🚨 Update github actions (main) (major)#3132
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
e38a026 to
df58afe
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
16f9391 to
31eb2bc
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
042a0f4 to
ddedbe9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
7 times, most recently
from
31ca854 to
e7d8189
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
e2a726f to
1182541
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
1182541 to
9c7fcb9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
9affe55 to
837e0b3
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
85b64e5 to
ee9b6d9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
baaf71f to
2dca731
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
2dca731 to
ee64288
Compare
ReviewFindingsHigh
Info
Previous runReviewFindingsHigh
Medium
Low
Info
Previous run (2)ReviewFindingsHigh
Medium
Low
Info
Previous run (3)ReviewFindingsHigh
Medium
Low
Info
Previous run (4)ReviewFindingsHigh
Medium
Low
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| id: generate-token | ||
| with: | ||
| app-id: ${{ vars.EC_AUTOMATION_APP_ID }} |
There was a problem hiding this comment.
[low] api-contract
actions/create-github-app-token v3.1.0 deprecated the app-id input in favor of client-id. The workflow still uses app-id. While deprecated inputs typically continue to work, this should be migrated to avoid future breakage.
Suggested fix: Replace app-id with client-id in the create-github-app-token step.
|
|
||
| - name: Upload test coverage artifacts | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
[low] api-contract
upload-artifact v6 to v7 and download-artifact v7 to v8 are both major bumps used cross-job. Confirm in release notes that upload v7 artifacts can be downloaded by download v8.
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
ee64288 to
ea04860
Compare
|
🤖 Finished Review · ✅ Success · Started 9:18 PM UTC · Completed 9:27 PM UTC |
| GOPRIVATE: github.com/conforma/go-containerregistry | ||
|
|
||
| - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 | ||
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 |
There was a problem hiding this comment.
[high] privilege-escalation
The bump from actions/create-github-app-token v2 to v3 introduces a breaking change in default token scoping. In v2, omitting the repositories input scoped the token to the current repository. In v3, omitting repositories (when owner is also omitted) may grant the token access to ALL repositories where the GitHub App is installed. The workflow does not specify repositories or owner, so the token generated for the peter-evans/create-pull-request step could have broader repository access than intended, violating least-privilege.
Suggested fix: Explicitly add repositories: ${{ github.event.repository.name }} to the actions/create-github-app-token step to preserve the v2 behavior of scoping the token to only the current repository.
|
|
||
| - name: Upload unit test coverage report | ||
| uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 | ||
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 |
There was a problem hiding this comment.
[medium] api-contract
codecov/codecov-action is bumped from v5.5.4 to v7.0.0, skipping v6 entirely. The disable_search input parameter is used in all four codecov upload steps. If disable_search is no longer supported in v7, Codecov may silently search for and upload unintended coverage files instead of using only the explicitly specified files. Additionally, skipping a major version makes incremental change auditing harder, particularly relevant given codecov's prior supply-chain compromise history.
Suggested fix: Verify that disable_search: true is still a supported input in codecov/codecov-action v7.0.0 by checking the action's v7 action.yml. Review the v6 and v7 changelogs for changes in secret handling or upload behavior.
| @@ -202,7 +202,7 @@ jobs: | |||
| git push -f --tags | |||
|
|
|||
| - name: Rolling release | |||
There was a problem hiding this comment.
[low] api-contract
softprops/action-gh-release is bumped from v2 to v3. The make_latest parameter is used in both the rolling release and versioned release steps. If v3 changed this input's type or semantics, release behavior could be affected.
Suggested fix: Verify that softprops/action-gh-release v3 still supports the make_latest input with the same semantics.
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
ea04860 to
353b744
Compare
|
🤖 Finished Review · ✅ Success · Started 5:54 PM UTC · Completed 6:05 PM UTC |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | ||
| env: | ||
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | ||
| with: |
There was a problem hiding this comment.
[medium] api-contract
The codecov/codecov-action is being bumped from v5.5.4 to v7.0.0, skipping major version v6. The disable_search input parameter is used in all four codecov upload steps. If this parameter was renamed or removed in v7, the action would silently ignore the unknown input, causing codecov to search for coverage files instead of using only the explicitly specified file. This could lead to incorrect or duplicate coverage reporting.
Suggested fix: Verify that disable_search is still a valid input for codecov/codecov-action v7.0.0 by checking the action's action.yml at commit fb8b3582c8e4def4969c97caa2f19720cb33a72f. If renamed, update all four usages in the Upload job.
|
|
||
| - name: Upload test coverage artifacts | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
[low] api-contract
upload-artifact is bumped from v6 to v7 and download-artifact from v7 to v8. These actions share artifacts between the Test/Acceptance jobs and the Upload job within the same workflow run. Cross-major-version artifact compatibility should be verified.
Suggested fix: Confirm that upload-artifact v7 and download-artifact v8 are backend-compatible by checking the respective release notes.
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
353b744 to
f507ca0
Compare
|
🤖 Finished Review · ✅ Success · Started 5:14 PM UTC · Completed 5:24 PM UTC |
| uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 | ||
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | ||
| env: | ||
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} |
There was a problem hiding this comment.
[medium] api-contract
codecov/codecov-action is bumped from v5.5.4 to v7.0.0, skipping v6 entirely. The workflow passes CODECOV_TOKEN via the env block (not with: token:) and uses disable_search: true across four codecov steps. These inputs and the env-based token approach may have changed in v7.
Suggested fix: Verify that codecov/codecov-action v7.0.0 still supports the disable_search input and env-based CODECOV_TOKEN. If either was removed or renamed, update accordingly.
|
|
||
| - name: Upload test coverage artifacts | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
[low] api-contract
upload-artifact is bumped from v6 to v7 while download-artifact is bumped from v7 to v8 in the same workflow pipeline. Both use the v2 artifact backend and are expected to be compatible, but the cross-major-version pairing is worth a quick verification.
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
f507ca0 to
3568a6c
Compare
|
🤖 Finished Review · ✅ Success · Started 6:44 PM UTC · Completed 6:53 PM UTC |
| GOPRIVATE: github.com/conforma/go-containerregistry | ||
|
|
||
| - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 | ||
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 |
There was a problem hiding this comment.
[info] secret-exposure
actions/create-github-app-token is bumped from v2.2.2 to v3.2.0. This action receives the EC_AUTOMATION_KEY private key secret. The usage pattern is unchanged. Verify the v3 changelog does not alter how the private key is handled or logged.
This PR contains the following updates:
v5.0.4→v6.0.0v6.0.2→v7.0.0v5.0.0→v6.0.0v2.2.2→v3.2.0v4.0.5→v5.0.0v7.0.0→v8.0.1v6.0.0→v7.0.1v4.0.0→v5.0.0v5.5.4→v7.0.0v3.7.0→v4.1.0v2→v3Release Notes
actions/cache (actions/cache)
v6.0.0Compare Source
What's Changed
Full Changelog: actions/cache@v5...v6.0.0
v6Compare Source
v5.0.5Compare Source
What's Changed
Full Changelog: actions/cache@v5...v5.0.5
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
v6.0.3Compare Source
actions/configure-pages (actions/configure-pages)
v6.0.0Compare Source
Changelog
See details of all code changes since previous release.
v6Compare Source
actions/create-github-app-token (actions/create-github-app-token)
v3.2.0Compare Source
Features
repositoriesinput (#372) (85eb8dd)Bug Fixes
v3.1.1Compare Source
Bug Fixes
v3.1.0Compare Source
Bug Fixes
Features
client-idinput and deprecateapp-id(#353) (e6bd4e6)v3.0.0Compare Source
NODE_USE_ENV_PROXYfor proxy support (#342) (4451bcb)Bug Fixes
BREAKING CHANGES
v3Compare Source
actions/deploy-pages (actions/deploy-pages)
v5.0.0Compare Source
Changelog
See details of all code changes since previous release.
v5Compare Source
actions/download-artifact (actions/download-artifact)
v8.0.1Compare Source
What's Changed
Full Changelog: actions/download-artifact@v8...v8.0.1
v8.0.0Compare Source
v8 - What's new
Direct downloads
To support direct uploads in
actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks theContent-Typeheader ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the newskip-decompressparameter totrue.Enforced checks (breaking)
A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the
digest-mismatchparameter. To be secure by default, we are now defaulting the behavior toerrorwhich will fail the workflow run.ESM
To support new versions of the @actions/* packages, we've upgraded the package to ESM.
What's Changed
errorby @danwkennedy in #461Full Changelog: actions/download-artifact@v7...v8.0.0
v8Compare Source
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v7Compare Source
actions/upload-pages-artifact (actions/upload-pages-artifact)
v5.0.0Compare Source
Changelog
include-hidden-filesinput @jonchurch (#137)See details of all code changes since previous release.
v5Compare Source
codecov/codecov-action (codecov/codecov-action)
v7.0.0Compare Source
codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0
v7Compare Source
v6.0.2Compare Source
This is a copy of the
v7.0.0release to make updates easierWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2
v6.0.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1
v6.0.0Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0
v6Compare Source
v5.5.5Compare Source
This release only contains the keybase.io change as described here.
Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5
docker/setup-qemu-action (docker/setup-qemu-action)
v4.1.0Compare Source
resetinput to uninstall current emulators by @crazy-max in #21Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0
v4.0.0Compare Source
Full Changelog: docker/setup-qemu-action@v3.7.0...v4.0.0
v4Compare Source
softprops/action-gh-release (softprops/action-gh-release)
v3.0.1Compare Source
3.0.1
v3.0.0Compare Source
3.0.0is a major release that moves the action runtime from Node 20 to Node 24.Use
v3on GitHub-hosted runners and self-hosted fleets that already support theNode 24 Actions runtime. If you still need the last Node 20-compatible line, stay on
v2.6.2.What's Changed
Other Changes 🔄
@types/nodeto the Node 24 line and allow future Dependabot updatesv3;v2remains pinned to the latest2.xreleasev3Compare Source
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.