chore(deps): Update GitHub Actions - #286
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis change updates reusable Python workflow pins from v7.0.25 to v7.1.7, replaces SonarCloud action commit SHAs, and updates the GitHub release action from v3.0.1 to v3.0.2. Existing workflow inputs, permissions, and scan or release configuration remain unchanged. ChangesWorkflow dependency pin updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Description checkExplanation The description clearly explains the dependency updates, impact, release notes, testing status, and Renovate configuration. It does not use the repository template headings and leaves issue, checklist, and test-detail fields incomplete, but the description is substantially complete and relevant. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
7547ad2 to
4877c10
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/python-release.yml (1)
523-523: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoffReduce duplicated third-party release-action usage.
Both workflows can use the runner-provided GitHub CLI instead of
softprops/action-gh-release, reducing dependency and pin-maintenance overhead.
.github/workflows/python-release.yml#L523-L523: replace the action step with an equivalentgh release createscript.workflow-templates/python-release.yml#L218-L218: apply the same replacement in the release template.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/python-release.yml at line 523, Replace the softprops/action-gh-release step at .github/workflows/python-release.yml:523 and workflow-templates/python-release.yml:218 with equivalent script steps invoking the runner-provided gh release create command. Preserve each workflow’s existing release tag, name, body, draft/prerelease settings, and uploaded assets, and ensure the GitHub token environment/permissions remain available in both locations.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/python-release.yml:
- Line 523: Replace the softprops/action-gh-release step at
.github/workflows/python-release.yml:523 and
workflow-templates/python-release.yml:218 with equivalent script steps invoking
the runner-provided gh release create command. Preserve each workflow’s existing
release tag, name, body, draft/prerelease settings, and uploaded assets, and
ensure the GitHub token environment/permissions remain available in both
locations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e1a1c7ed-91e5-44b9-8227-7c3dbed5c369
📒 Files selected for processing (15)
.github/workflows/python-release.yml.github/workflows/python-sonarcloud.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/sonarcloud.ymlworkflow-templates/python-compatibility.ymlworkflow-templates/python-container-security.ymlworkflow-templates/python-fips-compatibility.ymlworkflow-templates/python-mutation.ymlworkflow-templates/python-pr-validation.ymlworkflow-templates/python-release.ymlworkflow-templates/python-reuse.ymlworkflow-templates/python-sbom.ymlworkflow-templates/python-scorecard.ymlworkflow-templates/python-sonarcloud.yml
🚧 Files skipped from review as they are similar to previous changes (11)
- workflow-templates/python-fips-compatibility.yml
- workflow-templates/python-sbom.yml
- workflow-templates/python-compatibility.yml
- workflow-templates/python-pr-validation.yml
- .github/workflows/sonarcloud.yml
- .github/workflows/python-sonarcloud.yml
- .github/workflows/security-analysis.yml
- workflow-templates/python-reuse.yml
- .github/workflows/scorecard.yml
- workflow-templates/python-scorecard.yml
- workflow-templates/python-sonarcloud.yml
e39f0f7 to
c2122be
Compare
c0931d7 to
b5976e5
Compare
ef72c2f to
713f2c9
Compare
There was a problem hiding this comment.
🟢 Ready to approve
Changes are limited to SHA-pin updates for GitHub Actions and internal reusable workflow refs, with no functional logic modifications identified in the diffs.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates SHA-pinned GitHub Actions and internal reusable workflow references in this repository’s workflow library and self-test workflows, aligning with scheduled patch and security maintenance.
Changes:
- Bump
actions/checkoutpins across templates and workflows. - Bump
github/codeql-actionpins (includingupload-sarif) and SonarSource scan action pins where used. - Update pinned refs for internal reusable workflows (
ByronWilliamsCPA/.github) plus a handful of other actions (Scorecard, PyPI publish, GitHub Release, Docker login, Claude Code action).
File summaries
| File | Description |
|---|---|
| workflow-templates/python-sonarcloud.yml | Updates pinned actions/checkout and SonarSource scan action SHAs. |
| workflow-templates/python-slsa.yml | Updates pinned actions/checkout SHA. |
| workflow-templates/python-security-analysis.yml | Updates pinned actions/checkout and CodeQL action SHAs. |
| workflow-templates/python-scorecard.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-sbom.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-reuse.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-release.yml | Updates pinned actions/checkout and softprops/action-gh-release SHAs. |
| workflow-templates/python-publish-pypi.yml | Updates pinned actions/checkout and pypa/gh-action-pypi-publish SHAs. |
| workflow-templates/python-pr-validation.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-mutation.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-fips-compatibility.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-docs.yml | Updates pinned actions/checkout SHA in template jobs. |
| workflow-templates/python-container-security.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-compatibility.yml | Updates internal reusable workflow ref to v7.1.12. |
| workflow-templates/python-cifuzzy.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| workflow-templates/python-ci.yml | Updates pinned actions/checkout SHA across jobs. |
| .github/workflows/supply-chain-promote-core.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| .github/workflows/supply-chain-consume-verify.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/supply-chain-build-verify.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/sonarcloud.yml | Updates pinned actions/checkout and SonarSource scan action SHAs. |
| .github/workflows/shell-tests.yml | Updates pinned actions/checkout SHA in shell test jobs. |
| .github/workflows/self-test.yml | Updates pinned actions/checkout SHA across self-test jobs. |
| .github/workflows/security-analysis.yml | Updates internal reusable workflow ref to v7.1.12. |
| .github/workflows/scorecard.yml | Updates internal reusable workflow ref to v7.1.12. |
| .github/workflows/reuse.yml | Updates pinned actions/checkout SHA across reuse jobs. |
| .github/workflows/release-tag.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-supplemental-checks.yml | Updates pinned actions/checkout SHA across jobs. |
| .github/workflows/python-sonarcloud.yml | Updates pinned actions/checkout and SonarSource scan action SHAs. |
| .github/workflows/python-snyk.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| .github/workflows/python-snyk-iac.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| .github/workflows/python-security-analysis.yml | Updates pinned actions/checkout and CodeQL action SHAs. |
| .github/workflows/python-scorecard.yml | Updates pinned actions/checkout, ossf/scorecard-action, and upload-sarif SHAs. |
| .github/workflows/python-sbom.yml | Updates pinned actions/checkout and upload-sarif SHAs across SBOM jobs. |
| .github/workflows/python-reuse.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-release.yml | Updates pinned actions/checkout, sigstore action, and action-gh-release SHAs. |
| .github/workflows/python-qlty-gate.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-publish-pypi.yml | Updates pinned actions/checkout and pypa/gh-action-pypi-publish SHAs. |
| .github/workflows/python-precommit.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-performance-regression.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-mutation.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-fuzzing.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| .github/workflows/python-fips-compatibility.yml | Updates pinned actions/checkout SHA across jobs. |
| .github/workflows/python-docs.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-docker.yml | Updates pinned actions/checkout, docker/login-action, and upload-sarif SHAs. |
| .github/workflows/python-dependency-provenance.yml | Updates pinned actions/checkout SHA across provenance jobs. |
| .github/workflows/python-container-security.yml | Updates pinned actions/checkout and upload-sarif SHAs. |
| .github/workflows/python-compatibility.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/python-ci.yml | Updates pinned actions/checkout SHA across CI jobs. |
| .github/workflows/pre-commit.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/docs-deploy.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/dependency-review.yml | Updates pinned actions/checkout SHA. |
| .github/workflows/codeql.yml | Updates pinned actions/checkout and CodeQL action SHAs. |
| .github/workflows/claude-baseline-review.yml | Updates pinned actions/checkout and anthropics/claude-code-action SHAs. |
Review details
- Files reviewed: 53/53 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
713f2c9 to
42cfbb5
Compare
There was a problem hiding this comment.
🟡 Not ready to approve
The pinned docker/login-action version in .github/workflows/python-docker.yml is inconsistent with the version stated in the PR description, so the intended dependency bump needs to be reconciled.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (2)
.github/workflows/python-docker.yml:275
- Same mismatch as above: this second docker/login-action pin is annotated as v4.6.0, while the PR description states the update is only to v4.5.2 (v4.6.0 pending). Please align the workflow pins and the PR description/version annotations.
- name: Login to Container Registry
if: steps.push-check.outputs.push == 'true'
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
.github/workflows/python-docker.yml:204
- PR description lists docker/login-action updating to v4.5.2 (with v4.6.0 pending), but this workflow pins docker/login-action to a ref annotated as v4.6.0. Please reconcile the intended version (either update the PR description, or pin this workflow to the v4.5.2 SHA and annotate accordingly) so reviewers can verify the dependency bump.
This issue also appears on line 272 of the same file.
- name: Login to DHI Registry
if: inputs.enable-dhi-login
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
- Files reviewed: 53/53 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
42cfbb5 to
1f02292
Compare
There was a problem hiding this comment.
🟡 Not ready to approve
The pypa/gh-action-pypi-publish pin is updated to v1.14.2 while the PR description indicates v1.14.1, so the intended target version needs clarification for accurate review and auditability.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (2)
workflow-templates/python-publish-pypi.yml:114
- PR description table says pypa/gh-action-pypi-publish is updated to v1.14.1 (with v1.14.2 pending), but this workflow template is already pinned to v1.14.2. Please either update the PR description to match the actual pin, or revert the pin to the intended version so reviewers can audit the change accurately.
.github/workflows/python-publish-pypi.yml:162 - PR description table says pypa/gh-action-pypi-publish is updated to v1.14.1 (with v1.14.2 pending), but this reusable workflow is pinned to v1.14.2. Please either update the PR description to match the actual pin, or revert the pin to the intended version so the dependency update is unambiguous.
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
- Files reviewed: 53/53 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
1f02292 to
1dfd9db
Compare
There was a problem hiding this comment.
🟡 Not ready to approve
The pinned versions in the workflows do not match the PR description’s stated target versions and “patch only” claim, so the PR metadata should be corrected for accuracy.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
Suppressed comments (1)
workflow-templates/python-security-analysis.yml:122
- PR description says the github/codeql-action update is v4.37.0 → v4.37.3, but this workflow pins CodeQL to v4.37.4 (SHA f205ea1c...). Please update the PR description table and the "patch update only" wording to reflect the actual versions being pinned, or adjust the pins to match the stated target version.
- Files reviewed: 53/53 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
1dfd9db to
9bec131
Compare
|
There was a problem hiding this comment.
🟢 Ready to approve
The changes are limited to updating SHA-pinned action references and no functional issues were identified in the modified workflow YAML sections.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
- Files reviewed: 53/53 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
v7.0.25→v7.1.127138816→22918119c091bb→3d3c42ev1.0.171→v1.0.183v4.4.0→v4.6.0v4.37.0→v4.37.4v3.3.0→v3.4.0v2.4.3→v2.4.4v1.14.0→v1.14.2v3.4.0→v3.5.0v3.0.1→v3.0.2Impact
Acceptance Criteria
Testing
Notes
Release Notes
ByronWilliamsCPA/.github (ByronWilliamsCPA/.github)
v7.1.12Compare Source
v7.1.11Compare Source
v7.1.10Compare Source
v7.1.9Compare Source
v7.1.8Compare Source
v7.1.7Compare Source
v7.1.6Compare Source
v7.1.5Compare Source
v7.1.4Compare Source
v7.1.3Compare Source
v7.1.2Compare Source
v7.1.1Compare Source
v7.1.0Compare Source
v7.0.26Compare Source
anthropics/claude-code-action (anthropics/claude-code-action)
v1.0.183Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.183
v1.0.182Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.182
v1.0.181Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.181
v1.0.180Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.180
v1.0.179Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.179
v1.0.178Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.178
v1.0.177Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.177
v1.0.176Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.176
v1.0.175Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.175
v1.0.174Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.174
v1.0.173Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.173
v1.0.172Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.172
docker/login-action (docker/login-action)
v4.6.0Compare Source
Full Changelog: docker/login-action@v4.5.2...v4.6.0
v4.5.2Compare Source
Full Changelog: docker/login-action@v4.5.1...v4.5.2
v4.5.1Compare Source
dhi.ioas Docker Hub OIDC registry by @crazy-max in #1054Full Changelog: docker/login-action@v4.5.0...v4.5.1
v4.5.0Compare Source
Full Changelog: docker/login-action@v4.4.0...v4.5.0
github/codeql-action (github/codeql-action)
v4.37.4Compare Source
toolsinput for thecodeql-action/initstep to be specified using agithub-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value totoolcacheto always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided fortoolsin the workflow definition always takes precedence unless the value of the repository property starts with!. #4037v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
hadolint/hadolint-action (hadolint/hadolint-action)
v3.4.0Compare Source
Features
ossf/scorecard-action (ossf/scorecard-action)
v2.4.4Compare Source
What's Changed
This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.
Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4
pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)
v1.14.2Compare Source
This one probably won't touch you visibly so just bookmark @webknjaz's EuroPython 2026 “AI” slop rant for when it's published on YouTube or encourage him to come back with more to share next year!
🛠️ Urgh… Another release!? Again? Explain yourself!
Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.
🧐 Tell me why..
The rest of the updates bump things related to
pypi-attestationsandsigstore, which has the most interesting backstory here. @facutuesca💰 sent a patch in #417 but a bunch more helped out.TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23.
On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.
I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.
Over the course of investigation, @facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.
Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.
🫶 New Contributors
🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2
🧔♂️ Release Manager: @webknjaz 🇺🇦
🙏 Special Thanks to @davidbrochart💰 and @Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @miketheman💰 confirmed the Warehouse-side details. Also, @jku💰 and @woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.
💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.
v1.14.1Compare Source
This release was cut at EuroPython 2026 Sprints
🛠️ Internal Dependencies
@adisivaprasad💰 helped get rid of the GitHub Actions runner warning about the old Node 20 runtime being used by updating
actions/setup-pythonfrom v5.6.0 to v6.2.0 in #408.💪 New Contributors
🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.0...v1.14.1
🧔♂️ Release Manager: @webknjaz 🇺🇦
🙏 Special Thanks to @jylenhof💰 for reminding me to work on this release!
💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.
sigstore/gh-action-sigstore-python (sigstore/gh-action-sigstore-python)
v3.5.0Compare Source
What's Changed
Full Changelog: sigstore/gh-action-sigstore-python@v3.4.0...v3.5.0
softprops/action-gh-release (softprops/action-gh-release)
v3.0.2Compare Source
3.0.2is a patch release focused on release reliability and compatibility. Itreuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since
3.0.1.This release fixes #795, #438, and #803. The upload transport hardening covers the
historical failure reported in #790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #786 and does not
claim a reproducible release-creation fix.
What's Changed
Exciting New Features 🎉
Bug fixes 🐛
Other Changes 🔄
3.0.1Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.