Update github actions (main) (minor)#3282
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
189d150 to
00265e5
Compare
e12ed77 to
89592ca
Compare
7c8a8ae to
f6505bd
Compare
ReviewFindingsHigh
Previous runReviewVerdict: Approve SummaryThis is an automated dependency update PR from
AnalysisCorrectness: All version bumps are internally consistent — the same SHA is used for each action across every workflow file that references it. No behavioral changes to workflow logic; only Security: All third-party actions remain properly SHA-pinned with version comments. The Intent & coherence: The change is a straightforward automated dependency maintenance update, appropriately scoped to CI workflow files only. No source code, tests, or documentation are affected. Style/conventions: The existing pattern of Documentation: No documentation impact — CI dependency bumps do not affect in-repo docs. No findings at low severity or above.
Previous run (2)ReviewOutcome: approve SummaryThis PR is an automated dependency update from Actions updated:
CorrectnessAll version bumps are consistent: each action reference is updated uniformly across every workflow file where it appears. No workflow steps were added, removed, or reordered. No changes to workflow triggers, permissions, inputs, or outputs. The SHA pins and version comments match across all occurrences. SecuritySix of the seven updated actions use commit SHA pinning with version comments — the recommended practice for supply-chain security. All actions are from well-known, trusted publishers ( One note: Intent & CoherenceThe change is well-scoped and matches its stated purpose. Minor version bumps of CI dependencies are routine maintenance with low risk of breaking changes. Style & ConventionsFollows the existing repository conventions for action pinning (SHA + version comment). DocumentationNo documentation updates needed — CI dependency bumps do not affect in-repo docs.
Previous run (3)Review — Approve ✅PR: Update github actions (main) (minor) SummaryThis is a clean automated dependency update for GitHub Actions across 8 workflow files. All changes are minor version bumps with SHA-pinned references — no workflow logic, permissions, or structure changes. Changes Verified
Dimensions Evaluated
No findings at low severity or above.
Previous run (4)Review — approvePR: #3282 — Update github actions (main) (minor) SummaryClean mechanical dependency version bump across 8 GitHub Actions workflow files. All updates are minor version increments with commit SHA pinning. Actions updated:
Verification
Findings[low] Pre-existing: tag-based pinning for Remediation: Pin to a full 40-character commit SHA: No blocking issues. This is a safe, routine dependency update.
Labels: PR updates CI workflow dependency versions Previous run (5)Review of #3282Verdict: Comment — one pre-existing medium-severity finding surfaced by this diff; no blocking issues with the version bumps themselves. SummaryThis PR is an automated minor dependency update of GitHub Actions across 8 workflow files, generated by
All action references except one use SHA-pinned format ( Findings⚠ Medium: Missing SHA pin on
|
| Action | Old Version | New Version | SHA Verified |
|---|---|---|---|
step-security/harden-runner |
v2.15.1 | v2.20.0 | ✅ |
actions/cache |
v5.0.4 | v5.1.0 | ✅ |
actions/setup-go |
v6.3.0 | v6.5.0 | ✅ |
actions/setup-node |
v6.2.0 | v6.4.0 | ✅ |
github/codeql-action |
v4.32.6 | v4.37.0 | ✅ |
softprops/action-gh-release |
v2 (SHA bump) | v2 (SHA bump) | ✅ |
conforma/pr-size-label-action |
v1.0.0 | v1.2.0 | ✅ (tag) |
All SHA-to-version mappings were independently verified against each action's GitHub repository via the Git refs API.
Consistency check
Every instance of each action across all workflow files is being updated uniformly — no stale references remain.
Findings
Low — conforma/pr-size-label-action uses tag reference instead of SHA pin (label-pr-size.yaml)
The conforma/pr-size-label-action is referenced by mutable tag (v1.2.0) rather than a pinned commit SHA, unlike all other actions in this repository. Tags can be reassigned, which weakens supply chain integrity. This is a pre-existing pattern (was v1.0.0 before this PR) and the action is organization-internal, but pinning to a SHA with a version comment would align with the project's security posture for all other actions.
Remediation: Pin to a specific commit SHA with a version comment, e.g.:
uses: conforma/pr-size-label-action@<commit-sha> # v1.2.0Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.Protected files in this PR:
.github/workflows/checks-codecov.yaml.github/workflows/codeql.yaml.github/workflows/label-pr-size.yaml.github/workflows/lint.yaml.github/workflows/release.yaml.github/workflows/scorecard.yml.github/workflows/update-go-containerregistry.yaml.github/workflows/website.yaml
Previous run (7)
Review — Approve ✅
Scope: Automated GitHub Actions dependency update (minor versions) across 8 CI workflow files.
Changes Verified
| Action | Old Version | New Version | Pin Type |
|---|---|---|---|
step-security/harden-runner |
v2.15.1 | v2.20.0 | SHA ✅ |
actions/cache / cache/restore |
v5.0.4 | v5.1.0 | SHA ✅ |
actions/setup-go |
v6.3.0 | v6.5.0 | SHA ✅ |
actions/setup-node |
v6.2.0 | v6.4.0 | SHA ✅ |
github/codeql-action/* |
v4.32.6 | v4.36.3 | SHA ✅ |
softprops/action-gh-release |
(sha update) | (sha update) | SHA ✅ |
conforma/pr-size-label-action |
v1.0.0 | v1.2.0 | Tag only ⚠ |
Findings
Low: Missing SHA pin on conforma/pr-size-label-action — This action is referenced by mutable tag (@v1.2.0) rather than a commit SHA, unlike all other actions in the repository's workflows. While this is a pre-existing pattern (not introduced by this PR) and the action is from the same organization, adding a SHA pin would be consistent with the repository's supply chain security posture. Consider pinning in a follow-up.
Checks Performed
- Correctness: All SHA pins are internally consistent across the 8 workflow files. Version comments correctly annotate their corresponding commit SHAs. All updates are minor version bumps maintaining backward compatibility.
- Security: SHA pinning is maintained on all actions where it was previously in place. No new unpinned actions introduced. No workflow permission changes. No changes to workflow triggers or secrets handling.
- Intent & coherence: Changes are appropriately scoped to CI dependency updates only. No application code, configuration, or documentation is modified. PR is generated by the Renovate bot (
red-hat-konflux[bot]), consistent with the repository's automated dependency management. - Style/conventions: Consistent with existing workflow formatting and pinning conventions.
- Documentation: No documentation impact — CI-only changes.
- Cross-repo contracts: No API, schema, or interface changes.
Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.Protected files in this PR:
.github/workflows/checks-codecov.yaml.github/workflows/codeql.yaml.github/workflows/label-pr-size.yaml.github/workflows/lint.yaml.github/workflows/release.yaml.github/workflows/scorecard.yml.github/workflows/update-go-containerregistry.yaml.github/workflows/website.yaml
Previous run (8)
Review
Findings
Info
- [protected-path]
.github/workflows/*— All 8 changed files are under.github/(protected path). Authorization for these changes is supported by the repository'srenovate.jsonconfiguration, which explicitly enables automated dependency management viaconforma/.githubshared config. The PR is authored byred-hat-konflux[bot]and labeledrenovate. Human approval is still required for protected-path changes, regardless of automation authorization.
Labels: PR modifies CI workflow files under .github/workflows/
Previous run (9)
Review
Findings
High
- [protected-path]
.github/workflows/— All 8 modified files fall under the.github/protected path. This PR has no linked issue providing authorization for the changes. While the changes are mechanical GitHub Actions version bumps generated by Renovate, human approval is required for all modifications to CI/CD workflow files. Protected-path changes cannot be auto-approved regardless of content.
Remediation: A maintainer should verify the version bumps are expected and approve the PR manually.
Labels: PR updates GitHub Actions workflow dependency versions, matching the github_actions and dependencies label definitions.
Previous run (10)
Review
Findings
High
- [protected-path]
.github/workflows/— All 8 modified files are under the.github/protected path, which requires human approval. This PR has no linked issue and no explicit justification for modifying governance/infrastructure files beyond the automated bot description. Protected files modified:.github/workflows/checks-codecov.yaml,.github/workflows/codeql.yaml,.github/workflows/label-pr-size.yaml,.github/workflows/lint.yaml,.github/workflows/release.yaml,.github/workflows/scorecard.yml,.github/workflows/update-go-containerregistry.yaml,.github/workflows/website.yaml.
Remediation: A human reviewer must explicitly approve changes to protected paths. Consider linking a tracking issue for automated dependency updates that touch CI workflows.
Low
- [supply-chain]
.github/workflows/label-pr-size.yaml:32—conforma/pr-size-label-actionis referenced by mutable tag (v1.2.0) without SHA pinning. This action runs on thepull_request_targettrigger with write permissions to pull-requests and issues. However, this follows the established repository convention: allconforma/org-owned actions are referenced by branch or tag rather than SHA. The risk is mitigated by the action being owned by the same organization. Consider SHA-pinning allconforma/org-owned actions for defense-in-depth as a broader policy decision.
Previous run (11)
Review
Findings
High
- [protected-path]
.github/workflows/*— All 8 files modified in this PR are under the.github/protected path. The PR has no linked issue providing authorization context for modifying governance/infrastructure files. Human approval is required for all protected-path changes. Affected files:checks-codecov.yaml,codeql.yaml,label-pr-size.yaml,lint.yaml,release.yaml,scorecard.yml,update-go-containerregistry.yaml,website.yaml.
Medium
- [action-pinning]
.github/workflows/label-pr-size.yaml:32—conforma/pr-size-label-actionis pinned to a mutable version tag (v1.2.0) rather than an immutable commit SHA. Every other third-party action in this repository (across all 7 other workflow files) is pinned to a full 40-character commit SHA with a version comment. This workflow runs onpull_request_targetwithpull-requests: writeandissues: writepermissions, which increases the impact of a supply chain compromise if the tag is force-pushed.
Remediation: Pin to the commit SHA corresponding to v1.2.0, e.g.:uses: conforma/pr-size-label-action@<full-sha> # v1.2.0
Info
- [sub-agent-failure]
N/A— The style-conventions sub-agent did not return findings: model unavailable on deployment. - [sub-agent-failure]
N/A— The intent-coherence sub-agent did not return findings: model unavailable on deployment.
Previous run (12)
Review
Findings
High
- [protected-path]
.github/workflows/*— All 8 modified files are under.github/, a protected path. This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes regardless of content. Affected files:checks-codecov.yaml,codeql.yaml,label-pr-size.yaml,lint.yaml,release.yaml,scorecard.yml,update-go-containerregistry.yaml,website.yaml.
Low
- [pattern-inconsistency]
.github/workflows/label-pr-size.yaml:32—conforma/pr-size-label-actionis pinned to a mutable tag (@v1.2.0) rather than a commit SHA, unlike every other action reference in this repository. This is a pre-existing pattern (was@v1.0.0), not introduced by this PR. This action runs onpull_request_targetwithpull-requests: writeandissues: writepermissions, making SHA pinning especially important for supply-chain security. See also: security dimension (mutable action reference).
Remediation: Pin to a full commit SHA with a version comment, e.g.,uses: conforma/pr-size-label-action@<commit-sha> # v1.2.0.
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
f6505bd to
9c01ad3
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
9c01ad3 to
102a5b8
Compare
|
🤖 Review · |
102a5b8 to
6da25cf
Compare
|
🤖 Finished Review · ✅ Success · Started 1:54 AM UTC · Completed 2:03 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · |
cc66512 to
4a96d6b
Compare
|
🤖 Finished Review · ✅ Success · Started 2:09 AM UTC · Completed 2:17 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
requires-manual-review
4a96d6b to
81cd764
Compare
fullsend-ai-review
Bot
added
requires-manual-review
|
🤖 Finished Review · ✅ Success · Started 3:34 AM UTC · Completed 3:38 AM UTC |
81cd764 to
c5e45e8
Compare
|
🤖 Finished Review · ✅ Success · Started 3:42 AM UTC · Completed 3:46 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
requires-manual-review
c5e45e8 to
4904a54
Compare
|
🤖 Finished Review · ✅ Success · Started 3:49 AM UTC · Completed 3:53 AM UTC |
fullsend-ai-review
Bot
added
requires-manual-review
4904a54 to
868e42a
Compare
|
🤖 Review · |
868e42a to
4b7aa39
Compare
|
🤖 Review · |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
4b7aa39 to
2f77b4d
Compare
|
🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:24 AM UTC |
fullsend-ai-review
Bot
removed
the
requires-manual-review
This PR contains the following updates:
v5.0.4→v5.1.0v6.0.2→v6.1.0v6.3.0→v6.5.0v6.2.0→v6.5.0v1.0.0→v1.2.0v4.32.6→v4.37.1v4.37.3(+1)a06a81a→3bb1273v2.15.1→v2.20.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
actions/cache (actions/cache)
v5.1.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.1.0
v5.0.5Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.0.5
actions/checkout (actions/checkout)
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
v6.0.3Compare Source
actions/setup-go (actions/setup-go)
v6.5.0Compare Source
What's Changed
Dependency update
New Contributors
Full Changelog: actions/setup-go@v6...v6.5.0
v6.4.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation update
New Contributors
Full Changelog: actions/setup-go@v6...v6.4.0
actions/setup-node (actions/setup-node)
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
v6.4.0Compare Source
What's Changed
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v6...v6.4.0
v6.3.0Compare Source
What's Changed
Enhancements:
devEnginesfield by @susnux in #1283Dependency updates:
Bug fixes:
New Contributors
Full Changelog: actions/setup-node@v6...v6.3.0
conforma/pr-size-label-action (conforma/pr-size-label-action)
v1.2.0Compare Source
What's Changed
Full Changelog: conforma/pr-size-label-action@v1...v1.2.0
v1.1.0Compare Source
Highlights
@actions/corev2 — updated from v1package.jsonsrc/main.jsentrypoint,src/index.jsexportsrun()for testabilitysize:prefix (with trailing space) to avoid collisions.nvmrcandenginesfield addedWhat's Changed
What's Changed
New Contributors
Full Changelog: conforma/pr-size-label-action@v1.0.0...v1.1.0
github/codeql-action (github/codeql-action)
v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@​ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
v4.36.2Compare Source
v4.36.1Compare Source
No user facing changes.
v4.36.0Compare Source
v4.35.5Compare Source
analysis-kindsinput, onlycode-scanningwill be enabled. Theanalysis-kindsinput is experimental, for GitHub-internal use only, and may change without notice at any time. #3892v4.35.4Compare Source
v4.35.3Compare Source
GETrequests instead ofHEADfor better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853v4.35.2Compare Source
CODEQL_ACTION_CLEANUP_TRAP_CACHESenvironment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing thetrap-caching: falseinput to theinitAction. #3795v4.35.1Compare Source
v4.35.0Compare Source
v4.34.1Compare Source
v4.34.0Compare Source
none. We expect this rollout to be complete by the end of April 2026. #3584v4.33.0Compare Source
Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562
To opt out of this change:
github-codeql-file-coverage-on-prsand the type "True/false", then set this property totruein the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set theCODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.CODEQL_ACTION_FILE_COVERAGE_ON_PRSenvironment variable totruein your workflow.Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as
github-codeql-disable-overlaythat was previously only available on GitHub.com. #3559Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570
step-security/harden-runner (step-security/harden-runner)
v2.20.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0
v2.19.4Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4
v2.19.3Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3
v2.19.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2
v2.19.1Compare Source
What's Changed
What the fix changes
ubuntu-slimrunners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.What the fix does not do
ubuntu-slimwill not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored, you can block the use of
ubuntu-slimvia workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.New Contributors
Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1
v2.19.0Compare Source
What's Changed
New Runner Support
Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.
Automated Incident Response for Supply Chain Attacks
Bug Fixes
Windows and macOS: stability and reliability fixes
Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0
v2.18.0Compare Source
What's Changed
Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.
Deploy on Self-Hosted VM: Added
deploy-on-self-hosted-vminput that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0
v2.17.0Compare Source
What's Changed
Policy Store Support
Added
use-policy-storeandapi-keyinputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existingpolicyinput which requiresid-token: writepermission. If no policy is found in the store, the action defaults to audit mode.Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0
v2.16.1Compare Source
What's Changed
Enterprise tier: Added support for direct IP addresses in the allow list
Community tier: Migrated Harden Runner telemetry to a new endpoint
Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1
v2.16.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.