chore(deps): update github workflows - #6733
Conversation
Codecov Results 📊✅ 112448 passed | ⏭️ 6759 skipped | Total: 119207 | Pass Rate: 94.33% | Execution Time: 416m 36s 📊 Comparison with Base Branch
✨ No test changes detected All tests are passing successfully. ✅ Patch coverage is 100.00%. Project has 2487 uncovered lines. Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 90.19% 90.19% —%
==========================================
Files 193 193 —
Lines 25361 25361 —
Branches 9302 9302 —
==========================================
+ Hits 22874 22874 —
- Misses 2487 2487 —
- Partials 1434 1433 -1Generated by Codecov Action |
f723b07 to
ab7796a
Compare
4ff0133 to
ae76386
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
64fb4a7 to
f8ebb7b
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
6bc2f74 to
1dcbc62
Compare
1dcbc62 to
58362ff
Compare
347bca1 to
3f9c730
Compare
c39c69d to
f67fb98
Compare
1a1b6cf to
d88586b
Compare
d88586b to
b59bcb4
Compare
| enable-cache: false | ||
| - name: Install Java | ||
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 | ||
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 |
There was a problem hiding this comment.
Invalid setup-java action digest
High Severity
The pinned actions/setup-java digest b6effb05e454b25005698d916606bdc6ffcbf961 does not match the digest this PR documents (03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) and does not resolve to a known commit on actions/setup-java. Jobs that install Java via this pin, including the tasks integration workflow, will fail when GitHub Actions cannot fetch the action.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.
b59bcb4 to
7202e2b
Compare
7202e2b to
f82506c
Compare
f82506c to
b924259
Compare
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 |
There was a problem hiding this comment.
Template drift reverts codecov action bump
Medium Severity
.github/workflows/test.yml is auto-generated from test_orchestrator.jinja, and the getsentry/codecov-action digest was bumped only in the generated file. The template still pins the previous digest, so the next run of scripts/generate-test-files.sh (triggered weekly by update-tox.yml) will silently revert this update while other pins stay current.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b924259. Configure here.
b924259 to
2343487
Compare
477df02 to
69ed102
Compare
69ed102 to
c2f07fb
Compare
c2f07fb to
2db6b40
Compare
2db6b40 to
9d5f943
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9d5f943. Configure here.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0 |
There was a problem hiding this comment.
Invalid setup-uv action pin
High Severity
astral-sh/setup-uv is pinned to ae62891… labeled # v10.0.0, but no such release or commit exists. The PR targets v9.0.0, whose digest is c771a70…. This invalid pin is repeated across CI workflows and templates, so jobs that install uv fail when resolving the action.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 9d5f943. Configure here.
| container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }} | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
actions/checkout updated to non-existent major version v7.0.1
The pinned actions/checkout commit claims v7.0.1, a version that does not exist in the official repository, indicating a likely supply-chain compromise or bot misconfiguration that will break all affected CI workflows.
Evidence
- The diff adds
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1at line 27. actions/checkouthas no public v6 or v7 release; the latest major version in the canonical repository is v4.- The same non-existent v7 label is applied to
actions/setup-nodeandactions/upload-artifactacross every changed workflow file, which points to a systemic compromise or Renovate misconfiguration rather than a one-off typo.
Also found at 2 additional locations
.github/workflows/test-integrations-ai.yml:25.github/workflows/test-integrations-network.yml:26
Identified by Warden · code-review · 8FW-FWB
| container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }} | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
astral-sh/setup-uv version comment may be incorrect and SHA unverified
The workflow pins astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d with comment # v10.0.0. This version annotation has not been verified in-repo, and the same SHA is propagated from Jinja templates to many generated workflow files. Because this action installs tooling with workflow privileges, verify that the pinned SHA corresponds to an official, trusted release before approving.
Evidence
scripts/split_tox_gh_actions/templates/test_group.jinja:77andscripts/split_tox_gh_actions/templates/test_orchestrator.jinja:57both hardcode the sameastral-sh/setup-uvSHA and comment.- These templates generate workflow files including
.github/workflows/test-integrations-ai.yml:29,.github/workflows/ci.yml:27, and at least 15 other workflow files. - No in-repo lockfile, checksum, or release verification exists for this SHA.
- The
# v10.0.0comment is the only visible provenance for the pin; GitHub Actions executes the commit that the SHA points to regardless of the comment accuracy.
Identified by Warden · code-review · UCF-9ZY
| container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }} | ||
| steps: | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
actions/checkout version comment falsely claims non-existent v7.0.1
The comment # v7.0.1 does not match any official actions/checkout release, which undermines auditability of the pinned dependency.
Evidence
- GitHub's official
actions/checkoutrepository has not published a v7.x release; the latest major release is v4.x. - The previous replacement in this same line also claimed a non-existent version (
# v6.0.3), showing a systemic error in the versioning metadata. actions/upload-artifactin the same file is similarly tagged with# v7.0.1even though that official action has also not reached v7.- Because these workflows rely on pinned commit hashes for supply-chain security, an incorrect version comment makes it impossible to quickly verify at merge time whether the intended secure version is actually being used.
Also found at 1 additional location
scripts/split_tox_gh_actions/templates/test_orchestrator.jinja:53-55
Identified by Warden · find-bugs · NBK-E68
This PR contains the following updates:
v6.0.3→v7.0.1v6.0.3→v7.0.1be666c2→b6effb0be666c2→b6effb0v6.4.0→v7.0.0v6→v7v1.0.142→v1.0.191v8.2.0→v10.0.0v8.2.0→v10.0.048236a7→d0aa91bd90e69c→66554aav2.26.9→2.30.16143e76→cd1e82917-alpine→18-alpine17-alpine→18-alpine20→24Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v7Compare Source
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
v7Compare Source
anthropics/claude-code-action (anthropics/claude-code-action)
v1.0.191Compare Source
v1.0.190Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.190
v1.0.189Compare Source
v1.0.188Compare Source
v1.0.187Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.187
v1.0.186Compare Source
v1.0.185Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.185
v1.0.184Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.184
v1.0.183Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.183
v1.0.182Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.182
v1.0.181Compare Source
v1.0.180Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.180
v1.0.179Compare Source
v1.0.178Compare Source
v1.0.177Compare Source
v1.0.176Compare Source
v1.0.175Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.175
v1.0.174Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.174
v1.0.173Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.173
v1.0.172Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.172
v1.0.171Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.171
v1.0.170Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.170
v1.0.169Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.169
v1.0.168Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.168
v1.0.167Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.167
v1.0.166Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.166
v1.0.165Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.165
v1.0.164Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.164
v1.0.163Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.163
v1.0.162Compare Source
v1.0.161Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.161
v1.0.160Compare Source
v1.0.159Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.159
v1.0.158Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.158
v1.0.157Compare Source
v1.0.156Compare Source
v1.0.155Compare Source
v1.0.154Compare Source
v1.0.153Compare Source
v1.0.152Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.152
v1.0.151Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.151
v1.0.150Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.150
v1.0.149Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.149
v1.0.148Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.148
v1.0.147Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.147
v1.0.146Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.146
v1.0.145Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.145
v1.0.144Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.144
v1.0.143Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.143
astral-sh/setup-uv (astral-sh/setup-uv)
v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL featuresCompare Source
Changes
Another breaking release, directly after v9.0.0 but we think the added security justifies that.
Extra security by default
If you use the default
enable-cache: autothis will now DISABLE THE CACHE to protect against cache poisoning for the following events:pull_request_targetworkflow_runreleaseYou can read the full reasoning in #984
version: latest-knownThis will now install the latest version with a checksum that is known by this action. The known
uvchecksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.Read python version from
.tool-versionsWill now also set the python version if it is defined in
.tool-versions. You can read the details in the docs🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v9.0.0Compare Source
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
getsentry/craft (getsentry/craft)
v2.30.1Compare Source
Bug Fixes 🐛
v2.30.0Compare Source
New Features ✨
v2.29.0Compare Source
New Features ✨
Bug Fixes 🐛
Documentation 📚
v2.28.0Compare Source
New Features ✨
v2.27.2Compare Source
Bug Fixes 🐛
v2.27.1Compare Source
Bug Fixes 🐛
v2.27.0Compare Source
New Features ✨
Bug Fixes 🐛
Documentation 📚
Internal Changes 🔧
Deps Dev
Other
v2.26.14Compare Source
Bug Fixes 🐛
Deps
v2.26.13Compare Source
Internal Changes 🔧
v2.26.12Compare Source
Bug Fixes 🐛
v2.26.11Compare Source
Bug Fixes 🐛
Internal Changes 🔧
v2.26.10Compare Source
Bug Fixes 🐛
actions/node-versions (node)
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
v24.0.0: 24.0.0Compare Source
Node.js 24.0.0
v22.23.2: 22.23.2Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2[Compare Source](https://redirect.gi
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.