @v7 (site-build.yml) but download-artifact is bumped to @v8 (site-deploy.yml). These actions are independently versioned and likely cross-compatible, but the version skew across the build-deploy artifact handoff pipeline should be verified.

Suggested fix: Verify cross-version compatibility, or align both to the same major version.

[github-actions]

Site preview

Preview: https://96b6c465-site.fullsend-ai.workers.dev

Commit: 677b366582b299c81d1b70f311b5e6b0da6930af

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:53 AM UTC · Completed 8:03 AM UTC
Commit: 3e12934 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:59 AM UTC · Completed 12:11 PM UTC
Commit: 677b366 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] api-contract

upload-artifact is bumped to @v7 in site-build.yml but download-artifact is bumped to @v8 in site-deploy.yml. These actions form a producer-consumer pair for the site artifact across the build-deploy pipeline. The asymmetric major version bump should be verified against the v8 changelog.

Suggested fix: Verify cross-version compatibility, or align both to the same major version.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:21 PM UTC · Completed 12:30 PM UTC
Commit: 677b366 · View workflow run →

[fullsend-ai-retro]

Retro: PR #2457 — Update obsolete GitHub Actions

This was a human-authored, purely mechanical PR bumping 15 GitHub Actions workflow files to latest major versions (40 lines changed, all 1:1 version substitutions). The review bot ran 3 times, each time issuing changes_requested — primarily because all 15 files live under .github/ (a protected path), which deterministically forces a non-approval verdict.

Timeline

1. Jun 19 11:19 — PR opened by Victoremepunto
2. Jun 19 11:35 — Review bot run docs: Add agent-compatible code problem document #1: changes_requested (high protected-path, low stale-reference, low api-contract)
3. Jun 22 06:24 — Human approval by rh-hemartin
4. Jun 22 07:50 — PR synchronized → review bot run Add problem areas: Tekton pipeline review, migration path, multi-tenancy #2: same findings, same verdict
5. Jun 22 11:56 — PR synchronized → review bot run docs: Add codebase context problem document and trim CLAUDE.md #3: same findings, same verdict
6. Jun 22 12:16 — PR merged

Findings already covered by existing issues

• Protected-path governance causing guaranteed changes_requested on workflow PRs: covered by Suppress protected-path finding when all changed files are in protected paths #1392 (suppress when all files are protected), Review agent: downgrade protected-path severity for human-authored PRs #1551 (downgrade for human PRs), Review agent should not file CHANGES_REQUESTED for governance-only findings that the fix agent cannot resolve #1068 (don't request changes for governance-only findings)
• Redundant re-reviews on unchanged content: covered by Skip review dispatch when HEAD SHA was already reviewed and approved #963 (skip if SHA already reviewed), Review agent should not re-request changes for unchanged findings #1500 (don't re-request for unchanged findings), Stabilize review verdicts across re-runs on unchanged code #1389 (stabilize verdicts across re-runs), Deduplicate review runs on rapid successive pushes #1418 (deduplicate on rapid pushes)
• Lightweight review path for dependency bumps: covered by Add lightweight review path for trivial bot dependency bumps #1358, Review orchestrator: add fast path for trivial docs/prompt-only changes #1900

These are not re-proposed since they are well-tracked.

Novel finding

The review bot flagged upload-artifact@v7 paired with download-artifact@v8 as a potential API contract / version skew issue. These are independent GitHub Actions with independent versioning — v7 upload is fully compatible with v8 download. This false positive was emitted in 2 of the 3 review cycles. See proposal below.

Proposals filed

• Review agent: don't flag independent GitHub Actions with different major versions as version skew (in fullsend-ai/fullsend)