chore(deps): update ferrlabs actions - #218
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
ferrlabs-renovate
Bot
changed the title
324045d to
86cb199
Compare
ferrlabs-renovate
Bot
changed the title
ferrlabs-renovate
Bot
changed the title
86cb199 to
19294c7
Compare
19294c7 to
244bd7a
Compare
244bd7a to
cf1a950
Compare
cf1a950 to
0537d86
Compare
![ferrfleet[bot]](https://avatars.githubusercontent.com/in/4354888?s=60&v=4){kind=small}
There was a problem hiding this comment.
Two digest/version bumps, both uneventful for this repo.
FerrLabs/.github 4215a84→ce6349b: pulls in two upstream fixes — (1) reusable-security-scan.yml now defaults run-on-private: true and adds a scanned gate that fails if every scan job was skipped. security-scan.yml:9 already sets run-on-private: true, and this run's "Scans ran" check is green, so no behavior change here. (2) reusable-ci-go.yml's sonarqube job now requests job-level pull-requests: write so it can comment on PRs.
Nit: that second fix needs the caller to also grant the permission — the reusable workflow's own comment says so explicitly ("l'appelant doit accorder la même permission... sinon il n'y a rien à transmettre"). ci.yml's ci job (which sets enable-sonar: true) has no permissions: block, so nothing is passed down and the SonarQube job's PR-comment step will still fail to get write access. Not a regression from this bump though — before this fix the job had no permission override at all and was capped at contents: read by the reusable workflow's own top-level permissions: block, so it was already broken pre-bump. To actually benefit from the upstream fix, add to .github/workflows/ci.yml:
ci:
name: CI
permissions:
contents: read
pull-requests: write
uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@ce6349be15283fedc44fc17f74555f3b598ebbab # main
FerrLabs/FerrFlow v6.1.1→v6.2.0: adds workspace.releaseCommitBody (opt-in changelog-in-commit feature). No breaking changes, and publish.yml:61 only uses mode: publish, which isn't affected.
CI: gitleaks/osv-scanner/zizmor/opengrep/snyk/"Scans ran"/Conventional commits are all green on this head commit; kind smoke test and the CI (lint/test/build/SonarQube) job hadn't reported yet at review time — no failure signal from the bump so far.
0537d86 to
4e1c1ee
Compare
SonarQube — aucune nouvelle issueComparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail |
4e1c1ee to
3199c25
Compare
3199c25 to
7df811b
Compare
7df811b to
72c1286
Compare
There was a problem hiding this comment.
Follow-up on this rebased head. Two things changed since my last review, both good:
- The Nit I raised (missing
pull-requests: writepassthrough for the SonarQube reusable job) is now fixed —ci.ymlonmainpicked up FerrVault#222 (432a7211), which added thepermissions:block. This PR's rebase carries it, and it's not part of this PR's own diff. FerrLabs/.githubdigest moved further (ce6349b→f14308c) as Renovate kept rebasing while the PR sat open. Checked the intervening commits (#219–#226 on FerrLabs/.github): all self-referential digest bumps and renovate-config/Kellnr changes, nothing touchingreusable-ci-go.yml,reusable-ferrflow-release.yml,reusable-renovate-dispatch.yml,reusable-sbom-track.yml, orreusable-security-scan.yml. No new behavior for this repo.
FerrFlow bump (v6.1.1→v6.2.0) is unchanged from before: adds opt-in workspace.releaseCommitBody, not used by publish.yml:61 (mode: publish only).
CI was still pending/in-progress at review time (no failures observed); scan jobs (gitleaks/osv-scanner/zizmor/snyk) are green as before. No blocking findings.
72c1286 to
801d831
Compare
801d831 to
61cc358
Compare
61cc358 to
7470b3d
Compare
| pull-requests: write | ||
| name: CI | ||
| uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@8a2ad76ab0c58f42b46890618145fde58268072e # main |
| jobs: | ||
| dispatch: | ||
| uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@a4b4a70d116127cd49f09ad6f363ac55fd8f6501 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@8a2ad76ab0c58f42b46890618145fde58268072e # main |
| sbom: | ||
| name: SBOM → Dependency-Track | ||
| uses: FerrLabs/.github/.github/workflows/reusable-sbom-track.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-sbom-track.yml@8a2ad76ab0c58f42b46890618145fde58268072e # main |
| scan: | ||
| name: Secrets + CVE | ||
| uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@8a2ad76ab0c58f42b46890618145fde58268072e # main |
1 participant
This PR contains the following updates:
4215a84→8a2ad76v6.1.1→v6.2.0Release Notes
FerrLabs/FerrFlow (FerrLabs/FerrFlow)
v6.2.0Compare Source
[6.2.0] - 2026-08-09
Features
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.