chore(deps): Update GitHub Actions#57
Conversation
|
Warning Review limit reached
More reviews will be available in 20 minutes and 31 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR updates GitHub Actions workflow dependencies across 18 files. The primary change pins 16 ByronWilliamsCPA/.github reusable workflows to a new commit SHA, alongside bumping the CodeQL action to v4.36.0 and updating the Redis container image digest. ChangesGitHub Actions Workflow Dependencies Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency ReviewThe following issues were found:
License Issues.github/workflows/pr-validation.yml
.github/workflows/sbom.yml
.github/workflows/sonarcloud.yml
OpenSSF Scorecard
Scanned Files
|
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
There was a problem hiding this comment.
Pull request overview
Renovate dependency update bumping pinned SHAs for the shared ByronWilliamsCPA/.github reusable workflows, github/codeql-action (v4.35.5 → v4.36.0), and the redis:8-alpine service image digest used by Postman API tests.
Changes:
- Update all reusable workflow references from SHA
961eb17toe75a86bacross 15 workflow files. - Bump
github/codeql-action/initandanalyzefrom v4.35.5 to v4.36.0 (new SHA7211b7c). - Update
redis:8-alpineimage digest inpostman-api-tests.yml.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/ci.yml | Bump reusable python-ci.yml SHA |
| .github/workflows/codecov.yml | Bump reusable python-codecov.yml SHA |
| .github/workflows/codeql.yml | Upgrade codeql-action init/analyze to v4.36.0 |
| .github/workflows/container-security.yml | Bump reusable python-container-security.yml SHA |
| .github/workflows/coverage.yml | Bump reusable python-qlty-coverage.yml SHA |
| .github/workflows/docs.yml | Bump reusable python-docs.yml SHA |
| .github/workflows/mutation-testing.yml | Bump reusable python-mutation.yml SHA |
| .github/workflows/performance-regression.yml | Bump reusable python-performance-regression.yml SHA |
| .github/workflows/postman-api-tests.yml | Update redis:8-alpine image digest |
| .github/workflows/pr-validation.yml | Bump reusable python-ci.yml SHA |
| .github/workflows/publish-pypi.yml | Bump reusable python-publish-pypi.yml SHA |
| .github/workflows/python-compatibility.yml | Bump reusable python-compatibility.yml SHA |
| .github/workflows/qlty.yml | Bump reusable python-qlty-coverage.yml SHA |
| .github/workflows/release.yml | Bump reusable python-release.yml SHA |
| .github/workflows/sbom.yml | Bump reusable python-sbom.yml SHA |
| .github/workflows/scorecard.yml | Bump reusable python-scorecard.yml SHA |
| .github/workflows/security-analysis.yml | Bump reusable python-security-analysis.yml SHA |
| .github/workflows/sonarcloud.yml | Bump reusable python-sonarcloud.yml SHA |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
williaby
force-pushed
the
renovate/github-actions
branch
from
3dbb217 to
d8c2198
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
williaby
force-pushed
the
renovate/github-actions
branch
from
d8c2198 to
7fa8326
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
|
@copilot resolve the merge conflicts in this pull request |
Head branch was pushed to by a user without write access
Merge conflicts resolved in commit |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/postman-api-tests.yml (1)
65-67:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd
persist-credentials: falseto checkout step.
actions/checkoutcurrently persists the token in local git config on the runner. Explicitly disable persistence for hardening.🔧 Suggested fix
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: falseBased on learnings: In all GitHub Actions workflow YAML files under .github/workflows, ensure every
actions/checkoutstep includespersist-credentials: false.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/postman-api-tests.yml around lines 65 - 67, The checkout step currently uses actions/checkout@... without disabling token persistence; update the checkout step that uses "actions/checkout" to include persist-credentials: false so the runner does not write the GITHUB_TOKEN into local git config (locate the checkout step with the "uses: actions/checkout" entry and add the persist-credentials: false key under that step)..github/workflows/performance-regression.yml (1)
61-63:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd
persist-credentials: falseto theactions/checkoutstepIn
.github/workflows/performance-regression.yml, theCheckout repositorystep (actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) lackswith: persist-credentials: false, so the token can be persisted in the runner’s git config.🔒 Proposed fix
- name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/performance-regression.yml around lines 61 - 63, The checkout step using actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly disable token persistence; update the "Checkout repository" step to add a with: block that sets persist-credentials: false so the runner does not write the GITHUB_TOKEN into git config (locate the step named "Checkout repository" that references actions/checkout@de0fac2e... and add the with:persist-credentials: false entry).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/performance-regression.yml:
- Around line 61-63: The checkout step using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd should explicitly
disable token persistence; update the "Checkout repository" step to add a with:
block that sets persist-credentials: false so the runner does not write the
GITHUB_TOKEN into git config (locate the step named "Checkout repository" that
references actions/checkout@de0fac2e... and add the with:persist-credentials:
false entry).
In @.github/workflows/postman-api-tests.yml:
- Around line 65-67: The checkout step currently uses actions/checkout@...
without disabling token persistence; update the checkout step that uses
"actions/checkout" to include persist-credentials: false so the runner does not
write the GITHUB_TOKEN into local git config (locate the checkout step with the
"uses: actions/checkout" entry and add the persist-credentials: false key under
that step).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1cb70355-0183-49ca-9d79-9b8f28d361ad
📒 Files selected for processing (18)
.github/workflows/ci.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/container-security.yml.github/workflows/coverage.yml.github/workflows/docs.yml.github/workflows/mutation-testing.yml.github/workflows/performance-regression.yml.github/workflows/postman-api-tests.yml.github/workflows/pr-validation.yml.github/workflows/publish-pypi.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release.yml.github/workflows/sbom.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/sonarcloud.yml
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
The org python-sbom.yml at 74c633a used `--sbom=sbom-runtime.json` against osv-scanner-action v2.3.8, which now requires the SBOM filename to encode the format in the extension (e.g. .cdx.json). This caused exit code 127 at parse time. Points sbom.yml at e070932 which renames the artifact to sbom-runtime.cdx.json throughout and migrates the deprecated --sbom flag to -L. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
961eb17→74c633av4.35.5→v4.36.0d146f83→0916059Impact
Acceptance Criteria
Testing
Notes
Release Notes
github/codeql-action (github/codeql-action)
v4.36.0Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
Summary by CodeRabbit