chore(deps)!: update GitHub Actions (major) - #70
Conversation
|
Warning Review limit reachedNext included review available in 59 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (4)
WalkthroughNine GitHub Actions workflows update ChangesWorkflow action updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
There was a problem hiding this comment.
Pull request overview
Updates the pinned actions/checkout GitHub Action across this repository’s CI/security workflows to the v7 release series (via a new commit SHA), keeping workflows aligned on the same checkout implementation.
Changes:
- Bumped
actions/checkoutfromv6.0.2tov7(new pinned SHA) in multiple workflows. - Kept existing checkout configuration (e.g.,
fetch-depth,persist-credentials) unchanged where present.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/validate-cruft.yml | Updates checkout action pin to v7 for cruft validation workflow. |
| .github/workflows/sonarcloud.yml | Updates checkout action pin to v7 for SonarCloud analysis workflow. |
| .github/workflows/slsa-provenance.yml | Updates checkout action pin to v7 for SLSA provenance build job. |
| .github/workflows/release-sign.yml | Updates checkout action pin to v7 for release artifact signing workflow. |
| .github/workflows/pr-validation.yml | Updates checkout action pin to v7 for PR validation jobs. |
| .github/workflows/fips-compatibility.yml | Updates checkout action pin to v7 for FIPS compliance checks. |
| .github/workflows/dependency-review.yml | Updates checkout action pin to v7 for dependency review workflow. |
| .github/workflows/codeql.yml | Updates checkout action pin to v7 for CodeQL scanning workflow. |
| .github/workflows/cifuzzy.yml | Updates checkout action pin to v7 for continuous fuzzing workflow. |
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| with: |
dbfbcdb to
46ef537
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cifuzzy.yml:
- Around line 50-51: In the Checkout repository step, the default GitHub token
is still being persisted in the local git config for the rest of the job. Update
the actions/checkout usage in cifuzzy.yml to disable credential persistence by
setting persist-credentials to false, matching the pattern already used in the
other upgraded workflows, and keep the change scoped to the Checkout repository
step.
In @.github/workflows/pr-validation.yml:
- Around line 58-59: The workflow’s Checkout repository step is still persisting
the GitHub token in local git config because actions/checkout defaults to
persist-credentials true. Update both checkout steps in the workflow to
explicitly disable credential persistence by setting persist-credentials to
false on the checkout action, keeping the change tied to the existing Checkout
repository step and actions/checkout usage.
In @.github/workflows/release-sign.yml:
- Around line 24-25: Disable persisted checkout credentials in the signing
workflow by updating the Checkout step in release-sign.yml so actions/checkout
does not write the repo token into .git/config; keep GH_TOKEN for gh separately
and configure the checkout action to avoid persisting credentials in the signing
job.
In @.github/workflows/slsa-provenance.yml:
- Around line 63-65: The checkout step in the SLSA provenance workflow should
stop persisting Git credentials. Update the existing actions/checkout usage in
the workflow job to include persist-credentials set to false while keeping
fetch-depth at 0, since there is no later authenticated git usage in this job.
In @.github/workflows/validate-cruft.yml:
- Around line 44-45: The checkout step in validate-cruft.yml still uses the
default credential persistence, which should be disabled to match the other
updated workflows. Update the actions/checkout usage in the Checkout repository
step to set persist-credentials to false so the job token is not left in local
Git config.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 90bb3408-5f99-4d83-bd93-a2701a4bb40e
📒 Files selected for processing (9)
.github/workflows/cifuzzy.yml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/fips-compatibility.yml.github/workflows/pr-validation.yml.github/workflows/release-sign.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml.github/workflows/validate-cruft.yml
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence.
Line 51 leaves the default GitHub token in the local git config for the rest of the job. Add persist-credentials: false here, as you already do in the other upgraded workflows.
Suggested fix
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 50-51: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cifuzzy.yml around lines 50 - 51, In the Checkout
repository step, the default GitHub token is still being persisted in the local
git config for the rest of the job. Update the actions/checkout usage in
cifuzzy.yml to disable credential persistence by setting persist-credentials to
false, matching the pattern already used in the other upgraded workflows, and
keep the change scoped to the Checkout repository step.
Sources: Path instructions, Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/pr-validation.yml"
echo "Checkout blocks in $file:"
sed -n '48,120p' "$file"
echo
echo "Verify whether these jobs need authenticated git after checkout:"
rg -n -C2 'uses:\s*actions/checkout@|persist-credentials|git\s+(push|fetch|pull|submodule)|gh\s' "$file"Repository: ByronWilliamsCPA/audio-processor
Length of output: 3327
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/pr-validation.yml"
echo "Workflow header and permissions:"
sed -n '1,80p' "$file"
echo
echo "All git/gh/auth-related references in the workflow:"
rg -n -C2 '\b(git|gh|checkout|token|permissions:|persist-credentials)\b' "$file"
echo
echo "Job names and steps summary:"
python3 - <<'PY'
from pathlib import Path
import re
text = Path(".github/workflows/pr-validation.yml").read_text()
for m in re.finditer(r'^\s{2}([A-Za-z0-9_-]+):\n(?:.*\n)*?(?=^\s{2}[A-Za-z0-9_-]+:|\Z)', text, re.M):
job = m.group(1)
block = m.group(0)
steps = re.findall(r'^\s{6}- name: (.+)$', block, re.M)
print(f"{job}:")
for s in steps:
print(f" - {s}")
PYRepository: ByronWilliamsCPA/audio-processor
Length of output: 3740
Disable checkout credential persistence in both jobs.
Both actions/checkout steps leave the workflow token in local git config via the default persist-credentials: true, which is unnecessary here.
Suggested change
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 58-59: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml around lines 58 - 59, The workflow’s
Checkout repository step is still persisting the GitHub token in local git
config because actions/checkout defaults to persist-credentials true. Update
both checkout steps in the workflow to explicitly disable credential persistence
by setting persist-credentials to false on the checkout action, keeping the
change tied to the existing Checkout repository step and actions/checkout usage.
Sources: Path instructions, Linters/SAST tools
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/release-sign.yml"
sed -n '12,40p' "$file"
echo
rg -n -C2 'uses:\s*actions/checkout@|persist-credentials|GH_TOKEN|gh\s' "$file"Repository: ByronWilliamsCPA/audio-processor
Length of output: 2664
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/release-sign.yml"
ast-grep outline "$file" --view expanded || true
echo "-----"
sed -n '1,220p' "$file"
echo "-----"
rg -n 'git |git\W|gh release|checkout|persist-credentials|remote|push|fetch|upload|download|cosign|GH_TOKEN' "$file"Repository: ByronWilliamsCPA/audio-processor
Length of output: 4168
Disable persisted checkout credentials in the signing job.
gh already gets GH_TOKEN explicitly, so actions/checkout should not leave a repo token in .git/config for this workflow.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-sign.yml around lines 24 - 25, Disable persisted
checkout credentials in the signing workflow by updating the Checkout step in
release-sign.yml so actions/checkout does not write the repo token into
.git/config; keep GH_TOKEN for gh separately and configure the checkout action
to avoid persisting credentials in the signing job.
Sources: Path instructions, Linters/SAST tools
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/slsa-provenance.yml"
sed -n '42,90p' "$file"
echo
rg -n -C2 'uses:\s*actions/checkout@|persist-credentials|git\s+(push|fetch|pull|submodule)|gh\s' "$file"Repository: ByronWilliamsCPA/audio-processor
Length of output: 2112
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/slsa-provenance.yml"
echo "== top =="
sed -n '1,120p' "$file"
echo
echo "== checkout / git / gh usage =="
rg -n -C3 'actions/checkout|persist-credentials|git\s+(push|fetch|pull|submodule|config|remote)|gh\s|github-token|token:' "$file"Repository: ByronWilliamsCPA/audio-processor
Length of output: 4839
Disable persisted checkout credentials here. fetch-depth: 0 still works with persist-credentials: false, and this job doesn’t show any authenticated git use after checkout.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 62-65: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/slsa-provenance.yml around lines 63 - 65, The checkout
step in the SLSA provenance workflow should stop persisting Git credentials.
Update the existing actions/checkout usage in the workflow job to include
persist-credentials set to false while keeping fetch-depth at 0, since there is
no later authenticated git usage in this job.
Source: Path instructions
| - name: Checkout repository | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence here as well.
Line 45 keeps checkout's default credential persistence enabled, which is inconsistent with the safer pattern already used in the other bumped workflows. Add persist-credentials: false to avoid leaving the job token in local Git config.
Suggested fix
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 44-45: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/validate-cruft.yml around lines 44 - 45, The checkout step
in validate-cruft.yml still uses the default credential persistence, which
should be disabled to match the other updated workflows. Update the
actions/checkout usage in the Checkout repository step to set
persist-credentials to false so the job token is not left in local Git config.
Sources: Path instructions, Linters/SAST tools
ac864dd to
9ac8b89
Compare
williaby
changed the title
|
9ac8b89 to
85fe62a
Compare
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
v6.0.2→v7.0.1v6.2.0→v7.0.0v8.1.0→v9.0.0Impact
Acceptance Criteria
Testing
Notes
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
v6.0.3Compare Source
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors
Full Changelog: actions/setup-python@v6...v7.0.0
v7Compare Source
v6.3.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation
New Contributors
Full Changelog: actions/setup-python@v6.2.0...v6.3.0
astral-sh/setup-uv (astral-sh/setup-uv)
v9.0.0: 🌈 Changeprune-cachedefault tofalseCompare Source
Changes
This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967
Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.
🚨 Breaking changes
prune-cachedefault tofalse@charliermarsh (#967)🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.2: 🌈 update known checksums for 0.11.28Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.1: 🌈 update known checksums for 0.11.27Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
v8.3.0: 🌈 Support uv.lock as a version-file sourceCompare Source
Changes
Thanks to @somaz94 you can now use the pinned version of uv itself in
uv.lock. It gets picked up automatically.If you have pinned another version of uv in your
uv.lockyou can use the inputsversionorversion-sourceto override this.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.2.0: 🌈 New inputsquietanddownload-from-astral-mirrorCompare Source
Changes
This release brings two new inputs and a few bug fixes.
New inputs
Lets talk about the new inputs first.
quiet
Pretty simple. It turns of all
infologgings. Useful if you use this in a composite action and are not interested in all the details.In the upcoming releases we will add log groups to fully implement support for "less noise"
download-from-astral-mirror
In some cases you may want to directly use the fallback of checking for available versions and downloading releases from GitHub instead of using the astral.sh mirror. Setting
download-from-astral-mirror: falseallows you to do that.Bugfixes
When using the astral.sh mirror to query available versions and download releases (done by default) we now stop sending the GitHub token in the header. The mirror never looked at it but we shouldn't be handing out that data even if it is just a short lived token.
All other bugfixes try to limit the impact of failed GitHub queries due to retries and other faults.
We couldn't pinpoint all rootcauses yet but added more logging for error cases to track them down.
🐛 Bug fixes
🚀 Enhancements
download-from-astral-mirrorinput @eifinger (#897)🧰 Maintenance
⬆️ Dependency updates
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.