chore(deps): update GitHub Actions - #66
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR repins organization-level reusable workflows and advances action pins across CI workflows: runner hardening and checkout actions, specialized tooling (CodeQL, SARIF, SonarCloud, setup-uv), and multiple reusable workflow SHAs. No job logic or inputs changed. ChangesGitHub Actions and Reusable Workflow Pin Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Updates pinned GitHub Actions (and org-level reusable workflow references) across this repository’s CI/security automation to pick up upstream fixes and security patches while keeping actions pinned to immutable SHAs.
Changes:
- Bump
step-security/harden-runnertov2.19.4in all relevant workflows. - Bump
actions/checkouttov6.0.3, andgithub/codeql-actiontov4.36.1where used. - Update
ByronWilliamsCPA/.githubreusable workflow call sites to the latest digest; bump Sonar scan action tov8.1.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/validate-cruft.yml | Updates hardened-runner + checkout pins used for cruft template drift validation. |
| .github/workflows/sonarcloud.yml | Updates hardened-runner + checkout pins; bumps Sonar scan action pin used for analysis. |
| .github/workflows/slsa-provenance.yml | Updates hardened-runner + checkout pins; updates org reusable workflow digest for SLSA. |
| .github/workflows/security-analysis.yml | Updates org reusable workflow digest for the security analysis workflow. |
| .github/workflows/scorecard.yml | Updates org reusable workflow digest for OpenSSF Scorecard runs. |
| .github/workflows/sbom.yml | Updates org reusable workflow digest for SBOM/security generation. |
| .github/workflows/reuse.yml | Updates org reusable workflow digest; updates hardened-runner pin for the gate job. |
| .github/workflows/release.yml | Updates org reusable workflow digest used by the release pipeline. |
| .github/workflows/release-sign.yml | Updates hardened-runner + checkout pins used for release artifact signing. |
| .github/workflows/qlty.yml | Updates org reusable workflow digest for Qlty coverage upload. |
| .github/workflows/python-compatibility.yml | Updates org reusable workflow digest for the Python version matrix workflow. |
| .github/workflows/publish-pypi.yml | Updates org reusable workflow digest for PyPI publishing. |
| .github/workflows/pr-validation.yml | Updates org reusable workflow digest; updates hardened-runner + checkout pins for extra PR checks. |
| .github/workflows/pr-title.yml | Updates hardened-runner pin used for PR title enforcement. |
| .github/workflows/fips-compatibility.yml | Updates hardened-runner + checkout pins used in FIPS compatibility jobs. |
| .github/workflows/dependency-review.yml | Updates hardened-runner + checkout pins used for dependency review. |
| .github/workflows/coverage.yml | Updates org reusable workflow digest for coverage upload workflow. |
| .github/workflows/codeql.yml | Updates hardened-runner + checkout pins; bumps CodeQL action pins used for analysis. |
| .github/workflows/codecov.yml | Updates org reusable workflow digest; updates hardened-runner pin for failure-report job. |
| .github/workflows/cifuzzy.yml | Updates hardened-runner + checkout pins; bumps CodeQL upload-sarif action pin. |
| .github/workflows/ci.yml | Updates org reusable workflow digest; updates hardened-runner pin for CI gate job. |
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | ||
| uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 | ||
| with: |
3826370 to
b505b5a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
55-67:⚠️ Potential issue | 🟠 MajorRestrict
secrets: inheritfor the reusable release workflow call.In
.github/workflows/release.yml, line 67 usessecrets: inherit, which forwards all caller-available secrets toByronWilliamsCPA/.github/.github/workflows/python-release.yml@88514d9bd65030debb458cb03ab953cf44f64675. Switch to an explicitsecrets:allowlist (only the specific secret names required) to minimize blast radius.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 55 - 67, The reusable workflow invocation using the step with "uses: ByronWilliamsCPA/.github/.github/workflows/python-release.yml@88514d9bd65030debb458cb03ab953cf44f64675" currently sets "secrets: inherit" — replace this with an explicit secrets allowlist by listing only the exact secret keys the reusable workflow needs (e.g., GITHUB_TOKEN, PYPI_API_TOKEN or whichever specific names the python-release workflow expects) under a "secrets:" mapping instead of inheriting all caller secrets; update the call site where "secrets: inherit" appears to a block like "secrets: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}, PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} }" tailored to the actual required secret names.Sources: Coding guidelines, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cifuzzy.yml:
- Around line 50-52: The workflow currently uses the actions/checkout step
(uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) without
disabling credential persistence; update the Checkout repository step to set
persist-credentials: false to prevent the GITHUB_TOKEN from being written to the
checked-out repository's git config so credentials are not persisted for later
steps.
In @.github/workflows/pr-validation.yml:
- Around line 57-58: The checkout steps using actions/checkout (the steps with
"uses: actions/checkout@df4cb1c0..." and the second checkout at lines referenced
in the PR) must set persist-credentials: false to avoid leaving token-backed git
credentials for later steps; update both checkout steps (the steps that call
actions/checkout) to include the input persist-credentials: false under their
step definitions so credential persistence is disabled for each job.
In @.github/workflows/release-sign.yml:
- Around line 24-25: The Checkout step using
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 should disable
credential persistence by adding the input persist-credentials: false to that
step (the step named "Checkout" which uses actions/checkout). Update the
checkout step configuration so it does not leave authenticated credentials for
later steps while keeping the same action version.
In @.github/workflows/slsa-provenance.yml:
- Around line 62-66: The checkout step in the SLSA provenance workflow uses
actions/checkout with fetch-depth: 0 but does not disable credential
persistence; update the checkout invocation (the actions/checkout@... step) to
include persist-credentials: false so the GITHUB_TOKEN is not persisted to the
checked-out repository when the workflow has contents: write permissions.
In @.github/workflows/validate-cruft.yml:
- Around line 44-45: The checkout step currently uses actions/checkout without
disabling credential persistence; update the "Checkout repository" step (the
actions/checkout@... usage) to include a with: block setting
persist-credentials: false so git credentials are not written to the local git
config after checkout.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 55-67: The reusable workflow invocation using the step with "uses:
ByronWilliamsCPA/.github/.github/workflows/python-release.yml@88514d9bd65030debb458cb03ab953cf44f64675"
currently sets "secrets: inherit" — replace this with an explicit secrets
allowlist by listing only the exact secret keys the reusable workflow needs
(e.g., GITHUB_TOKEN, PYPI_API_TOKEN or whichever specific names the
python-release workflow expects) under a "secrets:" mapping instead of
inheriting all caller secrets; update the call site where "secrets: inherit"
appears to a block like "secrets: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }},
PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} }" tailored to the actual required
secret names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8aa35ab5-7015-4c3d-a859-8ab6909ffe91
📒 Files selected for processing (22)
.github/workflows/ci.yml.github/workflows/cifuzzy.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/pr-title.yml.github/workflows/pr-validation.yml.github/workflows/publish-pypi.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release-sign.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml.github/workflows/validate-cruft.yml
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
|
|
There was a problem hiding this comment.
Disable credential persistence in checkout.
Line 51 checks out code without persist-credentials: false, so the token can remain in local git config for later steps in this job.
Suggested fix
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: falseAs per coding guidelines, files under .github/workflows/** must follow security best practices including proper secret handling.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 50-51: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cifuzzy.yml around lines 50 - 52, The workflow currently
uses the actions/checkout step (uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) without disabling
credential persistence; update the Checkout repository step to set
persist-credentials: false to prevent the GITHUB_TOKEN from being written to the
checked-out repository's git config so credentials are not persisted for later
steps.
Sources: Coding guidelines, Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
Set persist-credentials: false on both checkout steps.
Line 58 and Line 100 use actions/checkout without disabling credential persistence, which keeps token-backed git auth available to later steps in each job.
Suggested fix
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: false
@@
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: falseAs per coding guidelines, .github/workflows/** must enforce security best practices and proper secret handling.
Also applies to: 99-100
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 57-58: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml around lines 57 - 58, The checkout steps
using actions/checkout (the steps with "uses: actions/checkout@df4cb1c0..." and
the second checkout at lines referenced in the PR) must set persist-credentials:
false to avoid leaving token-backed git credentials for later steps; update both
checkout steps (the steps that call actions/checkout) to include the input
persist-credentials: false under their step definitions so credential
persistence is disabled for each job.
Sources: Coding guidelines, Linters/SAST tools
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/release-sign.yml"
echo "---- File: $FILE ----"
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,120p'
else
echo "Missing file: $FILE"
fi
echo
echo "---- Search persist-credentials in $FILE ----"
rg -n "persist-credentials" "$FILE" || true
echo
echo "---- Show job permissions for file (best-effort) ----"
rg -n "permissions:" "$FILE" -n || trueRepository: ByronWilliamsCPA/audio-processor
Length of output: 188
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/release-sign.yml"
echo "---- File: $FILE ----"
if [ -f "$FILE" ]; then
awk '{printf "%5d %s\n", NR, $0}' "$FILE" | sed -n '1,140p'
else
echo "Missing file: $FILE"
fi
echo
echo "---- Search persist-credentials in $FILE ----"
rg -n "persist-credentials" "$FILE" || true
echo
echo "---- Search permissions contents in $FILE (with context) ----"
rg -n "permissions:|contents:" "$FILE" -C 2 || trueRepository: ByronWilliamsCPA/audio-processor
Length of output: 4021
🌐 Web query:
actions/checkout persist-credentials default value v6 writes credentials to local git config
💡 Result:
The default value for the persist-credentials input in actions/checkout is true [1][2]. Starting with version 6.0.0, the implementation of persist-credentials was updated to improve security [3][4]. Instead of writing the authentication token directly into the local.git/config file, the action now stores the credentials in a separate file located under $RUNNER_TEMP [1][3][4]. This change helps secure the credentials while maintaining the same default behavior, allowing scripts to continue executing authenticated git commands without requiring changes to existing workflows [1][3]. The token is still removed during post-job cleanup [1][5][6].
Citations:
- 1: https://github.com/actions/checkout/?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/master/action.yml
- 3: https://github.com/actions/checkout/tree/v6.0.0
- 4: actions/checkout@v5.0.1...v6.0.0
- 5: https://github.com/actions/checkout
- 6: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
Disable checkout credential persistence in release signing job.
actions/checkout defaults persist-credentials: true, so with the job’s contents: write permission it provisions authenticated credentials for subsequent steps (v6 stores them under $RUNNER_TEMP, cleaned up after the job). This job doesn’t need git auth after checkout, so disable persistence.
Suggested patch
- name: Checkout
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-sign.yml around lines 24 - 25, The Checkout step
using actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 should disable
credential persistence by adding the input persist-credentials: false to that
step (the step named "Checkout" which uses actions/checkout). Update the
checkout step configuration so it does not leave authenticated credentials for
later steps while keeping the same action version.
Sources: Coding guidelines, Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
There was a problem hiding this comment.
Disable persisted GitHub token for checkout in SLSA provenance workflow.
In .github/workflows/slsa-provenance.yml, the checkout step only sets fetch-depth: 0 and does not disable token persistence, while the workflow grants contents: write (Line 25). Add persist-credentials: false to reduce token exposure.
Suggested patch
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 62-65: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/slsa-provenance.yml around lines 62 - 66, The checkout
step in the SLSA provenance workflow uses actions/checkout with fetch-depth: 0
but does not disable credential persistence; update the checkout invocation (the
actions/checkout@... step) to include persist-credentials: false so the
GITHUB_TOKEN is not persisted to the checked-out repository when the workflow
has contents: write permissions.
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/validate-cruft.yml"
echo "== File: $FILE =="
ls -la "$FILE" 2>/dev/null || { echo "Missing file: $FILE"; exit 1; }
echo
echo "== Lines 35-70 =="
nl -ba "$FILE" | sed -n '35,70p'Repository: ByronWilliamsCPA/audio-processor
Length of output: 292
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/validate-cruft.yml"
echo "== File: $FILE =="
ls -la "$FILE" 2>/dev/null || { echo "Missing file: $FILE"; exit 1; }
echo
echo "== Lines 35-70 (cat -n) =="
cat -n "$FILE" | sed -n '35,70p'Repository: ByronWilliamsCPA/audio-processor
Length of output: 1983
Set persist-credentials: false for the checkout step in validate-cruft.
actions/checkout at line 45 lacks with: persist-credentials: false, so credentials are still persisted to the git config (default behavior).
Suggested patch
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 44-45: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/validate-cruft.yml around lines 44 - 45, The checkout step
currently uses actions/checkout without disabling credential persistence; update
the "Checkout repository" step (the actions/checkout@... usage) to include a
with: block setting persist-credentials: false so git credentials are not
written to the local git config after checkout.
Sources: Coding guidelines, Linters/SAST tools
2fa8e9d to
9ae2d87
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
67-67: 🧹 Nitpick | 🔵 TrivialConsider explicitly passing required secrets instead of inheriting all.
Line 67 uses
secrets: inherit, which passes all repository secrets to the reusable workflow. This increases the attack surface if the reusable workflow is compromised. Other workflows in this repository follow a more secure pattern by explicitly passing only the secrets they need (e.g.,sbom.ymlpasses onlyINFISICAL_CLIENT_IDandINFISICAL_CLIENT_SECRET;scorecard.ymlpasses onlySCORECARD_TOKEN).Verify which secrets the pinned
python-release.ymlreusable workflow actually requires, then update to explicitly pass only those secrets:secrets: SECRET_NAME_1: ${{ secrets.SECRET_NAME_1 }} SECRET_NAME_2: ${{ secrets.SECRET_NAME_2 }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml at line 67, Replace the broad "secrets: inherit" usage when calling the pinned reusable workflow (python-release.yml) with an explicit list of only the secrets that workflow requires: inspect the pinned python-release.yml invocation and its usage to determine the required secrets, then replace "secrets: inherit" with a mapped block like "secrets: SECRET_A: ${{ secrets.SECRET_A }} SECRET_B: ${{ secrets.SECRET_B }}" so only those specific secrets are passed to the reusable workflow instead of inheriting all repository secrets.Sources: Coding guidelines, Linters/SAST tools
♻️ Duplicate comments (4)
.github/workflows/slsa-provenance.yml (1)
62-65:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable persisted GitHub token for checkout in SLSA provenance workflow.
The checkout step only sets
fetch-depth: 0and does not disable token persistence, while the workflow grantscontents: write(Line 25). Addpersist-credentials: falseto reduce token exposure.🔒 Suggested patch
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/slsa-provenance.yml around lines 62 - 65, The checkout step named "Checkout repository" (uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) currently sets fetch-depth: 0 but does not disable credential persistence; update that step to add persist-credentials: false so the GitHub token is not stored in the checked-out repository (reduce credential exposure when the workflow has contents: write).Sources: Coding guidelines, Linters/SAST tools
.github/workflows/cifuzzy.yml (1)
50-52:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable credential persistence in checkout.
Line 51 checks out code without
persist-credentials: false, so the token can remain in local git config for later steps in this job.🔒 Suggested fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cifuzzy.yml around lines 50 - 52, The checkout step named "Checkout repository" is missing persist-credentials: false and may leave the workflow token in local git config; update the actions/checkout@... step (the step with name "Checkout repository" that uses actions/checkout) to include persist-credentials: false so credentials are not persisted to the checked-out repository, ensuring subsequent steps cannot access the workflow token from git config.Sources: Coding guidelines, Linters/SAST tools
.github/workflows/validate-cruft.yml (1)
44-45:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet
persist-credentials: falsefor the checkout step.
actions/checkoutdefaults to persisting credentials. This job doesn't need git authentication after checkout, so disable credential persistence.🛡️ Proposed fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate-cruft.yml around lines 44 - 45, The checkout step named "Checkout repository" currently uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10; update that step to include persist-credentials: false so git credentials are not persisted after checkout. Locate the step with name "Checkout repository" and the uses entry referencing actions/checkout and add the persist-credentials: false key under that step’s configuration.Source: Linters/SAST tools
.github/workflows/release-sign.yml (1)
24-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable checkout credential persistence in release signing job.
actions/checkoutdefaultspersist-credentials: true, so with the job'scontents: writepermission it provisions authenticated credentials for subsequent steps. This job doesn't need git auth after checkout, so disable persistence.🛡️ Proposed fix
- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-sign.yml around lines 24 - 25, The checkout step uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 and currently leaves credential persistence enabled; update that step to explicitly set persist-credentials: false so the job does not retain authenticated git credentials after checkout (ensure you add the persist-credentials: false key under the Checkout step that references actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10).Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release.yml:
- Line 67: Replace the broad "secrets: inherit" usage when calling the pinned
reusable workflow (python-release.yml) with an explicit list of only the secrets
that workflow requires: inspect the pinned python-release.yml invocation and its
usage to determine the required secrets, then replace "secrets: inherit" with a
mapped block like "secrets: SECRET_A: ${{ secrets.SECRET_A }} SECRET_B: ${{
secrets.SECRET_B }}" so only those specific secrets are passed to the reusable
workflow instead of inheriting all repository secrets.
---
Duplicate comments:
In @.github/workflows/cifuzzy.yml:
- Around line 50-52: The checkout step named "Checkout repository" is missing
persist-credentials: false and may leave the workflow token in local git config;
update the actions/checkout@... step (the step with name "Checkout repository"
that uses actions/checkout) to include persist-credentials: false so credentials
are not persisted to the checked-out repository, ensuring subsequent steps
cannot access the workflow token from git config.
In @.github/workflows/release-sign.yml:
- Around line 24-25: The checkout step uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 and currently leaves
credential persistence enabled; update that step to explicitly set
persist-credentials: false so the job does not retain authenticated git
credentials after checkout (ensure you add the persist-credentials: false key
under the Checkout step that references
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10).
In @.github/workflows/slsa-provenance.yml:
- Around line 62-65: The checkout step named "Checkout repository" (uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10) currently sets
fetch-depth: 0 but does not disable credential persistence; update that step to
add persist-credentials: false so the GitHub token is not stored in the
checked-out repository (reduce credential exposure when the workflow has
contents: write).
In @.github/workflows/validate-cruft.yml:
- Around line 44-45: The checkout step named "Checkout repository" currently
uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10; update that step
to include persist-credentials: false so git credentials are not persisted after
checkout. Locate the step with name "Checkout repository" and the uses entry
referencing actions/checkout and add the persist-credentials: false key under
that step’s configuration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0fe68b30-8fdd-47c0-8157-6da18d5d50ee
📒 Files selected for processing (22)
.github/workflows/ci.yml.github/workflows/cifuzzy.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/pr-title.yml.github/workflows/pr-validation.yml.github/workflows/publish-pypi.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release-sign.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml.github/workflows/validate-cruft.yml
c1c13d2 to
226e984
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (5)
.github/workflows/pr-validation.yml (1)
58-58:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet
persist-credentials: falseon both checkout steps.Lines 58 and 100 use
actions/checkoutwithout disabling credential persistence, which keeps token-backed git auth available to later steps in each job.🔒 Suggested fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: falseApply the same fix at line 100.
As per coding guidelines,
.github/workflows/**must enforce security best practices and proper secret handling.Also applies to: 100-100
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-validation.yml at line 58, The checkout steps using "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" must disable credential persistence; update both checkout steps (the occurrences of actions/checkout in the workflow) to add the input "persist-credentials: false" so the token-backed git auth is not left available to later steps—apply the same change to the second checkout occurrence referenced in the comment.Source: Coding guidelines
.github/workflows/slsa-provenance.yml (1)
62-65:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable persisted GitHub token for checkout in SLSA provenance workflow.
The checkout step does not set
persist-credentials: falsewhile the workflow grantscontents: write(Line 25). Addpersist-credentials: falseto prevent token exposure in the checked-out repository's git config.🔒 Suggested fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 + persist-credentials: falseAs per coding guidelines, files under
.github/workflows/**must follow security best practices including proper secret handling.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/slsa-provenance.yml around lines 62 - 65, The checkout step named "Checkout repository" uses actions/checkout@... but does not disable persisted credentials; update the checkout step (the "Checkout repository" block using actions/checkout) to add persist-credentials: false so the token granted by the workflow (contents: write) is not written into the repo git config; keep existing options like fetch-depth: 0 unchanged and ensure the new persist-credentials: false line is added under the with: block for the actions/checkout step.Sources: Coding guidelines, Linters/SAST tools
.github/workflows/cifuzzy.yml (1)
50-51:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable credential persistence in checkout.
The checkout step does not set
persist-credentials: false, allowing the GITHUB_TOKEN to remain in local git config for subsequent steps.🔒 Suggested fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: falseAs per coding guidelines, files under
.github/workflows/**must follow security best practices including proper secret handling.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cifuzzy.yml around lines 50 - 51, The checkout step currently uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 without disabling credential persistence; update the Checkout repository step (the uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 entry) to include a with: persist-credentials: false mapping so the GITHUB_TOKEN is not written to local git config and won't persist to subsequent steps.Sources: Coding guidelines, Linters/SAST tools
.github/workflows/validate-cruft.yml (1)
44-45:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet
persist-credentials: falsefor the checkout step.
actions/checkoutdefaultspersist-credentials: true, storing authenticated credentials under$RUNNER_TEMP(v6 behavior) for subsequent steps. This job only needs repository files for cruft validation and doesn't perform git operations after checkout, so credentials should be disabled.🔒 Proposed fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate-cruft.yml around lines 44 - 45, The checkout step currently uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (v6.0.3) and leaves persisted credentials enabled; update the Checkout repository step to explicitly set persist-credentials: false so authenticated credentials are not stored in $RUNNER_TEMP (modify the step that uses actions/checkout to include the persist-credentials: false key)..github/workflows/release-sign.yml (1)
24-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable checkout credential persistence in release signing job.
actions/checkoutdefaultspersist-credentials: true, provisioning authenticated credentials for subsequent steps (stored under$RUNNER_TEMPin v6, cleaned up after the job). This job hascontents: writepermission but doesn't need git auth after checkout—only artifact download and signing operations.🔒 Proposed fix
- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-sign.yml around lines 24 - 25, Update the Checkout step that uses actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (the "Checkout" step) to disable credential persistence by adding the persist-credentials: false input so the job does not leave authenticated git credentials for later steps; modify the step that references actions/checkout to include persist-credentials: false while keeping existing settings.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/coverage.yml:
- Line 26: The workflow currently pins the reusable workflow via the uses line
referencing
ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@671ea6d3bad0d0df346b6b401144e05a48172202,
but the PR text intends to target commit 2250ad2
(2250ad2bef7979c21ec1d0c23cfabec0b8880688); update the SHA in the uses reference
to the intended 2250ad2 full commit or change the PR description to reflect the
existing pinned SHA so they match; locate the uses entry in
.github/workflows/coverage.yml and replace the trailing commit ref or adjust the
PR message accordingly.
---
Duplicate comments:
In @.github/workflows/cifuzzy.yml:
- Around line 50-51: The checkout step currently uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 without disabling
credential persistence; update the Checkout repository step (the uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 entry) to include a
with: persist-credentials: false mapping so the GITHUB_TOKEN is not written to
local git config and won't persist to subsequent steps.
In @.github/workflows/pr-validation.yml:
- Line 58: The checkout steps using "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" must disable
credential persistence; update both checkout steps (the occurrences of
actions/checkout in the workflow) to add the input "persist-credentials: false"
so the token-backed git auth is not left available to later steps—apply the same
change to the second checkout occurrence referenced in the comment.
In @.github/workflows/release-sign.yml:
- Around line 24-25: Update the Checkout step that uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (the "Checkout" step)
to disable credential persistence by adding the persist-credentials: false input
so the job does not leave authenticated git credentials for later steps; modify
the step that references actions/checkout to include persist-credentials: false
while keeping existing settings.
In @.github/workflows/slsa-provenance.yml:
- Around line 62-65: The checkout step named "Checkout repository" uses
actions/checkout@... but does not disable persisted credentials; update the
checkout step (the "Checkout repository" block using actions/checkout) to add
persist-credentials: false so the token granted by the workflow (contents:
write) is not written into the repo git config; keep existing options like
fetch-depth: 0 unchanged and ensure the new persist-credentials: false line is
added under the with: block for the actions/checkout step.
In @.github/workflows/validate-cruft.yml:
- Around line 44-45: The checkout step currently uses
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 (v6.0.3) and leaves
persisted credentials enabled; update the Checkout repository step to explicitly
set persist-credentials: false so authenticated credentials are not stored in
$RUNNER_TEMP (modify the step that uses actions/checkout to include the
persist-credentials: false key).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 12b8cfc2-06f6-4567-bf61-233a158e19d3
📒 Files selected for processing (22)
.github/workflows/ci.yml.github/workflows/cifuzzy.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/pr-title.yml.github/workflows/pr-validation.yml.github/workflows/publish-pypi.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release-sign.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml.github/workflows/validate-cruft.yml
62f2a62 to
35adcce
Compare
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
.github/workflows/pr-validation.yml (1)
59-59:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet
persist-credentials: falseon checkout steps.Both checkout actions should disable credential persistence to prevent token-backed git auth from remaining available to subsequent steps.
🔒 Recommended fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: falseApply the same fix to both checkout steps at lines 59 and 101.
Also applies to: 101-101
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-validation.yml at line 59, The checkout steps using "uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" must disable credential persistence; add the input persist-credentials: false to both checkout steps (the two occurrences of actions/checkout) so token-backed Git auth is not left available to subsequent steps, ensuring each checkout step includes persist-credentials: false alongside its uses declaration.Source: Linters/SAST tools
.github/workflows/validate-cruft.yml (1)
44-45:⚠️ Potential issue | 🟠 Major | ⚡ Quick winSet
persist-credentials: falsefor checkout in cruft validation.
actions/checkoutdefaults to persisting credentials, but this job only validates template sync viacruft checkand doesn't require git authentication after checkout.🔒 Suggested fix
- name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate-cruft.yml around lines 44 - 45, The checkout step currently uses actions/checkout@... and leaves credentials persisted; update the checkout step that uses actions/checkout (the step named "Checkout repository") to include persist-credentials: false so the job does not retain Git credentials after checkout (this is for the cruft validation job which only needs a local copy for cruft check).Source: Linters/SAST tools
.github/workflows/release-sign.yml (1)
24-25:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDisable checkout credential persistence in release signing job.
actions/checkoutdefaultspersist-credentials: true, so credentials remain available to subsequent steps. This job doesn't need git auth after checkout (it usesGH_TOKENfrom secrets for CLI operations).🔒 Suggested fix
- name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-sign.yml around lines 24 - 25, The checkout step currently uses actions/checkout@... which leaves git credentials persisted; update the Checkout step (the actions/checkout invocation) to set persist-credentials: false so credentials are not left available to later steps in the release-sign job (the job uses GH_TOKEN from secrets for CLI operations and does not require persisted auth). Ensure the options are added to the checkout step so subsequent steps cannot access the runner's git credentials.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/coverage.yml:
- Line 26: The reusable-workflow SHA pinned in the uses line currently
references 7198a499e8ac9a16b65548c312363a81bae4b4b6 but the PR intent targets
987d517d3c8e4b180f4dd15de6d9575f0df91182; pick the correct intended revision and
update the hex in the uses string (the value after
ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@) so the
pinned SHA matches the PR description, then commit the change and update the PR
description if you instead prefer to keep the existing SHA.
---
Duplicate comments:
In @.github/workflows/pr-validation.yml:
- Line 59: The checkout steps using "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" must disable
credential persistence; add the input persist-credentials: false to both
checkout steps (the two occurrences of actions/checkout) so token-backed Git
auth is not left available to subsequent steps, ensuring each checkout step
includes persist-credentials: false alongside its uses declaration.
In @.github/workflows/release-sign.yml:
- Around line 24-25: The checkout step currently uses actions/checkout@... which
leaves git credentials persisted; update the Checkout step (the actions/checkout
invocation) to set persist-credentials: false so credentials are not left
available to later steps in the release-sign job (the job uses GH_TOKEN from
secrets for CLI operations and does not require persisted auth). Ensure the
options are added to the checkout step so subsequent steps cannot access the
runner's git credentials.
In @.github/workflows/validate-cruft.yml:
- Around line 44-45: The checkout step currently uses actions/checkout@... and
leaves credentials persisted; update the checkout step that uses
actions/checkout (the step named "Checkout repository") to include
persist-credentials: false so the job does not retain Git credentials after
checkout (this is for the cruft validation job which only needs a local copy for
cruft check).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 41b198ea-5fe5-4d87-862d-bfd13ce7143a
📒 Files selected for processing (22)
.github/workflows/ci.yml.github/workflows/cifuzzy.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/pr-title.yml.github/workflows/pr-validation.yml.github/workflows/publish-pypi.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release-sign.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/scorecard.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml.github/workflows/validate-cruft.yml
88f8b89 to
c1368b6
Compare
e39863f to
84b3eac
Compare
|
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
799ebd6→7d12f54v8.0.0→v8.2.1v4.1.0→v4.1.1v6.0.2→v6.1.0v6.2.0→v6.3.0v8.1.0→v8.3.2v4.35.5→v4.37.4v2.8.0→v2.9.0v2.19.3→v2.20.0Impact
Acceptance Criteria
Testing
Notes
Release Notes
SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)
v8.2.1Compare Source
What's Changed
Bug fix
Full Changelog: SonarSource/sonarqube-scan-action@v8.2.0...v8.2.1
v8.2.0Compare Source
What's Changed
Full Changelog: SonarSource/sonarqube-scan-action@v8...v8.2.0
v8.2Compare Source
v8.1.0Compare Source
What's Changed
Full Changelog: SonarSource/sonarqube-scan-action@v8...v8.1.0
v8.1Compare Source
actions/attest-build-provenance (actions/attest-build-provenance)
v4.1.1Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1
actions/checkout (actions/checkout)
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
v6.0.3Compare Source
actions/setup-python (actions/setup-python)
v6.3.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation
New Contributors
Full Changelog: actions/setup-python@v6.2.0...v6.3.0
astral-sh/setup-uv (astral-sh/setup-uv)
v8.3.2: 🌈 update known checksums for 0.11.28Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.1: 🌈 update known checksums for 0.11.27Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
v8.3.0: 🌈 Support uv.lock as a version-file sourceCompare Source
Changes
Thanks to @somaz94 you can now use the pinned version of uv itself in
uv.lock. It gets picked up automatically.If you have pinned another version of uv in your
uv.lockyou can use the inputsversionorversion-sourceto override this.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.2.0: 🌈 New inputsquietanddownload-from-astral-mirrorCompare Source
Changes
This release brings two new inputs and a few bug fixes.
New inputs
Lets talk about the new inputs first.
quiet
Pretty simple. It turns of all
infologgings. Useful if you use this in a composite action and are not interested in all the details.In the upcoming releases we will add log groups to fully implement support for "less noise"
download-from-astral-mirror
In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting
download-from-astral-mirror: falseallows you to do that.Bugfixes
When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.
We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.
🐛 Bug fixes
🚀 Enhancements
download-from-astral-mirrorinput @eifinger (#897)🧰 Maintenance
⬆️ Dependency updates
github/codeql-action (github/codeql-action)
v4.37.4Compare Source
toolsinput for thecodeql-action/initstep to be specified using agithub-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value totoolcacheto always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided fortoolsin the workflow definition always takes precedence unless the value of the repository property starts with!. #4037v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@​ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
v4.36.2Compare Source
v4.36.1Compare Source
No user facing changes.
v4.36.0Compare Source
lycheeverse/lychee-action (lycheeverse/lychee-action)
v2.9.0Compare Source
Summary
This release updates the default lychee version from
v0.23.0tov0.24.2.The main reason for this release is compatibility with the new lychee
0.24.xrelease artifacts. Starting with lycheev0.24.0, the archive layout changed, and thelycheebinary may now be packaged inside a subdirectory.lychee-actionnow detects that layout automatically, so users can upgrade without changing their workflows.If you use:
you will get the new version once the floating
v2tag has been updated. If you pin exact versions, update to:What’s new from lychee
v0.24.xBetter diagnostics
lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.
Text fragment checking
lychee can now check URL text fragments, such as links containing
#:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.Sitemap support
lychee can now read
sitemap.xmlinputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.JUnit output
lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.
Redirect and remap visibility
lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.
Multiple config files
lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.
Timeout handling
lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.
Fixes and reliability improvements
Fixed lychee
0.24.xarchive compatibilitylychee-actionnow handles the new lychee release archive layout by detecting whether thelycheebinary is inside a subdirectory.This fixes compatibility with lychee
0.24.x.More stable installation path
The action now installs lychee into
$RUNNER_TEMP/lychee/bininstead of$HOME.This avoids failures on runners where
$HOMEdiffers between composite action steps. In those environments, the action could add one directory toPATHbut install the binary somewhere else, causinglychee: command not found.Safer automatic lychee version updates
The workflow that checks for new lychee releases now guards against
nullrelease versions before creating update PRs. This prevents invalid automated PRs such as “Update lycheeVersion to null”.Dependency updates
actions/checkoutfromv6tov7actions/cachefromv5tov6Upstream lychee changelog
For the full lychee changelog, see:
What’s Changed
$RUNNER_TEMPinstead of$HOMEby @mre in #338Full Changelog: lycheeverse/lychee-action@v2.8.0...v2.9.0
step-security/harden-runner (step-security/harden-runner)
v2.20.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0
v2.19.4Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.